dcrat | 9eef15774b4f1d89af295a873b25b6d13f5486deda3ec97986b5b8580d72c6eb

General

Target

NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
Size

783KB
MD5

b0b24b9c0205044ace0abbd64e44e980
SHA1

0b20572786d013a427a99b2a2ba18fe5c4f439ed
SHA256

9eef15774b4f1d89af295a873b25b6d13f5486deda3ec97986b5b8580d72c6eb
SHA512

51f4c28b06c2ac76959ec8c702713a8ce6eb050eaa43215c070abdf8f90be17627e3a5c7d352ab1b3e73922d84a1d59419e716e05ebd4401112ed1f1cfc327c4
SSDEEP

12288:GqnOYxdAgpoNeF91rg5iFdr0yQ9gYx+EIpakCYJRU7Q9bWoFzqK:G+OQbpbgsFdAyQvzSqaq8q

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2644	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	2644	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	2644	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1212	2644	schtasks.exe	28

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1768-0-0x0000000000110000-0x00000000001DA000-memory.dmp	dcrat
behavioral1/files/0x002f000000015c67-37.dat	dcrat
behavioral1/files/0x0008000000015d2f-65.dat	dcrat
behavioral1/files/0x0008000000015ca8-73.dat	dcrat
behavioral1/files/0x0008000000015ca8-72.dat	dcrat
behavioral1/memory/2976-75-0x0000000001370000-0x000000000143A000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
2976	csrss.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\System32\\TapiMigPlugin\\winlogon.exe\""	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\24c32662-6fcd-11ee-ab95-d6a0c7caf0e4\\csrss.exe\""	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Documents and Settings\\taskhost.exe\""	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\msshooks\\csrss.exe\""	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\System32\msshooks\886983d96e3d3e31032c679b2d4ea91b6c05afef	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
File opened for modification	C:\Windows\System32\TapiMigPlugin\RCX9BA4.tmp	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
File opened for modification	C:\Windows\System32\msshooks\RCXA22D.tmp	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
File opened for modification	C:\Windows\System32\msshooks\csrss.exe	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
File created	C:\Windows\System32\TapiMigPlugin\winlogon.exe	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
File opened for modification	C:\Windows\System32\TapiMigPlugin\winlogon.exe	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
File created	C:\Windows\System32\TapiMigPlugin\cc11b995f2a76da408ea6a601e682e64743153ad	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
File created	C:\Windows\System32\msshooks\csrss.exe	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2616	schtasks.exe
2168	schtasks.exe
2524	schtasks.exe
1212	schtasks.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	csrss.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	csrss.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	csrss.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	csrss.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	csrss.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
1768	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
1768	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
1768	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
1768	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
1768	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
1768	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
1768	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
1768	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
1768	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
1768	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
1768	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
2976	csrss.exe
2976	csrss.exe
2976	csrss.exe
2976	csrss.exe
2976	csrss.exe
2976	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1768	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
Token: SeDebugPrivilege	2976	csrss.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 2852	1768	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe	33
PID 1768 wrote to memory of 2852	1768	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe	33
PID 1768 wrote to memory of 2852	1768	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe	33
PID 2852 wrote to memory of 320	2852	cmd.exe	35
PID 2852 wrote to memory of 320	2852	cmd.exe	35
PID 2852 wrote to memory of 320	2852	cmd.exe	35
PID 2852 wrote to memory of 2976	2852	cmd.exe	36
PID 2852 wrote to memory of 2976	2852	cmd.exe	36
PID 2852 wrote to memory of 2976	2852	cmd.exe	36

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\NEAS.b0b24b9c0205044ace0abbd64e44e980.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.b0b24b9c0205044ace0abbd64e44e980.exe"
1⤵
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zseJ0CNy4U.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:320
- - C:\Recovery\24c32662-6fcd-11ee-ab95-d6a0c7caf0e4\csrss.exe
    "C:\Recovery\24c32662-6fcd-11ee-ab95-d6a0c7caf0e4\csrss.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\TapiMigPlugin\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\24c32662-6fcd-11ee-ab95-d6a0c7caf0e4\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Documents and Settings\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\msshooks\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\24c32662-6fcd-11ee-ab95-d6a0c7caf0e4\csrss.exe

Filesize
783KB

MD5
b0b24b9c0205044ace0abbd64e44e980

SHA1
0b20572786d013a427a99b2a2ba18fe5c4f439ed

SHA256
9eef15774b4f1d89af295a873b25b6d13f5486deda3ec97986b5b8580d72c6eb

SHA512
51f4c28b06c2ac76959ec8c702713a8ce6eb050eaa43215c070abdf8f90be17627e3a5c7d352ab1b3e73922d84a1d59419e716e05ebd4401112ed1f1cfc327c4

Download Submit
C:\Recovery\24c32662-6fcd-11ee-ab95-d6a0c7caf0e4\csrss.exe

Filesize
783KB

MD5
b0b24b9c0205044ace0abbd64e44e980

SHA1
0b20572786d013a427a99b2a2ba18fe5c4f439ed

SHA256
9eef15774b4f1d89af295a873b25b6d13f5486deda3ec97986b5b8580d72c6eb

SHA512
51f4c28b06c2ac76959ec8c702713a8ce6eb050eaa43215c070abdf8f90be17627e3a5c7d352ab1b3e73922d84a1d59419e716e05ebd4401112ed1f1cfc327c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6175873189503a566bdd33495bb5830a

SHA1
7ecbb6a5a31f124cfbdaa3d6088ee69a7e82ac95

SHA256
4e62b043ce29738498f19fb92566187f95416107429190f5ccde9da5b69ff243

SHA512
5bc65257464dad73002fdf8c234ead97843f597abd149d9d14c9cf5508a8f99624540a328fb6bd80578a92c628f5ae434a19886e9e85e23e0057d0260d9090ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC277.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC2C8.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\zseJ0CNy4U.bat

Filesize
222B

MD5
cf8eb1a50d9ed24958b7fe33f02f9834

SHA1
b24a2bd4378eb0873fa1f064a42ff296e4e18a73

SHA256
f0b835232b36b0dfe32c987982bfe5f2d1a4f1e726fca0c9f57c430eaa463cde

SHA512
c00263c1f5110dc0e1da972eb7194b37f4170d50c1b65a3f1167a3f49fa0ccb5e12bd858ca524b6fd4a11c81223faca60f317cf7d2940a680481ff2460cac7e0

Download Submit
C:\Windows\System32\TapiMigPlugin\winlogon.exe

Filesize
783KB

MD5
b0b24b9c0205044ace0abbd64e44e980

SHA1
0b20572786d013a427a99b2a2ba18fe5c4f439ed

SHA256
9eef15774b4f1d89af295a873b25b6d13f5486deda3ec97986b5b8580d72c6eb

SHA512
51f4c28b06c2ac76959ec8c702713a8ce6eb050eaa43215c070abdf8f90be17627e3a5c7d352ab1b3e73922d84a1d59419e716e05ebd4401112ed1f1cfc327c4

Download Submit
C:\Windows\System32\msshooks\csrss.exe

Filesize
783KB

MD5
0893b31226fed83048bb9d1d042e6630

SHA1
8697bd831fb0dfe272b6932bf1623308e35a941e

SHA256
114bbb94fac4858a41e47ff62b9a70f8340379984b81706d9b01f225ab19ebfd

SHA512
78a68edc3c5ddcf3f0e31c7a6640c724183b81196545c5934ed413d4426c8ba98b243d512ebecabe0ef96a1328d46863c43ee856388b68f0e15f86fc7d313fa1

Download Submit
memory/1768-11-0x00000000005F0000-0x00000000005F8000-memory.dmp

Filesize
32KB

Download
memory/1768-50-0x00000000004D0000-0x0000000000550000-memory.dmp

Filesize
512KB

Download
memory/1768-8-0x00000000005E0000-0x00000000005EA000-memory.dmp

Filesize
40KB

Download
memory/1768-0-0x0000000000110000-0x00000000001DA000-memory.dmp

Filesize
808KB

Download
memory/1768-12-0x0000000000610000-0x0000000000618000-memory.dmp

Filesize
32KB

Download
memory/1768-13-0x0000000002110000-0x0000000002118000-memory.dmp

Filesize
32KB

Download
memory/1768-14-0x00000000020E0000-0x00000000020E8000-memory.dmp

Filesize
32KB

Download
memory/1768-15-0x000000001A6E0000-0x000000001A6E8000-memory.dmp

Filesize
32KB

Download
memory/1768-16-0x00000000021A0000-0x00000000021A8000-memory.dmp

Filesize
32KB

Download
memory/1768-17-0x000000001A710000-0x000000001A718000-memory.dmp

Filesize
32KB

Download
memory/1768-18-0x000000001A700000-0x000000001A708000-memory.dmp

Filesize
32KB

Download
memory/1768-20-0x000000001A6D0000-0x000000001A6D8000-memory.dmp

Filesize
32KB

Download
memory/1768-19-0x00000000022B0000-0x00000000022B8000-memory.dmp

Filesize
32KB

Download
memory/1768-21-0x00000000022C0000-0x00000000022CC000-memory.dmp

Filesize
48KB

Download
memory/1768-22-0x00000000004D0000-0x0000000000550000-memory.dmp

Filesize
512KB

Download
memory/1768-23-0x000000001A6F0000-0x000000001A6F8000-memory.dmp

Filesize
32KB

Download
memory/1768-32-0x00000000004D0000-0x0000000000550000-memory.dmp

Filesize
512KB

Download
memory/1768-36-0x00000000004D0000-0x0000000000550000-memory.dmp

Filesize
512KB

Download
memory/1768-9-0x00000000020F0000-0x00000000020FA000-memory.dmp

Filesize
40KB

Download
memory/1768-10-0x0000000002100000-0x0000000002108000-memory.dmp

Filesize
32KB

Download
memory/1768-63-0x00000000004D0000-0x0000000000550000-memory.dmp

Filesize
512KB

Download
memory/1768-64-0x000007FEF5D70000-0x000007FEF675C000-memory.dmp

Filesize
9.9MB

Download
memory/1768-7-0x0000000000600000-0x000000000060C000-memory.dmp

Filesize
48KB

Download
memory/1768-6-0x00000000005D0000-0x00000000005D8000-memory.dmp

Filesize
32KB

Download
memory/1768-71-0x000007FEF5D70000-0x000007FEF675C000-memory.dmp

Filesize
9.9MB

Download
memory/1768-4-0x00000000004B0000-0x00000000004B8000-memory.dmp

Filesize
32KB

Download
memory/1768-5-0x00000000004C0000-0x00000000004D0000-memory.dmp

Filesize
64KB

Download
memory/1768-1-0x000007FEF5D70000-0x000007FEF675C000-memory.dmp

Filesize
9.9MB

Download
memory/1768-2-0x00000000004D0000-0x0000000000550000-memory.dmp

Filesize
512KB

Download
memory/1768-3-0x00000000004A0000-0x00000000004A8000-memory.dmp

Filesize
32KB

Download
memory/2976-77-0x000000001AFB0000-0x000000001B030000-memory.dmp

Filesize
512KB

Download
memory/2976-78-0x000000001AFB0000-0x000000001B030000-memory.dmp

Filesize
512KB

Download
memory/2976-76-0x000000001AFB0000-0x000000001B030000-memory.dmp

Filesize
512KB

Download
memory/2976-75-0x0000000001370000-0x000000000143A000-memory.dmp

Filesize
808KB

Download
memory/2976-74-0x000007FEF5380000-0x000007FEF5D6C000-memory.dmp

Filesize
9.9MB

Download
memory/2976-140-0x000000001AFB0000-0x000000001B030000-memory.dmp

Filesize
512KB

Download
memory/2976-159-0x000007FEF5380000-0x000007FEF5D6C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads