Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    28/03/2024, 20:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    471339a0525809eab74b55fed407ac64697dbcfdaf52b21b56cc4a47125e76a8.exe
  • Size 260KB
  • Sample240328-zhmb9agg93
  • SHA256 471339a0525809eab74b55fed407ac64697dbcfdaf52b21b56cc4a47125e76a8
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
dcratdjvugluptebaredlinesmokeloadervidar5739ef2bbcd39fcd59c5746bfe4238c5logsdiller cloud (tg: @logsdillabot)pub1backdoordiscoverydropperevasioninfostealerloaderpersistenceransomwareratrootkitspywarestealertrojanupx

Malware Config

Extracted

Family

  • smokeloader

Botnet

  • pub1

Extracted

Family

  • smokeloader

Version

  • 2022

C2

  • http://trad-einmyus.com/index.php

  • http://tradein-myus.com/index.php

  • http://trade-inmyus.com/index.php

rc4.i32
rc4.i32

Extracted

Family

  • djvu

C2

  • http://sajdfue.com/test1/get.php

Attributes
  • extension

    .vook

  • offline_id

    1eSPzWRaNslCgtjBZfL5pzvovoiaVI4IZSnvAwt1

  • payload_url

    http://sdfjhuz.com/dl/build2.exe

    http://sajdfue.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/3ed7a617738550b0a00c5aa231c0752020240316170955/d71ce1 Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0857PsawqS

rsa_pubkey.plain

Extracted

Family

  • redline

Botnet

  • LogsDiller Cloud (TG: @logsdillabot)

C2

  • 5.42.65.0:29587

Extracted

Family

  • vidar

Version

  • 8.6

Botnet

  • 5739ef2bbcd39fcd59c5746bfe4238c5

C2

  • https://steamcommunity.com/profiles/76561199658817715

  • https://t.me/sa9ok

Attributes
  • profile_id_v2

    5739ef2bbcd39fcd59c5746bfe4238c5

  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36

Signatures

  • DcRat 6 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Detect Vidar Stealer 5 IoCs
    stealer
  • Detected Djvu ransomware 16 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 4 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Downloads MZ/PE file
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 19 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Drops file in System32 directory 7 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 61 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 12 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 57 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 43 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\471339a0525809eab74b55fed407ac64697dbcfdaf52b21b56cc4a47125e76a8.exe
    "C:\Users\Admin\AppData\Local\Temp\471339a0525809eab74b55fed407ac64697dbcfdaf52b21b56cc4a47125e76a8.exe"
    1⤵
    • DcRat
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:3204
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9078.bat" "
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1768
    • C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
      2⤵
        PID:2260
    • C:\Users\Admin\AppData\Local\Temp\9E44.exe
      C:\Users\Admin\AppData\Local\Temp\9E44.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:3956
      • C:\Users\Admin\AppData\Local\Temp\9E44.exe
        C:\Users\Admin\AppData\Local\Temp\9E44.exe
        2⤵
        • DcRat
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3188
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Users\Admin\AppData\Local\f2a4b65d-c904-4cf8-a746-a3b8e71f7ee4" /deny *S-1-1-0:(OI)(CI)(DE,DC)
          3⤵
          • Modifies file permissions
          PID:3124
        • C:\Users\Admin\AppData\Local\Temp\9E44.exe
          "C:\Users\Admin\AppData\Local\Temp\9E44.exe" --Admin IsNotAutoStart IsNotTask
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:3708
          • C:\Users\Admin\AppData\Local\Temp\9E44.exe
            "C:\Users\Admin\AppData\Local\Temp\9E44.exe" --Admin IsNotAutoStart IsNotTask
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1924
            • C:\Users\Admin\AppData\Local\a08545bf-360f-478e-bd53-780b9dc16b19\build2.exe
              "C:\Users\Admin\AppData\Local\a08545bf-360f-478e-bd53-780b9dc16b19\build2.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:1484
              • C:\Users\Admin\AppData\Local\a08545bf-360f-478e-bd53-780b9dc16b19\build2.exe
                "C:\Users\Admin\AppData\Local\a08545bf-360f-478e-bd53-780b9dc16b19\build2.exe"
                6⤵
                • Executes dropped EXE
                PID:4544
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 2092
                  7⤵
                  • Program crash
                  PID:3520
            • C:\Users\Admin\AppData\Local\a08545bf-360f-478e-bd53-780b9dc16b19\build3.exe
              "C:\Users\Admin\AppData\Local\a08545bf-360f-478e-bd53-780b9dc16b19\build3.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:2348
              • C:\Users\Admin\AppData\Local\a08545bf-360f-478e-bd53-780b9dc16b19\build3.exe
                "C:\Users\Admin\AppData\Local\a08545bf-360f-478e-bd53-780b9dc16b19\build3.exe"
                6⤵
                • Executes dropped EXE
                PID:976
                • C:\Windows\SysWOW64\schtasks.exe
                  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                  7⤵
                  • DcRat
                  • Creates scheduled task(s)
                  PID:5000
    • C:\Users\Admin\AppData\Local\Temp\A858.exe
      C:\Users\Admin\AppData\Local\Temp\A858.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:748
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3352
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 784
        2⤵
        • Program crash
        PID:4756
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 748 -ip 748
      1⤵
        PID:404
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 4544 -ip 4544
        1⤵
          PID:3728
        • C:\Users\Admin\AppData\Local\Temp\D37F.exe
          C:\Users\Admin\AppData\Local\Temp\D37F.exe
          1⤵
          • Executes dropped EXE
          PID:4604
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\D584.bat" "
          1⤵
            PID:3628
            • C:\Windows\system32\reg.exe
              reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
              2⤵
                PID:2956
            • C:\Users\Admin\AppData\Local\Temp\966.exe
              C:\Users\Admin\AppData\Local\Temp\966.exe
              1⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              PID:2816
              • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                2⤵
                  PID:4904
              • C:\Users\Admin\AppData\Local\Temp\1994.exe
                C:\Users\Admin\AppData\Local\Temp\1994.exe
                1⤵
                • Executes dropped EXE
                PID:2372
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  2⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4140
                • C:\Users\Admin\AppData\Local\Temp\1994.exe
                  "C:\Users\Admin\AppData\Local\Temp\1994.exe"
                  2⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Checks for VirtualBox DLLs, possible anti-VM trick
                  • Drops file in Windows directory
                  • Modifies data under HKEY_USERS
                  PID:4772
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    3⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    PID:4712
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                    3⤵
                      PID:3608
                      • C:\Windows\system32\netsh.exe
                        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                        4⤵
                        • Modifies Windows Firewall
                        PID:3848
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      3⤵
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      PID:4868
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      3⤵
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      PID:5032
                    • C:\Windows\rss\csrss.exe
                      C:\Windows\rss\csrss.exe
                      3⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Manipulates WinMonFS driver.
                      • Drops file in Windows directory
                      PID:2812
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        4⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        PID:4652
                      • C:\Windows\SYSTEM32\schtasks.exe
                        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                        4⤵
                        • DcRat
                        • Creates scheduled task(s)
                        PID:4036
                      • C:\Windows\SYSTEM32\schtasks.exe
                        schtasks /delete /tn ScheduledUpdate /f
                        4⤵
                          PID:3468
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          4⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          PID:4716
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          4⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          PID:3584
                        • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                          C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                          4⤵
                          • Executes dropped EXE
                          PID:1216
                        • C:\Windows\SYSTEM32\schtasks.exe
                          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                          4⤵
                          • DcRat
                          • Creates scheduled task(s)
                          PID:4588
                        • C:\Windows\windefender.exe
                          "C:\Windows\windefender.exe"
                          4⤵
                          • Executes dropped EXE
                          PID:4372
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                            5⤵
                              PID:4360
                              • C:\Windows\SysWOW64\sc.exe
                                sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                6⤵
                                • Launches sc.exe
                                PID:5040
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                      • Modifies Installed Components in the registry
                      • Enumerates connected drives
                      • Checks SCSI registry key(s)
                      • Modifies registry class
                      • Suspicious behavior: GetForegroundWindowSpam
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of SetWindowsHookEx
                      PID:812
                    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                      1⤵
                      • Enumerates system info in registry
                      • Modifies Internet Explorer settings
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      PID:1480
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      PID:5060
                    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                      1⤵
                      • Enumerates system info in registry
                      • Modifies Internet Explorer settings
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      PID:1936
                    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                      1⤵
                      • Enumerates system info in registry
                      • Modifies Internet Explorer settings
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      PID:2560
                    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                      1⤵
                      • Enumerates system info in registry
                      • Modifies Internet Explorer settings
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      PID:2612
                    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                      1⤵
                      • Enumerates system info in registry
                      • Modifies Internet Explorer settings
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      PID:2888
                    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                      1⤵
                      • Enumerates system info in registry
                      • Modifies Internet Explorer settings
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      PID:1244
                    • C:\Windows\windefender.exe
                      C:\Windows\windefender.exe
                      1⤵
                      • Executes dropped EXE
                      • Modifies data under HKEY_USERS
                      PID:2516
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:2888
                      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                        2⤵
                        • Executes dropped EXE
                        PID:3644
                        • C:\Windows\SysWOW64\schtasks.exe
                          /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                          3⤵
                          • DcRat
                          • Creates scheduled task(s)
                          PID:3944

                    Network

                          MITRE ATT&CK Enterprise v15

                          Reconnaissance

                          Resource Development

                          Initial Access

                          Execution

                          Scheduled Task/Job

                          1
                          T1053

                          Persistence

                          Boot or Logon Autostart Execution

                          2
                          T1547

                          Registry Run Keys / Startup Folder

                          2
                          T1547.001

                          Create or Modify System Process

                          1
                          T1543

                          Windows Service

                          1
                          T1543.003

                          Scheduled Task/Job

                          1
                          T1053

                          Privilege Escalation

                          Boot or Logon Autostart Execution

                          2
                          T1547

                          Registry Run Keys / Startup Folder

                          2
                          T1547.001

                          Create or Modify System Process

                          1
                          T1543

                          Windows Service

                          1
                          T1543.003

                          Scheduled Task/Job

                          1
                          T1053

                          Defense Evasion

                          File and Directory Permissions Modification

                          1
                          T1222

                          Impair Defenses

                          1
                          T1562

                          Disable or Modify System Firewall

                          1
                          T1562.004

                          Modify Registry

                          3
                          T1112

                          Credential Access

                          Unsecured Credentials

                          3
                          T1552

                          Credentials In Files

                          3
                          T1552.001

                          Discovery

                          Peripheral Device Discovery

                          2
                          T1120

                          Query Registry

                          5
                          T1012

                          System Information Discovery

                          5
                          T1082

                          Lateral Movement

                          Collection

                          Data from Local System

                          3
                          T1005

                          Command and Control

                          Web Service

                          1
                          T1102

                          Exfiltration

                          Impact

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                          • Size 1KB
                          • SHA256 75fd1a3412a91ff68ebb9d40936c1db5e6fa812e90e1ce89891ee9817e346126
                          • MD5 SHA1 SHA512
                          Submit Download

                          CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
                          • Size 724B
                          • SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
                          • MD5 SHA1 SHA512
                          Submit Download

                          24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                          • Size 410B
                          • SHA256 d6798e9c3a07b66340fe1190fc2afeb406c7d9113d45c4774261deedeb7d483c
                          • MD5 SHA1 SHA512
                          Submit Download

                          CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
                          • Size 392B
                          • SHA256 1ad4522f1c19d98b0171aa4071759ea82e1266e2578aea01351f3e3ac0bb3f42
                          • MD5 SHA1 SHA512
                          Submit Download

                          DiscoverCacheData.dat
                          • Path C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                          • Size 1022B
                          • SHA256 21210b42b1115cc408383434d5898d8f27aece11819e88b4d43ce232be3568fa
                          • MD5 SHA1 SHA512
                          Submit Download

                          1994.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\1994.exe
                          • Size 4.1MB
                          • SHA256 750d94a7cfe19ef443791b99f172a68c077f79f7c37c03e4a1ac3f0090ea901a
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          9078.bat
                          • Path C:\Users\Admin\AppData\Local\Temp\9078.bat
                          • Size 77B
                          • SHA256 d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a
                          • MD5 SHA1 SHA512
                          Submit Download

                          966.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\966.exe
                          • Size 30.6MB
                          • SHA256 2f625ea35f82332c639049c4a849f39cd2b74acb013880d156a2f647497c2512
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          9E44.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\9E44.exe
                          • Size 758KB
                          • SHA256 c7b11ca29d31194bcb76dfdce3e0a58bfa674285fe55e3ca1409bd191ad8af9d
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          A858.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\A858.exe
                          • Size 392KB
                          • SHA256 da1e155c46ca6b23409d059b6d85341c0b86c92d2c69dbda85eef3894313662d
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          D37F.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\D37F.exe
                          • Size 6.5MB
                          • SHA256 4a40f9d491f09521f4b0c6076a0eb488f6d8e1cf4b67aa6569c2ccce13556443
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          __PSScriptPolicyTest_a5cikfg3.orc.ps1
                          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a5cikfg3.orc.ps1
                          • Size 60B
                          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                          • MD5 SHA1 SHA512
                          Submit Download

                          injector.exe
                          • Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                          • Size 281KB
                          • SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          build2.exe
                          • Path C:\Users\Admin\AppData\Local\a08545bf-360f-478e-bd53-780b9dc16b19\build2.exe
                          • Size 277KB
                          • SHA256 afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          build3.exe
                          • Path C:\Users\Admin\AppData\Local\a08545bf-360f-478e-bd53-780b9dc16b19\build3.exe
                          • Size 299KB
                          • SHA256 fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          powershell.exe.log
                          • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                          • Size 2KB
                          • SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
                          • MD5 SHA1 SHA512
                          Submit Download

                          StartupProfileData-Interactive
                          • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                          • Size 19KB
                          • SHA256 e9fee81b3789f8bd3da90551f9e3e4ef31ca4ae9faa2e8ee613c53f3ca78fbaa
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          StartupProfileData-Interactive
                          • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                          • Size 19KB
                          • SHA256 03f979fa6148f22ac51bde4c062105c9871ec7dd907c4920ce28b70163fdb283
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          StartupProfileData-Interactive
                          • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                          • Size 19KB
                          • SHA256 e98935534e3fceb2d49758a4e52865ff105ef135898ee09e4b277dfd10b17e5d
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          StartupProfileData-Interactive
                          • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                          • Size 19KB
                          • SHA256 dd470d087bf38c4bdf05964d83d7242468f1b256fda910bd9b28675ed5c77816
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          StartupProfileData-Interactive
                          • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                          • Size 19KB
                          • SHA256 abe66a20e39c4abdf68299663761ab78d4c2c0b4527e83666739dedfdccb7c16
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          windefender.exe
                          • Path C:\Windows\windefender.exe
                          • Size 2.0MB
                          • SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
                          • MD5 SHA1 SHA512 SSDEEP
                          Submit Download

                          memory/748-73-0x0000000004D20000-0x0000000004D21000-memory.dmp
                          Download

                          memory/748-114-0x0000000073770000-0x0000000073F21000-memory.dmp
                          Download

                          memory/748-84-0x0000000002840000-0x0000000004840000-memory.dmp
                          Download

                          memory/748-70-0x0000000000300000-0x0000000000364000-memory.dmp
                          Download

                          memory/748-71-0x0000000073770000-0x0000000073F21000-memory.dmp
                          Download

                          memory/748-72-0x0000000004E50000-0x0000000004E60000-memory.dmp
                          Download

                          memory/976-140-0x0000000000400000-0x0000000000406000-memory.dmp
                          Download

                          memory/976-143-0x0000000000410000-0x0000000000413000-memory.dmp
                          Download

                          memory/976-142-0x0000000000400000-0x0000000000406000-memory.dmp
                          Download

                          memory/976-137-0x0000000000400000-0x0000000000406000-memory.dmp
                          Download

                          memory/1484-107-0x0000000000650000-0x0000000000750000-memory.dmp
                          Download

                          memory/1484-108-0x0000000002160000-0x0000000002191000-memory.dmp
                          Download

                          memory/1924-45-0x0000000000400000-0x0000000000537000-memory.dmp
                          Download

                          memory/1924-87-0x0000000000400000-0x0000000000537000-memory.dmp
                          Download

                          memory/1924-86-0x0000000000400000-0x0000000000537000-memory.dmp
                          Download

                          memory/1924-190-0x0000000000400000-0x0000000000537000-memory.dmp
                          Download

                          memory/1924-83-0x0000000000400000-0x0000000000537000-memory.dmp
                          Download

                          memory/1924-52-0x0000000000400000-0x0000000000537000-memory.dmp
                          Download

                          memory/1924-51-0x0000000000400000-0x0000000000537000-memory.dmp
                          Download

                          memory/1924-46-0x0000000000400000-0x0000000000537000-memory.dmp
                          Download

                          memory/1924-44-0x0000000000400000-0x0000000000537000-memory.dmp
                          Download

                          memory/1924-128-0x0000000000400000-0x0000000000537000-memory.dmp
                          Download

                          memory/2348-135-0x0000000000B00000-0x0000000000C00000-memory.dmp
                          Download

                          memory/2348-136-0x0000000000A60000-0x0000000000A64000-memory.dmp
                          Download

                          memory/2372-341-0x0000000000400000-0x0000000000ECD000-memory.dmp
                          Download

                          memory/2812-709-0x0000000000400000-0x0000000000ECD000-memory.dmp
                          Download

                          memory/2812-690-0x0000000000400000-0x0000000000ECD000-memory.dmp
                          Download

                          memory/2816-450-0x00007FF669A80000-0x00007FF66B9CC000-memory.dmp
                          Download

                          memory/2816-344-0x00007FF669A80000-0x00007FF66B9CC000-memory.dmp
                          Download

                          memory/3188-24-0x0000000000400000-0x0000000000537000-memory.dmp
                          Download

                          memory/3188-22-0x0000000000400000-0x0000000000537000-memory.dmp
                          Download

                          memory/3188-38-0x0000000000400000-0x0000000000537000-memory.dmp
                          Download

                          memory/3188-26-0x0000000000400000-0x0000000000537000-memory.dmp
                          Download

                          memory/3188-25-0x0000000000400000-0x0000000000537000-memory.dmp
                          Download

                          memory/3196-4-0x0000000002D70000-0x0000000002D86000-memory.dmp
                          Download

                          memory/3196-295-0x0000000002DA0000-0x0000000002DA1000-memory.dmp
                          Download

                          memory/3204-5-0x0000000000400000-0x0000000000AEA000-memory.dmp
                          Download

                          memory/3204-3-0x0000000000400000-0x0000000000AEA000-memory.dmp
                          Download

                          memory/3204-2-0x0000000000E90000-0x0000000000E9B000-memory.dmp
                          Download

                          memory/3204-1-0x0000000000EA0000-0x0000000000FA0000-memory.dmp
                          Download

                          memory/3352-146-0x0000000006950000-0x00000000069A0000-memory.dmp
                          Download

                          memory/3352-98-0x0000000005FA0000-0x00000000065B8000-memory.dmp
                          Download

                          memory/3352-196-0x0000000007900000-0x0000000007AC2000-memory.dmp
                          Download

                          memory/3352-198-0x0000000008000000-0x000000000852C000-memory.dmp
                          Download

                          memory/3352-105-0x0000000005320000-0x000000000536C000-memory.dmp
                          Download

                          memory/3352-104-0x00000000051A0000-0x00000000051DC000-memory.dmp
                          Download

                          memory/3352-76-0x0000000000400000-0x0000000000450000-memory.dmp
                          Download

                          memory/3352-78-0x00000000053D0000-0x0000000005976000-memory.dmp
                          Download

                          memory/3352-79-0x0000000004F00000-0x0000000004F92000-memory.dmp
                          Download

                          memory/3352-89-0x00000000050B0000-0x00000000050C0000-memory.dmp
                          Download

                          memory/3352-169-0x00000000050B0000-0x00000000050C0000-memory.dmp
                          Download

                          memory/3352-88-0x0000000004ED0000-0x0000000004EDA000-memory.dmp
                          Download

                          memory/3352-93-0x0000000073770000-0x0000000073F21000-memory.dmp
                          Download

                          memory/3352-145-0x0000000005A50000-0x0000000005AB6000-memory.dmp
                          Download

                          memory/3352-102-0x0000000005210000-0x000000000531A000-memory.dmp
                          Download

                          memory/3352-174-0x0000000073770000-0x0000000073F21000-memory.dmp
                          Download

                          memory/3352-103-0x0000000005140000-0x0000000005152000-memory.dmp
                          Download

                          memory/3708-41-0x0000000002760000-0x00000000027FF000-memory.dmp
                          Download

