dcrat | 57d8aa5144b218e2f5932aa7dae64a40afd2219b6ce2859cd9f306151357039d

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 23:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
04a052321a1788c0130966758d1743f2.exe
Size 1.3MB
Sample240225-2586msfa63
SHA256 57d8aa5144b218e2f5932aa7dae64a40afd2219b6ce2859cd9f306151357039d
MD5 04a052321a1788c0130966758d1743f2
SHA1 639e7ca07dec42b0ad311d5adbdefccbdefeb917
SHA512 ac295d6a5518f55075eed748d35f132c3a40e9bec98d9b3c2f4204ed9832c096757335a1d0ea6fc44525a5e97934b105430ee1a63a591e1fc644fe158d61214c
SSDEEP 24576:F0OQXXd3cLuzK0HQwKuK7/bgWvyCiQlSYnzl0LaOrayjS:YsuPHQjvocylQlNB0Lp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat 30 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

pid	Process
1400	schtasks.exe
2724	schtasks.exe
1348	schtasks.exe
1736	schtasks.exe
4788	schtasks.exe
4752	schtasks.exe
3488	schtasks.exe
4608	schtasks.exe
1716	schtasks.exe
2312	schtasks.exe
2208	schtasks.exe
3064	schtasks.exe
1144	schtasks.exe
4864	schtasks.exe
4384	schtasks.exe
3736	schtasks.exe
4492	schtasks.exe
116	schtasks.exe
4856	schtasks.exe
216	schtasks.exe
776	schtasks.exe
5080	schtasks.exe
4840	schtasks.exe
3108	schtasks.exe
2688	schtasks.exe
5036	schtasks.exe
208	schtasks.exe
2572	schtasks.exe
2172	schtasks.exe
4132	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 10 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\04a052321a1788c0130966758d1743f2.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\", \"C:\\Program Files\\Microsoft Office\\Updates\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\backgroundTaskHost.exe\", \"C:\\Windows\\L2Schemas\\wininit.exe\", \"C:\\odt\\dllhost.exe\", \"C:\\Program Files\\Windows Media Player\\Skins\\wininit.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\04a052321a1788c0130966758d1743f2.exe\", \"C:\\Program Files\\7-Zip\\RuntimeBroker.exe\""	04a052321a1788c0130966758d1743f2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\04a052321a1788c0130966758d1743f2.exe\""	04a052321a1788c0130966758d1743f2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\04a052321a1788c0130966758d1743f2.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\""	04a052321a1788c0130966758d1743f2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\04a052321a1788c0130966758d1743f2.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\", \"C:\\Program Files\\Microsoft Office\\Updates\\RuntimeBroker.exe\""	04a052321a1788c0130966758d1743f2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\04a052321a1788c0130966758d1743f2.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\", \"C:\\Program Files\\Microsoft Office\\Updates\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\backgroundTaskHost.exe\", \"C:\\Windows\\L2Schemas\\wininit.exe\""	04a052321a1788c0130966758d1743f2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\04a052321a1788c0130966758d1743f2.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\", \"C:\\Program Files\\Microsoft Office\\Updates\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\backgroundTaskHost.exe\", \"C:\\Windows\\L2Schemas\\wininit.exe\", \"C:\\odt\\dllhost.exe\""	04a052321a1788c0130966758d1743f2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\04a052321a1788c0130966758d1743f2.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\", \"C:\\Program Files\\Microsoft Office\\Updates\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\backgroundTaskHost.exe\", \"C:\\Windows\\L2Schemas\\wininit.exe\", \"C:\\odt\\dllhost.exe\", \"C:\\Program Files\\Windows Media Player\\Skins\\wininit.exe\""	04a052321a1788c0130966758d1743f2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\04a052321a1788c0130966758d1743f2.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\", \"C:\\Program Files\\Microsoft Office\\Updates\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\backgroundTaskHost.exe\", \"C:\\Windows\\L2Schemas\\wininit.exe\", \"C:\\odt\\dllhost.exe\", \"C:\\Program Files\\Windows Media Player\\Skins\\wininit.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\04a052321a1788c0130966758d1743f2.exe\""	04a052321a1788c0130966758d1743f2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\04a052321a1788c0130966758d1743f2.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\""	04a052321a1788c0130966758d1743f2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\04a052321a1788c0130966758d1743f2.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\", \"C:\\Program Files\\Microsoft Office\\Updates\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\backgroundTaskHost.exe\""	04a052321a1788c0130966758d1743f2.exe

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4840	812	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3488	812	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	216	812	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4856	812	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4492	812	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4132	812	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5036	812	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	776	812	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3736	812	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	812	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4752	812	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	812	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	812	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4384	812	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	812	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	812	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	116	812	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	812	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4608	812	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5080	812	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4788	812	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3108	812	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	812	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1348	812	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	812	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	812	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4864	812	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	812	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	812	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1400	812	schtasks.exe	87

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1180-0-0x0000000000CE0000-0x0000000000E34000-memory.dmp	dcrat
behavioral2/files/0x0006000000023114-19.dat	dcrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	04a052321a1788c0130966758d1743f2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	04a052321a1788c0130966758d1743f2.exe

Executes dropped EXE 1 IoCs

pid	Process
840	RuntimeBroker.exe

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\""	04a052321a1788c0130966758d1743f2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Microsoft Office\\Updates\\RuntimeBroker.exe\""	04a052321a1788c0130966758d1743f2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\backgroundTaskHost.exe\""	04a052321a1788c0130966758d1743f2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\odt\\dllhost.exe\""	04a052321a1788c0130966758d1743f2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\WindowsRE\\winlogon.exe\""	04a052321a1788c0130966758d1743f2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\backgroundTaskHost.exe\""	04a052321a1788c0130966758d1743f2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\L2Schemas\\wininit.exe\""	04a052321a1788c0130966758d1743f2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\L2Schemas\\wininit.exe\""	04a052321a1788c0130966758d1743f2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\odt\\dllhost.exe\""	04a052321a1788c0130966758d1743f2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\04a052321a1788c0130966758d1743f2 = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\04a052321a1788c0130966758d1743f2.exe\""	04a052321a1788c0130966758d1743f2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\04a052321a1788c0130966758d1743f2 = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\04a052321a1788c0130966758d1743f2.exe\""	04a052321a1788c0130966758d1743f2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\04a052321a1788c0130966758d1743f2 = "\"C:\\odt\\04a052321a1788c0130966758d1743f2.exe\""	04a052321a1788c0130966758d1743f2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\RuntimeBroker.exe\""	04a052321a1788c0130966758d1743f2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\WindowsRE\\winlogon.exe\""	04a052321a1788c0130966758d1743f2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files\\Windows Media Player\\Skins\\wininit.exe\""	04a052321a1788c0130966758d1743f2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\7-Zip\\RuntimeBroker.exe\""	04a052321a1788c0130966758d1743f2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\7-Zip\\RuntimeBroker.exe\""	04a052321a1788c0130966758d1743f2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\04a052321a1788c0130966758d1743f2 = "\"C:\\odt\\04a052321a1788c0130966758d1743f2.exe\""	04a052321a1788c0130966758d1743f2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Microsoft Office\\Updates\\RuntimeBroker.exe\""	04a052321a1788c0130966758d1743f2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files\\Windows Media Player\\Skins\\wininit.exe\""	04a052321a1788c0130966758d1743f2.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_2020.1906.55.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\spoolsv.exe	04a052321a1788c0130966758d1743f2.exe
File created	C:\Program Files\7-Zip\9e8d7a4ca61bd9	04a052321a1788c0130966758d1743f2.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\9e8d7a4ca61bd9	04a052321a1788c0130966758d1743f2.exe
File created	C:\Program Files\Microsoft Office\Updates\RuntimeBroker.exe	04a052321a1788c0130966758d1743f2.exe
File created	C:\Program Files\Microsoft Office\Updates\9e8d7a4ca61bd9	04a052321a1788c0130966758d1743f2.exe
File created	C:\Program Files\Windows Media Player\Skins\wininit.exe	04a052321a1788c0130966758d1743f2.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe	04a052321a1788c0130966758d1743f2.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\backgroundTaskHost.exe	04a052321a1788c0130966758d1743f2.exe
File opened for modification	C:\Program Files\Windows Media Player\Skins\wininit.exe	04a052321a1788c0130966758d1743f2.exe
File created	C:\Program Files\Windows Media Player\Skins\56085415360792	04a052321a1788c0130966758d1743f2.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\04a052321a1788c0130966758d1743f2.exe	04a052321a1788c0130966758d1743f2.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\55f5ec8be98217	04a052321a1788c0130966758d1743f2.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\eddb19405b7ce1	04a052321a1788c0130966758d1743f2.exe
File created	C:\Program Files\7-Zip\RuntimeBroker.exe	04a052321a1788c0130966758d1743f2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\L2Schemas\wininit.exe	04a052321a1788c0130966758d1743f2.exe
File created	C:\Windows\L2Schemas\56085415360792	04a052321a1788c0130966758d1743f2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3488	schtasks.exe
3736	schtasks.exe
2688	schtasks.exe
3064	schtasks.exe
4840	schtasks.exe
2724	schtasks.exe
4384	schtasks.exe
4788	schtasks.exe
4864	schtasks.exe
4856	schtasks.exe
4608	schtasks.exe
5080	schtasks.exe
3108	schtasks.exe
1348	schtasks.exe
1144	schtasks.exe
216	schtasks.exe
5036	schtasks.exe
2572	schtasks.exe
1736	schtasks.exe
4492	schtasks.exe
208	schtasks.exe
2172	schtasks.exe
776	schtasks.exe
1716	schtasks.exe
4132	schtasks.exe
116	schtasks.exe
1400	schtasks.exe
4752	schtasks.exe
2208	schtasks.exe
2312	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000_Classes\Local Settings	04a052321a1788c0130966758d1743f2.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
1180	04a052321a1788c0130966758d1743f2.exe
1180	04a052321a1788c0130966758d1743f2.exe
1180	04a052321a1788c0130966758d1743f2.exe
1180	04a052321a1788c0130966758d1743f2.exe
1180	04a052321a1788c0130966758d1743f2.exe
728	04a052321a1788c0130966758d1743f2.exe
728	04a052321a1788c0130966758d1743f2.exe
728	04a052321a1788c0130966758d1743f2.exe
840	RuntimeBroker.exe
840	RuntimeBroker.exe
840	RuntimeBroker.exe
840	RuntimeBroker.exe
840	RuntimeBroker.exe
840	RuntimeBroker.exe
840	RuntimeBroker.exe
840	RuntimeBroker.exe
840	RuntimeBroker.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
840	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1180	04a052321a1788c0130966758d1743f2.exe
Token: SeDebugPrivilege	728	04a052321a1788c0130966758d1743f2.exe
Token: SeDebugPrivilege	840	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 1368	1180	04a052321a1788c0130966758d1743f2.exe	109
PID 1180 wrote to memory of 1368	1180	04a052321a1788c0130966758d1743f2.exe	109
PID 1368 wrote to memory of 884	1368	cmd.exe	111
PID 1368 wrote to memory of 884	1368	cmd.exe	111
PID 1368 wrote to memory of 728	1368	cmd.exe	112
PID 1368 wrote to memory of 728	1368	cmd.exe	112
PID 728 wrote to memory of 840	728	04a052321a1788c0130966758d1743f2.exe	122
PID 728 wrote to memory of 840	728	04a052321a1788c0130966758d1743f2.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\04a052321a1788c0130966758d1743f2.exe
"C:\Users\Admin\AppData\Local\Temp\04a052321a1788c0130966758d1743f2.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yr7U4buvFx.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:884
- - C:\Users\Admin\AppData\Local\Temp\04a052321a1788c0130966758d1743f2.exe
    "C:\Users\Admin\AppData\Local\Temp\04a052321a1788c0130966758d1743f2.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Checks computer location settings
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:728
  - - C:\Program Files\7-Zip\RuntimeBroker.exe
      "C:\Program Files\7-Zip\RuntimeBroker.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "04a052321a1788c0130966758d1743f20" /sc MINUTE /mo 9 /tr "'C:\odt\04a052321a1788c0130966758d1743f2.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "04a052321a1788c0130966758d1743f20" /sc MINUTE /mo 12 /tr "'C:\odt\04a052321a1788c0130966758d1743f2.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "04a052321a1788c0130966758d1743f2" /sc ONLOGON /tr "'C:\odt\04a052321a1788c0130966758d1743f2.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office\Updates\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Updates\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office\Updates\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Windows\L2Schemas\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\L2Schemas\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Windows\L2Schemas\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\odt\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Media Player\Skins\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Skins\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\Skins\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "04a052321a1788c0130966758d1743f20" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\04a052321a1788c0130966758d1743f2.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "04a052321a1788c0130966758d1743f2" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\04a052321a1788c0130966758d1743f2.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "04a052321a1788c0130966758d1743f20" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\04a052321a1788c0130966758d1743f2.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\7-Zip\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\7-Zip\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

backgroundTaskHost.exe

Path C:\Program Files (x86)\Windows Sidebar\Gadgets\backgroundTaskHost.exe
Size 1.3MB
SHA256 57d8aa5144b218e2f5932aa7dae64a40afd2219b6ce2859cd9f306151357039d
MD5 04a052321a1788c0130966758d1743f2
SHA1 639e7ca07dec42b0ad311d5adbdefccbdefeb917
SHA512 ac295d6a5518f55075eed748d35f132c3a40e9bec98d9b3c2f4204ed9832c096757335a1d0ea6fc44525a5e97934b105430ee1a63a591e1fc644fe158d61214c
SSDEEP 24576:F0OQXXd3cLuzK0HQwKuK7/bgWvyCiQlSYnzl0LaOrayjS:YsuPHQjvocylQlNB0Lp
MD5 SHA1 SHA512 SSDEEP

Submit Download

04a052321a1788c0130966758d1743f2.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\04a052321a1788c0130966758d1743f2.exe.log
Size 1KB
SHA256 eb70c64ae99d14ac2588b7a84854fbf3c420532d7fe4dfd49c7b5a70c869943a
MD5 bbb951a34b516b66451218a3ec3b0ae1
SHA1 7393835a2476ae655916e0a9687eeaba3ee876e9
SHA512 63bcbfcf8e7421c66855c487c31b2991a989bdea0c1edd4c40066b52fa3eb3d9d37db1cd21b8eb4f33dd5870cc20532c8f485eab9c0b4f6b0793a35c077f2d6f
MD5 SHA1 SHA512

Submit Download

db619db65645c50119a87f5d0b2681da148226c04.5.32cb6e7cc7d98dab2d438b8ebf463334d77ecda568

Path C:\Users\Admin\AppData\Local\Temp\db619db65645c50119a87f5d0b2681da148226c04.5.32cb6e7cc7d98dab2d438b8ebf463334d77ecda568
Size 372B
SHA256 52dc0840df122ce258255b8b78a220706cbd7f233aa92f0de6f62e03b222f749
MD5 3ecda9dedc09cc38bd2917fef4668af6
SHA1 db678e1e418e805e4479620f0c3251aea0300946
SHA512 6b75a1dc1910de5c908924b91cd8babb39d0be2de066140850c4e4c54db9ce5d9a5c8a46a3f67e88fffe30c46b6787f50eff2b600ca40f2cdc25749996922d4a
MD5 SHA1 SHA512

Submit Download

yr7U4buvFx.bat

Path C:\Users\Admin\AppData\Local\Temp\yr7U4buvFx.bat
Size 235B
SHA256 b5ed92db8f5afc747b546543c684d1e7592426d0a4c8db7bb5e7d8dd6011473d
MD5 668346f7a2f16fce45c7acc4b1c005fe
SHA1 682ab1f679d9b5b55720e41732f6e5a26de36807
SHA512 b7cf2feb66cab601ed16e0add637fcfb01e023b6109b8bf29a91ac45d78c2205629260879315ee8bbc794152be6dd0af8524de69e8bf0f032ef38f33bff073d2
MD5 SHA1 SHA512

Submit Download

memory/728-56-0x00007FFFCBCC0000-0x00007FFFCC781000-memory.dmp

Download

memory/728-36-0x00000000032C0000-0x00000000032D2000-memory.dmp

Download

memory/728-35-0x000000001BB60000-0x000000001BB70000-memory.dmp

Download

memory/728-34-0x00007FFFCBCC0000-0x00007FFFCC781000-memory.dmp

Download

memory/840-58-0x00007FFFCBCC0000-0x00007FFFCC781000-memory.dmp

Download

memory/840-57-0x000000001C3C0000-0x000000001C3D2000-memory.dmp

Download

memory/840-55-0x00007FFFCBCC0000-0x00007FFFCC781000-memory.dmp

Download

memory/1180-5-0x000000001B960000-0x000000001B976000-memory.dmp

Download

memory/1180-10-0x0000000001620000-0x0000000001628000-memory.dmp

Download

memory/1180-32-0x00007FFFCBA40000-0x00007FFFCC501000-memory.dmp

Download

memory/1180-9-0x0000000001610000-0x0000000001618000-memory.dmp

Download

memory/1180-8-0x0000000001600000-0x000000000160E000-memory.dmp

Download

memory/1180-7-0x000000001C7B0000-0x000000001CCD8000-memory.dmp

Download

memory/1180-6-0x0000000002F70000-0x0000000002F82000-memory.dmp

Download

memory/1180-0-0x0000000000CE0000-0x0000000000E34000-memory.dmp

Download

memory/1180-4-0x000000001B9B0000-0x000000001BA00000-memory.dmp

Download

memory/1180-3-0x0000000002F50000-0x0000000002F6C000-memory.dmp

Download

memory/1180-2-0x000000001BA00000-0x000000001BA10000-memory.dmp

Download

memory/1180-1-0x00007FFFCBA40000-0x00007FFFCC501000-memory.dmp

Download