dcrat | 7849b02c1912451ca4703361443e161953750e9783ee237985db9cafaff76c04

Windows Service

T1543.003

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	d6b8c1db03cd0f282e1718daf0dc35cf.exe

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	2728	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	2728	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	2728	schtasks.exe	33

Windows security bypass 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\lsm.exe = "0"	lsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\d6b8c1db03cd0f282e1718daf0dc35cf.exe = "0"	d6b8c1db03cd0f282e1718daf0dc35cf.exe

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2672-23-0x0000000000400000-0x00000000004AC000-memory.dmp	dcrat
behavioral1/memory/2672-24-0x0000000000400000-0x00000000004AC000-memory.dmp	dcrat
behavioral1/memory/2672-29-0x0000000000400000-0x00000000004AC000-memory.dmp	dcrat
behavioral1/memory/2672-32-0x0000000000400000-0x00000000004AC000-memory.dmp	dcrat
behavioral1/memory/2672-34-0x0000000000400000-0x00000000004AC000-memory.dmp	dcrat
behavioral1/memory/2672-38-0x0000000004A60000-0x0000000004AA0000-memory.dmp	dcrat
behavioral1/memory/2412-90-0x0000000002740000-0x0000000002780000-memory.dmp	dcrat

Nirsoft 1 IoCs

resource	yara_rule
behavioral1/files/0x00090000000141a2-7.dat	Nirsoft

Executes dropped EXE 6 IoCs

pid	Process
2196	AdvancedRun.exe
1948	AdvancedRun.exe
1932	lsm.exe
1872	AdvancedRun.exe
2768	AdvancedRun.exe
1684	lsm.exe

Loads dropped DLL 9 IoCs

pid	Process
2820	d6b8c1db03cd0f282e1718daf0dc35cf.exe
2820	d6b8c1db03cd0f282e1718daf0dc35cf.exe
2196	AdvancedRun.exe
2196	AdvancedRun.exe
2672	d6b8c1db03cd0f282e1718daf0dc35cf.exe
1932	lsm.exe
1932	lsm.exe
1872	AdvancedRun.exe
1872	AdvancedRun.exe

Windows security modification 2 TTPs 9 IoCs

evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\d6b8c1db03cd0f282e1718daf0dc35cf.exe = "0"	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\lsm.exe = "0"	lsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	d6b8c1db03cd0f282e1718daf0dc35cf.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\ProgramData\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\lsm.exe\""	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Program Files\\Mozilla Firefox\\fonts\\taskhost.exe\""	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\PerfLogs\\Admin\\csrss.exe\""	d6b8c1db03cd0f282e1718daf0dc35cf.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2820 set thread context of 2672	2820	d6b8c1db03cd0f282e1718daf0dc35cf.exe	32
PID 1932 set thread context of 1684	1932	lsm.exe	42

