dcrat | 1f9168ebe5c0fb87e5d3a637d2dfc6d6271ef1ad37c9da811743cc28dffccb1e

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
09/12/2023, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
642ab556168baf4ec41c4e9f55bdc60e.exe
Size 1.1MB
Sample231209-dpcwhaedap
SHA256 1f9168ebe5c0fb87e5d3a637d2dfc6d6271ef1ad37c9da811743cc28dffccb1e
MD5 642ab556168baf4ec41c4e9f55bdc60e
SHA1 35a90fbaa712a843766b1a064b1ee87f2e523fea
SHA512 c2da42212a4498e7e4d5fdbda489585bc10360085c4aa797fc633f2aaa53512c2af59bb4b3d179270715126e5b577d44e3bd2494b2293e62f40ae5bcb685a7e7
SSDEEP 24576:/GsGAlkenHFOdfepVmC7iBtV2IwQZhAOCLYft/x:/XlzMUVatV2JkKzsft
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat 27 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

pid	Process
2500	schtasks.exe
740	schtasks.exe
1924	schtasks.exe
2736	schtasks.exe
1036	schtasks.exe
2756	schtasks.exe
2592	schtasks.exe
2704	schtasks.exe
2576	schtasks.exe
320	schtasks.exe
1028	schtasks.exe
2644	schtasks.exe
2904	schtasks.exe
1752	schtasks.exe
2628	schtasks.exe
1660	schtasks.exe
2124	schtasks.exe
2928	schtasks.exe
2852	schtasks.exe
1564	schtasks.exe
736	schtasks.exe
1160	schtasks.exe
1448	schtasks.exe
108	schtasks.exe
2744	schtasks.exe
1528	schtasks.exe
1516	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 9 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Recovery\\dc2a2482-6fc2-11ee-ac24-e54deae2f792\\System.exe\", \"C:\\Program Files\\MSBuild\\dwm.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\csrss.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\System.exe\", \"C:\\Windows\\LiveKernelReports\\lsass.exe\", \"C:\\Recovery\\dc2a2482-6fc2-11ee-ac24-e54deae2f792\\csrss.exe\", \"C:\\Recovery\\dc2a2482-6fc2-11ee-ac24-e54deae2f792\\sppsvc.exe\", \"C:\\Users\\Public\\Documents\\My Videos\\winlogon.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Recovery\\dc2a2482-6fc2-11ee-ac24-e54deae2f792\\System.exe\", \"C:\\Program Files\\MSBuild\\dwm.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\csrss.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Recovery\\dc2a2482-6fc2-11ee-ac24-e54deae2f792\\System.exe\", \"C:\\Program Files\\MSBuild\\dwm.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\csrss.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\System.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Recovery\\dc2a2482-6fc2-11ee-ac24-e54deae2f792\\System.exe\", \"C:\\Program Files\\MSBuild\\dwm.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\csrss.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\System.exe\", \"C:\\Windows\\LiveKernelReports\\lsass.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Recovery\\dc2a2482-6fc2-11ee-ac24-e54deae2f792\\System.exe\", \"C:\\Program Files\\MSBuild\\dwm.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\csrss.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\System.exe\", \"C:\\Windows\\LiveKernelReports\\lsass.exe\", \"C:\\Recovery\\dc2a2482-6fc2-11ee-ac24-e54deae2f792\\csrss.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Recovery\\dc2a2482-6fc2-11ee-ac24-e54deae2f792\\System.exe\", \"C:\\Program Files\\MSBuild\\dwm.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\csrss.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\System.exe\", \"C:\\Windows\\LiveKernelReports\\lsass.exe\", \"C:\\Recovery\\dc2a2482-6fc2-11ee-ac24-e54deae2f792\\csrss.exe\", \"C:\\Recovery\\dc2a2482-6fc2-11ee-ac24-e54deae2f792\\sppsvc.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\csrss.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Recovery\\dc2a2482-6fc2-11ee-ac24-e54deae2f792\\System.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Recovery\\dc2a2482-6fc2-11ee-ac24-e54deae2f792\\System.exe\", \"C:\\Program Files\\MSBuild\\dwm.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	2788	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2788	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	2788	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	2788	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	2788	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	2788	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	2788	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	2788	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	2788	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	108	2788	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	2788	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	2788	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	740	2788	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	2788	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	2788	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	736	2788	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	2788	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	2788	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1448	2788	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	320	2788	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	2788	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	2788	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1028	2788	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	2788	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	2788	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	2788	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	2788	schtasks.exe	28

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1264-0-0x0000000000A00000-0x0000000000B26000-memory.dmp	dcrat
behavioral1/files/0x0006000000016064-17.dat	dcrat
behavioral1/files/0x0006000000016454-31.dat	dcrat
behavioral1/files/0x0006000000016454-32.dat	dcrat
behavioral1/memory/1048-33-0x0000000000890000-0x00000000009B6000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
1048	lsass.exe

Adds Run key to start application 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\System.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\LiveKernelReports\\lsass.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\dc2a2482-6fc2-11ee-ac24-e54deae2f792\\csrss.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Recovery\\dc2a2482-6fc2-11ee-ac24-e54deae2f792\\System.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\MSBuild\\dwm.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\csrss.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\System.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\LiveKernelReports\\lsass.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\dc2a2482-6fc2-11ee-ac24-e54deae2f792\\csrss.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Public\\Documents\\My Videos\\winlogon.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\MSOCache\\All Users\\csrss.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Recovery\\dc2a2482-6fc2-11ee-ac24-e54deae2f792\\System.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\MSBuild\\dwm.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\dc2a2482-6fc2-11ee-ac24-e54deae2f792\\sppsvc.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\MSOCache\\All Users\\csrss.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\csrss.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\dc2a2482-6fc2-11ee-ac24-e54deae2f792\\sppsvc.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Public\\Documents\\My Videos\\winlogon.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\886983d96e3d3e	642ab556168baf4ec41c4e9f55bdc60e.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\System.exe	642ab556168baf4ec41c4e9f55bdc60e.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\27d1bcfc3c54e0	642ab556168baf4ec41c4e9f55bdc60e.exe
File created	C:\Program Files\MSBuild\dwm.exe	642ab556168baf4ec41c4e9f55bdc60e.exe
File created	C:\Program Files\MSBuild\6cb0b6c459d5d3	642ab556168baf4ec41c4e9f55bdc60e.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\csrss.exe	642ab556168baf4ec41c4e9f55bdc60e.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\LiveKernelReports\lsass.exe	642ab556168baf4ec41c4e9f55bdc60e.exe
File created	C:\Windows\LiveKernelReports\6203df4a6bafc7	642ab556168baf4ec41c4e9f55bdc60e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2756	schtasks.exe
740	schtasks.exe
1448	schtasks.exe
2500	schtasks.exe
2576	schtasks.exe
1564	schtasks.exe
1924	schtasks.exe
2628	schtasks.exe
2124	schtasks.exe
108	schtasks.exe
1036	schtasks.exe
2704	schtasks.exe
2644	schtasks.exe
2744	schtasks.exe
2736	schtasks.exe
2904	schtasks.exe
2928	schtasks.exe
1160	schtasks.exe
2592	schtasks.exe
736	schtasks.exe
1028	schtasks.exe
1516	schtasks.exe
1752	schtasks.exe
1660	schtasks.exe
2852	schtasks.exe
320	schtasks.exe
1528	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1264	642ab556168baf4ec41c4e9f55bdc60e.exe
1264	642ab556168baf4ec41c4e9f55bdc60e.exe
1264	642ab556168baf4ec41c4e9f55bdc60e.exe
1264	642ab556168baf4ec41c4e9f55bdc60e.exe
1264	642ab556168baf4ec41c4e9f55bdc60e.exe
1264	642ab556168baf4ec41c4e9f55bdc60e.exe
1264	642ab556168baf4ec41c4e9f55bdc60e.exe
1264	642ab556168baf4ec41c4e9f55bdc60e.exe
1264	642ab556168baf4ec41c4e9f55bdc60e.exe
1048	lsass.exe
1048	lsass.exe
1048	lsass.exe
1048	lsass.exe
1048	lsass.exe
1048	lsass.exe
1048	lsass.exe
1048	lsass.exe
1048	lsass.exe
1048	lsass.exe
1048	lsass.exe
1048	lsass.exe
1048	lsass.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1048	lsass.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1264	642ab556168baf4ec41c4e9f55bdc60e.exe
Token: SeDebugPrivilege	1048	lsass.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 1048	1264	642ab556168baf4ec41c4e9f55bdc60e.exe	56
PID 1264 wrote to memory of 1048	1264	642ab556168baf4ec41c4e9f55bdc60e.exe	56
PID 1264 wrote to memory of 1048	1264	642ab556168baf4ec41c4e9f55bdc60e.exe	56

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\642ab556168baf4ec41c4e9f55bdc60e.exe
"C:\Users\Admin\AppData\Local\Temp\642ab556168baf4ec41c4e9f55bdc60e.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\LiveKernelReports\lsass.exe
  "C:\Windows\LiveKernelReports\lsass.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Recovery\dc2a2482-6fc2-11ee-ac24-e54deae2f792\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\dc2a2482-6fc2-11ee-ac24-e54deae2f792\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Recovery\dc2a2482-6fc2-11ee-ac24-e54deae2f792\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files\MSBuild\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\MSBuild\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files\MSBuild\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Windows\LiveKernelReports\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Windows\LiveKernelReports\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\dc2a2482-6fc2-11ee-ac24-e54deae2f792\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\dc2a2482-6fc2-11ee-ac24-e54deae2f792\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\dc2a2482-6fc2-11ee-ac24-e54deae2f792\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Recovery\dc2a2482-6fc2-11ee-ac24-e54deae2f792\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\dc2a2482-6fc2-11ee-ac24-e54deae2f792\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Recovery\dc2a2482-6fc2-11ee-ac24-e54deae2f792\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Documents\My Videos\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Videos\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Documents\My Videos\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.exe

Path C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\System.exe
Size 1.1MB
SHA256 1f9168ebe5c0fb87e5d3a637d2dfc6d6271ef1ad37c9da811743cc28dffccb1e
MD5 642ab556168baf4ec41c4e9f55bdc60e
SHA1 35a90fbaa712a843766b1a064b1ee87f2e523fea
SHA512 c2da42212a4498e7e4d5fdbda489585bc10360085c4aa797fc633f2aaa53512c2af59bb4b3d179270715126e5b577d44e3bd2494b2293e62f40ae5bcb685a7e7
SSDEEP 24576:/GsGAlkenHFOdfepVmC7iBtV2IwQZhAOCLYft/x:/XlzMUVatV2JkKzsft
MD5 SHA1 SHA512 SSDEEP

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Size 65KB
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar88D6.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar88D6.tmp
Size 171KB
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
SSDEEP 1536:+AuJ+lCUs0RvWqgCyPW5BXNWdm1wpyru2/3EwjYoz0VDTrubmt6mJp:+9J+q0RuXCyfdmAyru2/RAKtgp
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Windows\LiveKernelReports\lsass.exe
Size 1.1MB
SHA256 1f9168ebe5c0fb87e5d3a637d2dfc6d6271ef1ad37c9da811743cc28dffccb1e
MD5 642ab556168baf4ec41c4e9f55bdc60e
SHA1 35a90fbaa712a843766b1a064b1ee87f2e523fea
SHA512 c2da42212a4498e7e4d5fdbda489585bc10360085c4aa797fc633f2aaa53512c2af59bb4b3d179270715126e5b577d44e3bd2494b2293e62f40ae5bcb685a7e7
SSDEEP 24576:/GsGAlkenHFOdfepVmC7iBtV2IwQZhAOCLYft/x:/XlzMUVatV2JkKzsft
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Windows\LiveKernelReports\lsass.exe
Size 1.1MB
SHA256 1f9168ebe5c0fb87e5d3a637d2dfc6d6271ef1ad37c9da811743cc28dffccb1e
MD5 642ab556168baf4ec41c4e9f55bdc60e
SHA1 35a90fbaa712a843766b1a064b1ee87f2e523fea
SHA512 c2da42212a4498e7e4d5fdbda489585bc10360085c4aa797fc633f2aaa53512c2af59bb4b3d179270715126e5b577d44e3bd2494b2293e62f40ae5bcb685a7e7
SSDEEP 24576:/GsGAlkenHFOdfepVmC7iBtV2IwQZhAOCLYft/x:/XlzMUVatV2JkKzsft
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1048-36-0x000000001A950000-0x000000001A9D0000-memory.dmp

Download

memory/1048-33-0x0000000000890000-0x00000000009B6000-memory.dmp

Download

memory/1048-75-0x000000001A950000-0x000000001A9D0000-memory.dmp

Download

memory/1048-74-0x000007FEF5A00000-0x000007FEF63EC000-memory.dmp

Download

memory/1048-34-0x000007FEF5A00000-0x000007FEF63EC000-memory.dmp

Download

memory/1264-5-0x0000000000770000-0x0000000000786000-memory.dmp

Download

memory/1264-3-0x0000000000540000-0x000000000054E000-memory.dmp

Download

memory/1264-4-0x0000000000550000-0x0000000000558000-memory.dmp

Download

memory/1264-6-0x0000000000790000-0x000000000079C000-memory.dmp

Download

memory/1264-35-0x000007FEF5A00000-0x000007FEF63EC000-memory.dmp

Download

memory/1264-0-0x0000000000A00000-0x0000000000B26000-memory.dmp

Download

memory/1264-2-0x000000001B1B0000-0x000000001B230000-memory.dmp

Download

memory/1264-1-0x000007FEF5A00000-0x000007FEF63EC000-memory.dmp

Download

memory/1264-8-0x0000000000960000-0x000000000096C000-memory.dmp

Download

memory/1264-7-0x00000000007A0000-0x00000000007A8000-memory.dmp

Download