dcrat | c3b511d889528a52823649518bf1f0227f28c5d76f252bbaea8a3f31578f86a7

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
31-10-2023 08:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.deae068c77a6e63c6d74307f353e5e40.exe
Size

784KB
MD5

deae068c77a6e63c6d74307f353e5e40
SHA1

cb740abd0c89cd3cb20356f6e5777f879372f906
SHA256

c3b511d889528a52823649518bf1f0227f28c5d76f252bbaea8a3f31578f86a7
SHA512

4c506b647042da604aa3f96a30538874218daf4960e4fb11048a7f4a7f998a020928fb2374e27073fe4bf5fd9be80bf0f3d218108bcb0a513467991057115166
SSDEEP

12288:eqnO8YpD1oOJp+Ce1PSiG2jfIBoI5DyDwYMDxFesH0ioBw7oKk2:e+ORToOWSi5gBoS4wYUJ0eo2

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	2268	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	2268	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	2268	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	2268	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2268	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	2268	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	2268	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	2268	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	2268	schtasks.exe	28

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/628-0-0x0000000000B30000-0x0000000000BFA000-memory.dmp	dcrat
behavioral1/files/0x00060000000144ca-32.dat	dcrat
behavioral1/files/0x0007000000015c32-124.dat	dcrat
behavioral1/files/0x0007000000015c32-125.dat	dcrat
behavioral1/memory/2676-126-0x00000000000F0000-0x00000000001BA000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
2676	winlogon.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NEAS.deae068c77a6e63c6d74307f353e5e40 = "\"C:\\Program Files\\Google\\NEAS.deae068c77a6e63c6d74307f353e5e40.exe\""	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\d10510a2-6fc3-11ee-bc6f-a02387f916ed\\explorer.exe\""	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Admin\\Links\\lsass.exe\""	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\System32\\wscapi\\smss.exe\""	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\System32\\Bubbles\\smss.exe\""	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\d10510a2-6fc3-11ee-bc6f-a02387f916ed\\wininit.exe\""	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\System32\\shrpubw\\winlogon.exe\""	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\System32\\perfh00A\\sppsvc.exe\""	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Windows\\System32\\perfc011\\taskhost.exe\""	NEAS.deae068c77a6e63c6d74307f353e5e40.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe

Drops file in System32 directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\perfh00A\sppsvc.exe	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
File opened for modification	C:\Windows\System32\wscapi\smss.exe	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
File created	C:\Windows\System32\Bubbles\smss.exe	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
File created	C:\Windows\System32\wscapi\69ddcba757bf72f7d36c464c71f42baab150b2b9	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
File opened for modification	C:\Windows\System32\Bubbles\RCX536F.tmp	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
File opened for modification	C:\Windows\System32\shrpubw\winlogon.exe	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
File opened for modification	C:\Windows\System32\perfh00A\RCX5C88.tmp	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
File opened for modification	C:\Windows\System32\perfc011\taskhost.exe	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
File created	C:\Windows\System32\perfc011\taskhost.exe	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
File created	C:\Windows\System32\perfc011\b75386f1303e64d8139363b71e44ac16341adf4e	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
File created	C:\Windows\System32\shrpubw\cc11b995f2a76da408ea6a601e682e64743153ad	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
File created	C:\Windows\System32\perfh00A\sppsvc.exe	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
File created	C:\Windows\System32\perfh00A\0a1fd5f707cd16ea89afd3d6db52b2da58214a6c	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
File created	C:\Windows\System32\wscapi\smss.exe	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
File opened for modification	C:\Windows\System32\Bubbles\smss.exe	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
File opened for modification	C:\Windows\System32\shrpubw\RCX5796.tmp	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
File created	C:\Windows\System32\Bubbles\69ddcba757bf72f7d36c464c71f42baab150b2b9	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
File created	C:\Windows\System32\shrpubw\winlogon.exe	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
File opened for modification	C:\Windows\System32\perfc011\RCX5E8B.tmp	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
File opened for modification	C:\Windows\System32\wscapi\RCX6300.tmp	NEAS.deae068c77a6e63c6d74307f353e5e40.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Google\NEAS.deae068c77a6e63c6d74307f353e5e40.exe	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
File opened for modification	C:\Program Files\Google\NEAS.deae068c77a6e63c6d74307f353e5e40.exe	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
File created	C:\Program Files\Google\3cd8348f5f54ae613799e570a591e0623c76b338	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
File opened for modification	C:\Program Files\Google\RCX4FE5.tmp	NEAS.deae068c77a6e63c6d74307f353e5e40.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2996	schtasks.exe
2140	schtasks.exe
2564	schtasks.exe
2932	schtasks.exe
2004	schtasks.exe
2692	schtasks.exe
2612	schtasks.exe
2960	schtasks.exe
1960	schtasks.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	winlogon.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	winlogon.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	winlogon.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	winlogon.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	winlogon.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
628	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
628	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
628	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
628	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
628	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
628	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
628	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
628	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
628	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
628	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
628	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
628	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
628	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
628	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
628	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
628	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
628	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
2676	winlogon.exe
2676	winlogon.exe
2676	winlogon.exe
2676	winlogon.exe
2676	winlogon.exe
2676	winlogon.exe
2676	winlogon.exe
2676	winlogon.exe
2676	winlogon.exe
2676	winlogon.exe
2676	winlogon.exe
2676	winlogon.exe
2676	winlogon.exe
2676	winlogon.exe
2676	winlogon.exe
2676	winlogon.exe
2676	winlogon.exe
2676	winlogon.exe
2676	winlogon.exe
2676	winlogon.exe
2676	winlogon.exe
2676	winlogon.exe
2676	winlogon.exe
2676	winlogon.exe
2676	winlogon.exe
2676	winlogon.exe
2676	winlogon.exe
2676	winlogon.exe
2676	winlogon.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	628	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
Token: SeDebugPrivilege	2676	winlogon.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 3052	628	NEAS.deae068c77a6e63c6d74307f353e5e40.exe	38
PID 628 wrote to memory of 3052	628	NEAS.deae068c77a6e63c6d74307f353e5e40.exe	38
PID 628 wrote to memory of 3052	628	NEAS.deae068c77a6e63c6d74307f353e5e40.exe	38
PID 3052 wrote to memory of 2384	3052	cmd.exe	40
PID 3052 wrote to memory of 2384	3052	cmd.exe	40
PID 3052 wrote to memory of 2384	3052	cmd.exe	40
PID 3052 wrote to memory of 2676	3052	cmd.exe	41
PID 3052 wrote to memory of 2676	3052	cmd.exe	41
PID 3052 wrote to memory of 2676	3052	cmd.exe	41

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	NEAS.deae068c77a6e63c6d74307f353e5e40.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winlogon.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\NEAS.deae068c77a6e63c6d74307f353e5e40.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.deae068c77a6e63c6d74307f353e5e40.exe"
1⤵
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BQr0H05ZpU.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2384
- - C:\Windows\System32\shrpubw\winlogon.exe
    "C:\Windows\System32\shrpubw\winlogon.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "NEAS.deae068c77a6e63c6d74307f353e5e40" /sc ONLOGON /tr "'C:\Program Files\Google\NEAS.deae068c77a6e63c6d74307f353e5e40.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\System32\Bubbles\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\shrpubw\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\System32\perfh00A\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\perfc011\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Admin\Links\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\System32\wscapi\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\d10510a2-6fc3-11ee-bc6f-a02387f916ed\explorer.exe

Filesize
784KB

MD5
deae068c77a6e63c6d74307f353e5e40

SHA1
cb740abd0c89cd3cb20356f6e5777f879372f906

SHA256
c3b511d889528a52823649518bf1f0227f28c5d76f252bbaea8a3f31578f86a7

SHA512
4c506b647042da604aa3f96a30538874218daf4960e4fb11048a7f4a7f998a020928fb2374e27073fe4bf5fd9be80bf0f3d218108bcb0a513467991057115166

Download Submit
C:\Users\Admin\AppData\Local\Temp\BQr0H05ZpU.bat

Filesize
204B

MD5
bacafb167684e4bec91d333a715961a5

SHA1
f3df1aa857cdef2c75689a17f469e7dc6edbada0

SHA256
3101bea462b0750db6dc248300d8f94de1200c50fbba0ab46131345c810a2ce9

SHA512
7b1d783268d1fcde56dcd7bb71bb500b0ecb84f7288f92362800053d502f1307c12d021b921c7d3af70d48b5952d4da5bcc04f7461a5c1c2567df29e6f31e526

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab82A9.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB234.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Windows\System32\shrpubw\winlogon.exe

Filesize
784KB

MD5
9c621d7dedc11c8e6758b2904a7e5386

SHA1
e21e2d468c337ccd7f5465b985b7d67f303c0cd6

SHA256
22ae46d71a4e7331d943f49b9e30a04321fb05d895a025439496ed5113a90233

SHA512
b58b88debfd722b6a7cf216e8e16e827f3f6deacec38dbfa3a21dfb5e9e6d657a83e881a19b75ecf6d2ab680b38799c3a53547c86863698f176e81202098cf6a

Download Submit
C:\Windows\System32\shrpubw\winlogon.exe

Filesize
784KB

MD5
9c621d7dedc11c8e6758b2904a7e5386

SHA1
e21e2d468c337ccd7f5465b985b7d67f303c0cd6

SHA256
22ae46d71a4e7331d943f49b9e30a04321fb05d895a025439496ed5113a90233

SHA512
b58b88debfd722b6a7cf216e8e16e827f3f6deacec38dbfa3a21dfb5e9e6d657a83e881a19b75ecf6d2ab680b38799c3a53547c86863698f176e81202098cf6a

Download Submit
memory/628-76-0x000000001B180000-0x000000001B200000-memory.dmp

Filesize
512KB

Download
memory/628-11-0x0000000000AD0000-0x0000000000AD8000-memory.dmp

Filesize
32KB

Download
memory/628-3-0x00000000001C0000-0x00000000001C8000-memory.dmp

Filesize
32KB

Download
memory/628-4-0x00000000001D0000-0x00000000001D8000-memory.dmp

Filesize
32KB

Download
memory/628-5-0x00000000001E0000-0x00000000001F0000-memory.dmp

Filesize
64KB

Download
memory/628-6-0x0000000000200000-0x0000000000208000-memory.dmp

Filesize
32KB

Download
memory/628-7-0x0000000000AE0000-0x0000000000AEC000-memory.dmp

Filesize
48KB

Download
memory/628-8-0x0000000000680000-0x000000000068A000-memory.dmp

Filesize
40KB

Download
memory/628-9-0x0000000000670000-0x000000000067A000-memory.dmp

Filesize
40KB

Download
memory/628-10-0x0000000002020000-0x0000000002028000-memory.dmp

Filesize
32KB

Download
memory/628-107-0x000000001B180000-0x000000001B200000-memory.dmp

Filesize
512KB

Download
memory/628-12-0x0000000000B00000-0x0000000000B08000-memory.dmp

Filesize
32KB

Download
memory/628-13-0x0000000002270000-0x0000000002278000-memory.dmp

Filesize
32KB

Download
memory/628-14-0x0000000000AC0000-0x0000000000AC8000-memory.dmp

Filesize
32KB

Download
memory/628-17-0x0000000000AF0000-0x0000000000AF8000-memory.dmp

Filesize
32KB

Download
memory/628-16-0x0000000002000000-0x0000000002008000-memory.dmp

Filesize
32KB

Download
memory/628-15-0x0000000000B10000-0x0000000000B18000-memory.dmp

Filesize
32KB

Download
memory/628-18-0x0000000000B20000-0x0000000000B28000-memory.dmp

Filesize
32KB

Download
memory/628-19-0x0000000002060000-0x0000000002068000-memory.dmp

Filesize
32KB

Download
memory/628-20-0x0000000002080000-0x0000000002088000-memory.dmp

Filesize
32KB

Download
memory/628-21-0x0000000002010000-0x000000000201C000-memory.dmp

Filesize
48KB

Download
memory/628-22-0x0000000002030000-0x0000000002038000-memory.dmp

Filesize
32KB

Download
memory/628-23-0x000000001B180000-0x000000001B200000-memory.dmp

Filesize
512KB

Download
memory/628-42-0x000000001B180000-0x000000001B200000-memory.dmp

Filesize
512KB

Download
memory/628-43-0x000000001B180000-0x000000001B200000-memory.dmp

Filesize
512KB

Download
memory/628-49-0x000000001B180000-0x000000001B200000-memory.dmp

Filesize
512KB

Download
memory/628-61-0x000000001B180000-0x000000001B200000-memory.dmp

Filesize
512KB

Download
memory/628-75-0x000007FEF54D0000-0x000007FEF5EBC000-memory.dmp

Filesize
9.9MB

Download
memory/628-1-0x000007FEF54D0000-0x000007FEF5EBC000-memory.dmp

Filesize
9.9MB

Download
memory/628-91-0x000000001B180000-0x000000001B200000-memory.dmp

Filesize
512KB

Download
memory/628-0-0x0000000000B30000-0x0000000000BFA000-memory.dmp

Filesize
808KB

Download
memory/628-105-0x000000001B180000-0x000000001B200000-memory.dmp

Filesize
512KB

Download
memory/628-2-0x000000001B180000-0x000000001B200000-memory.dmp

Filesize
512KB

Download
memory/628-119-0x000000001B180000-0x000000001B200000-memory.dmp

Filesize
512KB

Download
memory/628-121-0x000000001B180000-0x000000001B200000-memory.dmp

Filesize
512KB

Download
memory/628-123-0x000007FEF54D0000-0x000007FEF5EBC000-memory.dmp

Filesize
9.9MB

Download
memory/628-106-0x000000001B180000-0x000000001B200000-memory.dmp

Filesize
512KB

Download
memory/2676-167-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/2676-156-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/2676-127-0x000007FEF4AE0000-0x000007FEF54CC000-memory.dmp

Filesize
9.9MB

Download
memory/2676-130-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/2676-149-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/2676-150-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/2676-151-0x000007FEF4AE0000-0x000007FEF54CC000-memory.dmp

Filesize
9.9MB

Download
memory/2676-152-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/2676-153-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/2676-154-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/2676-155-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/2676-191-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/2676-129-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/2676-128-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/2676-166-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/2676-160-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/2676-161-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/2676-158-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/2676-163-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/2676-164-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/2676-165-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/2676-159-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/2676-126-0x00000000000F0000-0x00000000001BA000-memory.dmp

Filesize
808KB

Download
memory/2676-168-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/2676-157-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/2676-187-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/2676-162-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download