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\fonts\taskhost.exe	d6b8c1db03cd0f282e1718daf0dc35cf.exe
File created	C:\Program Files\Mozilla Firefox\fonts\b75386f1303e64d8139363b71e44ac16341adf4e	d6b8c1db03cd0f282e1718daf0dc35cf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
3064	schtasks.exe
2044	schtasks.exe
2796	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2196	AdvancedRun.exe
2196	AdvancedRun.exe
1948	AdvancedRun.exe
1948	AdvancedRun.exe
2600	powershell.exe
2672	d6b8c1db03cd0f282e1718daf0dc35cf.exe
1872	AdvancedRun.exe
1872	AdvancedRun.exe
2768	AdvancedRun.exe
2768	AdvancedRun.exe
2412	powershell.exe
1684	lsm.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2196	AdvancedRun.exe
Token: SeImpersonatePrivilege	2196	AdvancedRun.exe
Token: SeDebugPrivilege	1948	AdvancedRun.exe
Token: SeImpersonatePrivilege	1948	AdvancedRun.exe
Token: SeDebugPrivilege	2820	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Token: SeDebugPrivilege	2672	d6b8c1db03cd0f282e1718daf0dc35cf.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	1872	AdvancedRun.exe
Token: SeImpersonatePrivilege	1872	AdvancedRun.exe
Token: SeDebugPrivilege	2768	AdvancedRun.exe
Token: SeImpersonatePrivilege	2768	AdvancedRun.exe
Token: SeDebugPrivilege	1932	lsm.exe
Token: SeDebugPrivilege	2412	powershell.exe
Token: SeDebugPrivilege	1684	lsm.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2196	2820	d6b8c1db03cd0f282e1718daf0dc35cf.exe	28
PID 2820 wrote to memory of 2196	2820	d6b8c1db03cd0f282e1718daf0dc35cf.exe	28
PID 2820 wrote to memory of 2196	2820	d6b8c1db03cd0f282e1718daf0dc35cf.exe	28
PID 2820 wrote to memory of 2196	2820	d6b8c1db03cd0f282e1718daf0dc35cf.exe	28
PID 2196 wrote to memory of 1948	2196	AdvancedRun.exe	29
PID 2196 wrote to memory of 1948	2196	AdvancedRun.exe	29
PID 2196 wrote to memory of 1948	2196	AdvancedRun.exe	29
PID 2196 wrote to memory of 1948	2196	AdvancedRun.exe	29
PID 2820 wrote to memory of 2600	2820	d6b8c1db03cd0f282e1718daf0dc35cf.exe	30
PID 2820 wrote to memory of 2600	2820	d6b8c1db03cd0f282e1718daf0dc35cf.exe	30
PID 2820 wrote to memory of 2600	2820	d6b8c1db03cd0f282e1718daf0dc35cf.exe	30
PID 2820 wrote to memory of 2600	2820	d6b8c1db03cd0f282e1718daf0dc35cf.exe	30
PID 2820 wrote to memory of 2672	2820	d6b8c1db03cd0f282e1718daf0dc35cf.exe	32
PID 2820 wrote to memory of 2672	2820	d6b8c1db03cd0f282e1718daf0dc35cf.exe	32
PID 2820 wrote to memory of 2672	2820	d6b8c1db03cd0f282e1718daf0dc35cf.exe	32
PID 2820 wrote to memory of 2672	2820	d6b8c1db03cd0f282e1718daf0dc35cf.exe	32
PID 2820 wrote to memory of 2672	2820	d6b8c1db03cd0f282e1718daf0dc35cf.exe	32
PID 2820 wrote to memory of 2672	2820	d6b8c1db03cd0f282e1718daf0dc35cf.exe	32
PID 2820 wrote to memory of 2672	2820	d6b8c1db03cd0f282e1718daf0dc35cf.exe	32
PID 2820 wrote to memory of 2672	2820	d6b8c1db03cd0f282e1718daf0dc35cf.exe	32
PID 2820 wrote to memory of 2672	2820	d6b8c1db03cd0f282e1718daf0dc35cf.exe	32
PID 2672 wrote to memory of 1932	2672	d6b8c1db03cd0f282e1718daf0dc35cf.exe	37
PID 2672 wrote to memory of 1932	2672	d6b8c1db03cd0f282e1718daf0dc35cf.exe	37
PID 2672 wrote to memory of 1932	2672	d6b8c1db03cd0f282e1718daf0dc35cf.exe	37
PID 2672 wrote to memory of 1932	2672	d6b8c1db03cd0f282e1718daf0dc35cf.exe	37
PID 1932 wrote to memory of 1872	1932	lsm.exe	38
PID 1932 wrote to memory of 1872	1932	lsm.exe	38
PID 1932 wrote to memory of 1872	1932	lsm.exe	38
PID 1932 wrote to memory of 1872	1932	lsm.exe	38
PID 1872 wrote to memory of 2768	1872	AdvancedRun.exe	39
PID 1872 wrote to memory of 2768	1872	AdvancedRun.exe	39
PID 1872 wrote to memory of 2768	1872	AdvancedRun.exe	39
PID 1872 wrote to memory of 2768	1872	AdvancedRun.exe	39
PID 1932 wrote to memory of 2412	1932	lsm.exe	40
PID 1932 wrote to memory of 2412	1932	lsm.exe	40
PID 1932 wrote to memory of 2412	1932	lsm.exe	40
PID 1932 wrote to memory of 2412	1932	lsm.exe	40
PID 1932 wrote to memory of 1684	1932	lsm.exe	42
PID 1932 wrote to memory of 1684	1932	lsm.exe	42
PID 1932 wrote to memory of 1684	1932	lsm.exe	42
PID 1932 wrote to memory of 1684	1932	lsm.exe	42
PID 1932 wrote to memory of 1684	1932	lsm.exe	42
PID 1932 wrote to memory of 1684	1932	lsm.exe	42
PID 1932 wrote to memory of 1684	1932	lsm.exe	42
PID 1932 wrote to memory of 1684	1932	lsm.exe	42
PID 1932 wrote to memory of 1684	1932	lsm.exe	42

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d6b8c1db03cd0f282e1718daf0dc35cf.exe
"C:\Users\Admin\AppData\Local\Temp\d6b8c1db03cd0f282e1718daf0dc35cf.exe"
1⤵
- DcRat
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Users\Admin\AppData\Local\Temp\1c50edc5-174f-4f17-96da-6204a8fcfb97\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\1c50edc5-174f-4f17-96da-6204a8fcfb97\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\1c50edc5-174f-4f17-96da-6204a8fcfb97\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Users\Admin\AppData\Local\Temp\1c50edc5-174f-4f17-96da-6204a8fcfb97\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\1c50edc5-174f-4f17-96da-6204a8fcfb97\AdvancedRun.exe" /SpecialRun 4101d8 2196
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1948
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\d6b8c1db03cd0f282e1718daf0dc35cf.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2600
- C:\Users\Admin\AppData\Local\Temp\d6b8c1db03cd0f282e1718daf0dc35cf.exe
  "C:\Users\Admin\AppData\Local\Temp\d6b8c1db03cd0f282e1718daf0dc35cf.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\lsm.exe
    "C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\lsm.exe"
    3⤵
    - Windows security bypass
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Users\Admin\AppData\Local\Temp\13c88ef5-8944-45d2-8419-31e431942fa3\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\13c88ef5-8944-45d2-8419-31e431942fa3\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\13c88ef5-8944-45d2-8419-31e431942fa3\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1872
    - - C:\Users\Admin\AppData\Local\Temp\13c88ef5-8944-45d2-8419-31e431942fa3\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\13c88ef5-8944-45d2-8419-31e431942fa3\AdvancedRun.exe" /SpecialRun 4101d8 1872
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2768
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\lsm.exe" -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2412
  - - C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\lsm.exe
      "C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\lsm.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\fonts\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\PerfLogs\Admin\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry