dcrat | 1f9168ebe5c0fb87e5d3a637d2dfc6d6271ef1ad37c9da811743cc28dffccb1e

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
09/12/2023, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
642ab556168baf4ec41c4e9f55bdc60e.exe
Size 1.1MB
Sample231209-dpcwhaedap
SHA256 1f9168ebe5c0fb87e5d3a637d2dfc6d6271ef1ad37c9da811743cc28dffccb1e
MD5 642ab556168baf4ec41c4e9f55bdc60e
SHA1 35a90fbaa712a843766b1a064b1ee87f2e523fea
SHA512 c2da42212a4498e7e4d5fdbda489585bc10360085c4aa797fc633f2aaa53512c2af59bb4b3d179270715126e5b577d44e3bd2494b2293e62f40ae5bcb685a7e7
SSDEEP 24576:/GsGAlkenHFOdfepVmC7iBtV2IwQZhAOCLYft/x:/XlzMUVatV2JkKzsft
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat 33 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

pid	Process
1180	schtasks.exe
952	schtasks.exe
3876	schtasks.exe
5040	schtasks.exe
2284	schtasks.exe
4600	schtasks.exe
3724	schtasks.exe
2500	schtasks.exe
5064	schtasks.exe
2732	schtasks.exe
4980	schtasks.exe
3156	schtasks.exe
3020	schtasks.exe
4944	schtasks.exe
3648	schtasks.exe
3836	schtasks.exe
1364	schtasks.exe
4048	schtasks.exe
4924	schtasks.exe
4272	schtasks.exe
4592	schtasks.exe
1020	schtasks.exe
1516	schtasks.exe
2208	schtasks.exe
5044	schtasks.exe
4604	schtasks.exe
2904	schtasks.exe
1048	schtasks.exe
3580	schtasks.exe
3436	schtasks.exe
4464	schtasks.exe
1992	schtasks.exe
2244	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 11 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\", \"C:\\Windows\\twain_32\\backgroundTaskHost.exe\", \"C:\\odt\\lsass.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\System.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\", \"C:\\Windows\\twain_32\\backgroundTaskHost.exe\", \"C:\\odt\\lsass.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\System.exe\", \"C:\\Users\\Public\\SearchApp.exe\", \"C:\\Windows\\PLA\\Templates\\fontdrvhost.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\", \"C:\\Windows\\twain_32\\backgroundTaskHost.exe\", \"C:\\odt\\lsass.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\System.exe\", \"C:\\Users\\Public\\SearchApp.exe\", \"C:\\Windows\\PLA\\Templates\\fontdrvhost.exe\", \"C:\\Users\\Default User\\sihost.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\backgroundTaskHost.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\", \"C:\\Windows\\twain_32\\backgroundTaskHost.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\", \"C:\\Windows\\twain_32\\backgroundTaskHost.exe\", \"C:\\odt\\lsass.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\", \"C:\\Windows\\twain_32\\backgroundTaskHost.exe\", \"C:\\odt\\lsass.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\System.exe\", \"C:\\Users\\Public\\SearchApp.exe\", \"C:\\Windows\\PLA\\Templates\\fontdrvhost.exe\", \"C:\\Users\\Default User\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\", \"C:\\Windows\\twain_32\\backgroundTaskHost.exe\", \"C:\\odt\\lsass.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\System.exe\", \"C:\\Users\\Public\\SearchApp.exe\", \"C:\\Windows\\PLA\\Templates\\fontdrvhost.exe\", \"C:\\Users\\Default User\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\explorer.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\dwm.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\", \"C:\\Windows\\twain_32\\backgroundTaskHost.exe\", \"C:\\odt\\lsass.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\System.exe\", \"C:\\Users\\Public\\SearchApp.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe

Process spawned unexpected child process 33 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1020	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1180	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5064	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4944	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4272	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3648	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3836	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4592	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1364	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4600	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3724	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3580	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3876	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3436	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4048	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4980	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4464	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3156	2044	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	2044	schtasks.exe	87

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/116-0-0x00000000009B0000-0x0000000000AD6000-memory.dmp	dcrat
behavioral2/files/0x000600000002328b-17.dat	dcrat
behavioral2/files/0x000600000002329d-41.dat	dcrat
behavioral2/files/0x000600000002329d-39.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\Control Panel\International\Geo\Nation	642ab556168baf4ec41c4e9f55bdc60e.exe

Executes dropped EXE 1 IoCs

pid	Process
3988	backgroundTaskHost.exe

Adds Run key to start application 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\explorer.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\TypeSupport\\Unicode\\explorer.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\odt\\lsass.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Recovery\\WindowsRE\\dwm.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Windows\\twain_32\\backgroundTaskHost.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Windows\\twain_32\\backgroundTaskHost.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Users\\Public\\SearchApp.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\odt\\backgroundTaskHost.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Default User\\RuntimeBroker.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Default User\\RuntimeBroker.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\odt\\lsass.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\System.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\System.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Users\\Public\\SearchApp.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\PLA\\Templates\\fontdrvhost.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\odt\\backgroundTaskHost.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Recovery\\WindowsRE\\dwm.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\Default User\\sihost.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\PLA\\Templates\\fontdrvhost.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\Default User\\sihost.exe\""	642ab556168baf4ec41c4e9f55bdc60e.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\System.exe	642ab556168baf4ec41c4e9f55bdc60e.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\27d1bcfc3c54e0	642ab556168baf4ec41c4e9f55bdc60e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\explorer.exe	642ab556168baf4ec41c4e9f55bdc60e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\7a0fd90576e088	642ab556168baf4ec41c4e9f55bdc60e.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\twain_32\eddb19405b7ce1	642ab556168baf4ec41c4e9f55bdc60e.exe
File created	C:\Windows\PLA\Templates\fontdrvhost.exe	642ab556168baf4ec41c4e9f55bdc60e.exe
File created	C:\Windows\PLA\Templates\5b884080fd4f94	642ab556168baf4ec41c4e9f55bdc60e.exe
File created	C:\Windows\twain_32\backgroundTaskHost.exe	642ab556168baf4ec41c4e9f55bdc60e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4944	schtasks.exe
1048	schtasks.exe
3156	schtasks.exe
5040	schtasks.exe
4592	schtasks.exe
2284	schtasks.exe
3580	schtasks.exe
2904	schtasks.exe
1516	schtasks.exe
3648	schtasks.exe
4600	schtasks.exe
4980	schtasks.exe
5064	schtasks.exe
952	schtasks.exe
2208	schtasks.exe
3436	schtasks.exe
2732	schtasks.exe
4048	schtasks.exe
4604	schtasks.exe
4924	schtasks.exe
4464	schtasks.exe
3020	schtasks.exe
2244	schtasks.exe
1180	schtasks.exe
3836	schtasks.exe
3724	schtasks.exe
1992	schtasks.exe
1020	schtasks.exe
4272	schtasks.exe
1364	schtasks.exe
3876	schtasks.exe
2500	schtasks.exe
5044	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
116	642ab556168baf4ec41c4e9f55bdc60e.exe
116	642ab556168baf4ec41c4e9f55bdc60e.exe
116	642ab556168baf4ec41c4e9f55bdc60e.exe
116	642ab556168baf4ec41c4e9f55bdc60e.exe
116	642ab556168baf4ec41c4e9f55bdc60e.exe
116	642ab556168baf4ec41c4e9f55bdc60e.exe
116	642ab556168baf4ec41c4e9f55bdc60e.exe
116	642ab556168baf4ec41c4e9f55bdc60e.exe
116	642ab556168baf4ec41c4e9f55bdc60e.exe
116	642ab556168baf4ec41c4e9f55bdc60e.exe
116	642ab556168baf4ec41c4e9f55bdc60e.exe
3988	backgroundTaskHost.exe
3988	backgroundTaskHost.exe
3988	backgroundTaskHost.exe
3988	backgroundTaskHost.exe
3988	backgroundTaskHost.exe
3988	backgroundTaskHost.exe
3988	backgroundTaskHost.exe
3988	backgroundTaskHost.exe
3988	backgroundTaskHost.exe
3988	backgroundTaskHost.exe
3988	backgroundTaskHost.exe
3988	backgroundTaskHost.exe
3988	backgroundTaskHost.exe
3988	backgroundTaskHost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3988	backgroundTaskHost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	116	642ab556168baf4ec41c4e9f55bdc60e.exe
Token: SeDebugPrivilege	3988	backgroundTaskHost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 3988	116	642ab556168baf4ec41c4e9f55bdc60e.exe	122
PID 116 wrote to memory of 3988	116	642ab556168baf4ec41c4e9f55bdc60e.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\642ab556168baf4ec41c4e9f55bdc60e.exe
"C:\Users\Admin\AppData\Local\Temp\642ab556168baf4ec41c4e9f55bdc60e.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:116
- C:\Recovery\WindowsRE\backgroundTaskHost.exe
  "C:\Recovery\WindowsRE\backgroundTaskHost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\odt\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\odt\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\odt\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Windows\twain_32\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\twain_32\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Windows\twain_32\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\odt\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\odt\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\odt\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Users\Public\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\Public\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Users\Public\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Windows\PLA\Templates\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\PLA\Templates\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Windows\PLA\Templates\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\sihost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Default User\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

backgroundTaskHost.exe

Path C:\Recovery\WindowsRE\backgroundTaskHost.exe
Size 1.1MB
SHA256 1f9168ebe5c0fb87e5d3a637d2dfc6d6271ef1ad37c9da811743cc28dffccb1e
MD5 642ab556168baf4ec41c4e9f55bdc60e
SHA1 35a90fbaa712a843766b1a064b1ee87f2e523fea
SHA512 c2da42212a4498e7e4d5fdbda489585bc10360085c4aa797fc633f2aaa53512c2af59bb4b3d179270715126e5b577d44e3bd2494b2293e62f40ae5bcb685a7e7
SSDEEP 24576:/GsGAlkenHFOdfepVmC7iBtV2IwQZhAOCLYft/x:/XlzMUVatV2JkKzsft
MD5 SHA1 SHA512 SSDEEP

Submit Download

backgroundTaskHost.exe

Path C:\Recovery\WindowsRE\backgroundTaskHost.exe
Size 1.1MB
SHA256 1f9168ebe5c0fb87e5d3a637d2dfc6d6271ef1ad37c9da811743cc28dffccb1e
MD5 642ab556168baf4ec41c4e9f55bdc60e
SHA1 35a90fbaa712a843766b1a064b1ee87f2e523fea
SHA512 c2da42212a4498e7e4d5fdbda489585bc10360085c4aa797fc633f2aaa53512c2af59bb4b3d179270715126e5b577d44e3bd2494b2293e62f40ae5bcb685a7e7
SSDEEP 24576:/GsGAlkenHFOdfepVmC7iBtV2IwQZhAOCLYft/x:/XlzMUVatV2JkKzsft
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\odt\lsass.exe
Size 1.1MB
SHA256 1f9168ebe5c0fb87e5d3a637d2dfc6d6271ef1ad37c9da811743cc28dffccb1e
MD5 642ab556168baf4ec41c4e9f55bdc60e
SHA1 35a90fbaa712a843766b1a064b1ee87f2e523fea
SHA512 c2da42212a4498e7e4d5fdbda489585bc10360085c4aa797fc633f2aaa53512c2af59bb4b3d179270715126e5b577d44e3bd2494b2293e62f40ae5bcb685a7e7
SSDEEP 24576:/GsGAlkenHFOdfepVmC7iBtV2IwQZhAOCLYft/x:/XlzMUVatV2JkKzsft
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/116-8-0x0000000002C40000-0x0000000002C4C000-memory.dmp

Download

memory/116-2-0x000000001B7F0000-0x000000001B800000-memory.dmp

Download

memory/116-5-0x0000000002C00000-0x0000000002C16000-memory.dmp

Download

memory/116-6-0x0000000002C20000-0x0000000002C2C000-memory.dmp

Download

memory/116-7-0x0000000002C30000-0x0000000002C38000-memory.dmp

Download

memory/116-0-0x00000000009B0000-0x0000000000AD6000-memory.dmp

Download

memory/116-3-0x0000000002BE0000-0x0000000002BEE000-memory.dmp

Download

memory/116-4-0x0000000002BF0000-0x0000000002BF8000-memory.dmp

Download

memory/116-1-0x00007FFA99880000-0x00007FFA9A341000-memory.dmp

Download

memory/116-43-0x00007FFA99880000-0x00007FFA9A341000-memory.dmp

Download

memory/3988-42-0x00007FFA99880000-0x00007FFA9A341000-memory.dmp

Download

memory/3988-44-0x000000001AFF0000-0x000000001B000000-memory.dmp

Download

memory/3988-45-0x00007FFA99880000-0x00007FFA9A341000-memory.dmp

Download

memory/3988-46-0x000000001AFF0000-0x000000001B000000-memory.dmp

Download