dcrat | fc402b8bbe328bc15da197b4f57b67d6fb74530553eb7f6fb2d1aa3d1af64fb6

Analysis

max time kernel
146s
max time network
150s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
27/08/2023, 19:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2b7f820ad4b5f7518071bd730ac2e655.exe
Size 2.5MB
Sample230827-x28cqaef71
SHA256 fc402b8bbe328bc15da197b4f57b67d6fb74530553eb7f6fb2d1aa3d1af64fb6
MD5 2b7f820ad4b5f7518071bd730ac2e655
SHA1 8ff9a5b37c8d8482666707b3f555e071b8298df2
SHA512 99623412cb32c2cffc63e8889089321841468cfe092eb73b02563a64efbf44df095efb98a9ba43b0f0320b784ac595ed2223e8addd578662f8be333ec52d8789
SSDEEP 24576:PFFok8gvLa+c8OFvHh6QaA3JnPN8NTx5cxWpQkQTd315EitgptuOkalH9MWTk8eo:dFzvo1Ta24dx5gWmxrEiC35dk0VjR61
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 10 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\dwm.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\dwm.exe\", \"C:\\Recovery\\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\\explorer.exe\", \"C:\\Recovery\\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\\taskhost.exe\", \"C:\\Users\\Admin\\NetHood\\taskhost.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\dwm.exe\", \"C:\\Recovery\\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\\explorer.exe\", \"C:\\Recovery\\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\\taskhost.exe\", \"C:\\Users\\Admin\\NetHood\\taskhost.exe\", \"C:\\Program Files\\Mozilla Firefox\\fonts\\taskhost.exe\", \"C:\\Windows\\Prefetch\\services.exe\", \"C:\\Recovery\\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\\winlogon.exe\", \"C:\\Program Files\\Windows Journal\\fr-FR\\audiodg.exe\", \"C:\\Users\\Admin\\Desktop\\Idle.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\dwm.exe\", \"C:\\Recovery\\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\\explorer.exe\", \"C:\\Recovery\\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\\taskhost.exe\", \"C:\\Users\\Admin\\NetHood\\taskhost.exe\", \"C:\\Program Files\\Mozilla Firefox\\fonts\\taskhost.exe\", \"C:\\Windows\\Prefetch\\services.exe\", \"C:\\Recovery\\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\\winlogon.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\dwm.exe\", \"C:\\Recovery\\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\\explorer.exe\", \"C:\\Recovery\\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\\taskhost.exe\", \"C:\\Users\\Admin\\NetHood\\taskhost.exe\", \"C:\\Program Files\\Mozilla Firefox\\fonts\\taskhost.exe\", \"C:\\Windows\\Prefetch\\services.exe\", \"C:\\Recovery\\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\\winlogon.exe\", \"C:\\Program Files\\Windows Journal\\fr-FR\\audiodg.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\dllhost.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\dwm.exe\", \"C:\\Recovery\\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\\explorer.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\dwm.exe\", \"C:\\Recovery\\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\\explorer.exe\", \"C:\\Recovery\\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\\taskhost.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\dwm.exe\", \"C:\\Recovery\\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\\explorer.exe\", \"C:\\Recovery\\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\\taskhost.exe\", \"C:\\Users\\Admin\\NetHood\\taskhost.exe\", \"C:\\Program Files\\Mozilla Firefox\\fonts\\taskhost.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\dwm.exe\", \"C:\\Recovery\\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\\explorer.exe\", \"C:\\Recovery\\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\\taskhost.exe\", \"C:\\Users\\Admin\\NetHood\\taskhost.exe\", \"C:\\Program Files\\Mozilla Firefox\\fonts\\taskhost.exe\", \"C:\\Windows\\Prefetch\\services.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1512	2180	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	2180	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	2180	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	2180	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1052	2180	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	2180	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	2180	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	2180	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	2180	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	2180	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	2180	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	2180	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	2180	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	2180	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	2180	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	2180	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2180	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	2180	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	2180	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	2180	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	2180	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1172	2180	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1452	2180	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1288	2180	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	2180	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	2180	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	796	2180	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	2180	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	2180	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1076	2180	schtasks.exe	28

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1772-0-0x00000000010C0000-0x000000000133E000-memory.dmp	dcrat
behavioral1/files/0x0005000000018bc1-21.dat	dcrat
behavioral1/files/0x0005000000018725-39.dat	dcrat
behavioral1/files/0x0005000000018725-40.dat	dcrat
behavioral1/memory/660-42-0x0000000001280000-0x00000000014FE000-memory.dmp	dcrat
behavioral1/memory/660-47-0x000000001B200000-0x000000001B280000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
660	explorer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Recovery\\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\\taskhost.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Users\\Admin\\NetHood\\taskhost.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\\winlogon.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Admin\\dllhost.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Admin\\dllhost.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\dwm.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\\explorer.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Program Files\\Mozilla Firefox\\fonts\\taskhost.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\Prefetch\\services.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Program Files\\Windows Journal\\fr-FR\\audiodg.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\dwm.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\\explorer.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\Prefetch\\services.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Program Files\\Windows Journal\\fr-FR\\audiodg.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Recovery\\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\\taskhost.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Users\\Admin\\NetHood\\taskhost.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Program Files\\Mozilla Firefox\\fonts\\taskhost.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\\winlogon.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Users\\Admin\\Desktop\\Idle.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Users\\Admin\\Desktop\\Idle.exe\""	2b7f820ad4b5f7518071bd730ac2e655.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\6cb0b6c459d5d3	2b7f820ad4b5f7518071bd730ac2e655.exe
File created	C:\Program Files\Mozilla Firefox\fonts\taskhost.exe	2b7f820ad4b5f7518071bd730ac2e655.exe
File created	C:\Program Files\Mozilla Firefox\fonts\b75386f1303e64	2b7f820ad4b5f7518071bd730ac2e655.exe
File created	C:\Program Files\Windows Journal\fr-FR\audiodg.exe	2b7f820ad4b5f7518071bd730ac2e655.exe
File created	C:\Program Files\Windows Journal\fr-FR\42af1c969fbb7b	2b7f820ad4b5f7518071bd730ac2e655.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\dwm.exe	2b7f820ad4b5f7518071bd730ac2e655.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Prefetch\c5b4cb5e9653cc	2b7f820ad4b5f7518071bd730ac2e655.exe
File created	C:\Windows\Prefetch\services.exe	2b7f820ad4b5f7518071bd730ac2e655.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1636	schtasks.exe
1452	schtasks.exe
1288	schtasks.exe
2964	schtasks.exe
2884	schtasks.exe
2844	schtasks.exe
1076	schtasks.exe
1512	schtasks.exe
3000	schtasks.exe
2896	schtasks.exe
2776	schtasks.exe
1172	schtasks.exe
2640	schtasks.exe
1608	schtasks.exe
2236	schtasks.exe
1052	schtasks.exe
2872	schtasks.exe
2932	schtasks.exe
2784	schtasks.exe
2956	schtasks.exe
2544	schtasks.exe
1884	schtasks.exe
2692	schtasks.exe
1916	schtasks.exe
1372	schtasks.exe
2476	schtasks.exe
2736	schtasks.exe
2836	schtasks.exe
2000	schtasks.exe
796	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1772	2b7f820ad4b5f7518071bd730ac2e655.exe
660	explorer.exe
660	explorer.exe
660	explorer.exe
660	explorer.exe
660	explorer.exe
660	explorer.exe
660	explorer.exe
660	explorer.exe
660	explorer.exe
660	explorer.exe
660	explorer.exe
660	explorer.exe
660	explorer.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1772	2b7f820ad4b5f7518071bd730ac2e655.exe
Token: SeDebugPrivilege	660	explorer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 1948	1772	2b7f820ad4b5f7518071bd730ac2e655.exe	59
PID 1772 wrote to memory of 1948	1772	2b7f820ad4b5f7518071bd730ac2e655.exe	59
PID 1772 wrote to memory of 1948	1772	2b7f820ad4b5f7518071bd730ac2e655.exe	59
PID 1948 wrote to memory of 900	1948	cmd.exe	61
PID 1948 wrote to memory of 900	1948	cmd.exe	61
PID 1948 wrote to memory of 900	1948	cmd.exe	61
PID 1948 wrote to memory of 660	1948	cmd.exe	63
PID 1948 wrote to memory of 660	1948	cmd.exe	63
PID 1948 wrote to memory of 660	1948	cmd.exe	63

C:\Users\Admin\AppData\Local\Temp\2b7f820ad4b5f7518071bd730ac2e655.exe
"C:\Users\Admin\AppData\Local\Temp\2b7f820ad4b5f7518071bd730ac2e655.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\06uRfOfGub.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:900
- - C:\Recovery\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\explorer.exe
    "C:\Recovery\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\explorer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Recovery\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Recovery\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Recovery\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Recovery\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\NetHood\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Admin\NetHood\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\NetHood\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Program Files\Mozilla Firefox\fonts\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\fonts\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Program Files\Mozilla Firefox\fonts\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Windows\Prefetch\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Prefetch\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Windows\Prefetch\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Recovery\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Recovery\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Journal\fr-FR\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\fr-FR\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Journal\fr-FR\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Desktop\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\Desktop\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Desktop\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

explorer.exe

Path C:\Recovery\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\explorer.exe
Size 2.5MB
SHA256 fc402b8bbe328bc15da197b4f57b67d6fb74530553eb7f6fb2d1aa3d1af64fb6
MD5 2b7f820ad4b5f7518071bd730ac2e655
SHA1 8ff9a5b37c8d8482666707b3f555e071b8298df2
SHA512 99623412cb32c2cffc63e8889089321841468cfe092eb73b02563a64efbf44df095efb98a9ba43b0f0320b784ac595ed2223e8addd578662f8be333ec52d8789
SSDEEP 24576:PFFok8gvLa+c8OFvHh6QaA3JnPN8NTx5cxWpQkQTd315EitgptuOkalH9MWTk8eo:dFzvo1Ta24dx5gWmxrEiC35dk0VjR61
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Recovery\a60d4a02-20f1-11ee-b5a9-e92b09c817f3\explorer.exe
Size 2.5MB
SHA256 fc402b8bbe328bc15da197b4f57b67d6fb74530553eb7f6fb2d1aa3d1af64fb6
MD5 2b7f820ad4b5f7518071bd730ac2e655
SHA1 8ff9a5b37c8d8482666707b3f555e071b8298df2
SHA512 99623412cb32c2cffc63e8889089321841468cfe092eb73b02563a64efbf44df095efb98a9ba43b0f0320b784ac595ed2223e8addd578662f8be333ec52d8789
SSDEEP 24576:PFFok8gvLa+c8OFvHh6QaA3JnPN8NTx5cxWpQkQTd315EitgptuOkalH9MWTk8eo:dFzvo1Ta24dx5gWmxrEiC35dk0VjR61
MD5 SHA1 SHA512 SSDEEP

Submit Download

06uRfOfGub.bat

Path C:\Users\Admin\AppData\Local\Temp\06uRfOfGub.bat
Size 226B
SHA256 f8b0a42683fc5d6e59a6c1ba8da94cc7d9d3c2ecb564653bdcc9f40910869c95
MD5 ed343e2dbf817a5aff7685bd7828467e
SHA1 6986679fb7c617e825bd24585ab25bcb35fa0906
SHA512 b6319ca47da4fcc51e82e61e10911cf8f0f86683766cd92d1181816920581cacbbf0d078c03e79bd1b3fbd668ef5835513a6bf29f6489f239d5a81e830864152
MD5 SHA1 SHA512

Submit Download

taskhost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\taskhost.exe
Size 2.5MB
SHA256 fc402b8bbe328bc15da197b4f57b67d6fb74530553eb7f6fb2d1aa3d1af64fb6
MD5 2b7f820ad4b5f7518071bd730ac2e655
SHA1 8ff9a5b37c8d8482666707b3f555e071b8298df2
SHA512 99623412cb32c2cffc63e8889089321841468cfe092eb73b02563a64efbf44df095efb98a9ba43b0f0320b784ac595ed2223e8addd578662f8be333ec52d8789
SSDEEP 24576:PFFok8gvLa+c8OFvHh6QaA3JnPN8NTx5cxWpQkQTd315EitgptuOkalH9MWTk8eo:dFzvo1Ta24dx5gWmxrEiC35dk0VjR61
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/660-44-0x0000000000C10000-0x0000000000C66000-memory.dmp

Download

memory/660-45-0x0000000000530000-0x0000000000542000-memory.dmp

Download

memory/660-46-0x000007FEF5390000-0x000007FEF5D7C000-memory.dmp

Download

memory/660-43-0x000000001B200000-0x000000001B280000-memory.dmp

Download

memory/660-42-0x0000000001280000-0x00000000014FE000-memory.dmp

Download

memory/660-41-0x000007FEF5390000-0x000007FEF5D7C000-memory.dmp

Download

memory/660-47-0x000000001B200000-0x000000001B280000-memory.dmp

Download

memory/660-52-0x000000001B200000-0x000000001B280000-memory.dmp

Download

memory/660-72-0x000000001B200000-0x000000001B280000-memory.dmp

Download

memory/1772-6-0x00000000004D0000-0x0000000000526000-memory.dmp

Download

memory/1772-7-0x0000000000170000-0x0000000000182000-memory.dmp

Download

memory/1772-38-0x000007FEF5D80000-0x000007FEF676C000-memory.dmp

Download

memory/1772-11-0x0000000000550000-0x0000000000558000-memory.dmp

Download

memory/1772-10-0x0000000000540000-0x000000000054E000-memory.dmp

Download

memory/1772-9-0x0000000000530000-0x000000000053E000-memory.dmp

Download

memory/1772-8-0x00000000003D0000-0x00000000003DC000-memory.dmp

Download

memory/1772-12-0x0000000000560000-0x0000000000568000-memory.dmp

Download

memory/1772-0-0x00000000010C0000-0x000000000133E000-memory.dmp

Download

memory/1772-5-0x0000000000190000-0x00000000001A6000-memory.dmp

Download

memory/1772-4-0x0000000000150000-0x000000000016C000-memory.dmp

Download

memory/1772-3-0x0000000000140000-0x000000000014E000-memory.dmp

Download

memory/1772-2-0x000000001B400000-0x000000001B480000-memory.dmp

Download

memory/1772-1-0x000007FEF5D80000-0x000007FEF676C000-memory.dmp

Download