                          memory/3956-21-0x0000000002940000-0x0000000002A5B000-memory.dmp
                          Download

                          memory/3956-20-0x0000000002730000-0x00000000027CB000-memory.dmp
                          Download

                          memory/4372-714-0x0000000000400000-0x00000000008DF000-memory.dmp
                          Download

                          memory/4544-109-0x0000000000400000-0x0000000000644000-memory.dmp
                          Download

                          memory/4544-112-0x0000000000400000-0x0000000000644000-memory.dmp
                          Download

                          memory/4544-113-0x0000000000400000-0x0000000000644000-memory.dmp
                          Download

                          memory/4544-132-0x0000000000400000-0x0000000000644000-memory.dmp
                          Download

                          memory/4604-177-0x0000000003F10000-0x0000000004010000-memory.dmp
                          Download

                          memory/4604-178-0x0000000003F10000-0x0000000004010000-memory.dmp
                          Download

                          memory/4604-185-0x0000000003F10000-0x0000000004010000-memory.dmp
                          Download

                          memory/4604-188-0x0000000003F10000-0x0000000004010000-memory.dmp
                          Download

                          memory/4604-187-0x0000000003F10000-0x0000000004010000-memory.dmp
                          Download

                          memory/4604-184-0x0000000003F10000-0x0000000004010000-memory.dmp
                          Download

                          memory/4604-191-0x0000000003F10000-0x0000000004010000-memory.dmp
                          Download

                          memory/4604-189-0x0000000003F10000-0x0000000004010000-memory.dmp
                          Download

                          memory/4604-194-0x0000000003F10000-0x0000000004010000-memory.dmp
                          Download

                          memory/4604-192-0x0000000003F10000-0x0000000004010000-memory.dmp
                          Download

                          memory/4604-193-0x0000000003F10000-0x0000000004010000-memory.dmp
                          Download

                          memory/4604-195-0x0000000003F10000-0x0000000004010000-memory.dmp
                          Download

                          memory/4604-197-0x0000000003F10000-0x0000000004010000-memory.dmp
                          Download

                          memory/4604-183-0x0000000003F10000-0x0000000004010000-memory.dmp
                          Download

                          memory/4604-182-0x0000000003F10000-0x0000000004010000-memory.dmp
                          Download

                          memory/4604-199-0x0000000003F10000-0x0000000004010000-memory.dmp
                          Download

                          memory/4604-200-0x0000000003F10000-0x0000000004010000-memory.dmp
                          Download

                          memory/4604-181-0x0000000003F10000-0x0000000004010000-memory.dmp
                          Download

                          memory/4604-180-0x0000000003F10000-0x0000000004010000-memory.dmp
                          Download

                          memory/4604-186-0x0000000003F10000-0x0000000004010000-memory.dmp
                          Download

                          memory/4604-179-0x0000000003F10000-0x0000000004010000-memory.dmp
                          Download

                          memory/4604-175-0x0000000003F10000-0x0000000004010000-memory.dmp
                          Download

                          memory/4604-176-0x0000000003F10000-0x0000000004010000-memory.dmp
                          Download

                          memory/4604-156-0x0000000000E00000-0x0000000001AE5000-memory.dmp
                          Download

                          memory/4604-173-0x00000000032B0000-0x00000000032F0000-memory.dmp
                          Download

                          memory/4604-172-0x00000000032B0000-0x00000000032F0000-memory.dmp
                          Download

                          memory/4604-171-0x00000000032B0000-0x00000000032F0000-memory.dmp
                          Download

                          memory/4604-161-0x0000000000C90000-0x0000000000C91000-memory.dmp
                          Download

                          memory/4604-162-0x0000000000CA0000-0x0000000000CA1000-memory.dmp
                          Download

                          memory/4604-170-0x00000000032B0000-0x00000000032F0000-memory.dmp
                          Download

                          memory/4604-165-0x0000000000CE0000-0x0000000000CE1000-memory.dmp
                          Download

                          memory/4604-168-0x0000000000E00000-0x0000000001AE5000-memory.dmp
                          Download

                          memory/4604-167-0x00000000032A0000-0x00000000032A1000-memory.dmp
                          Download

                          memory/4604-166-0x0000000003290000-0x0000000003291000-memory.dmp
                          Download

                          memory/4604-164-0x0000000000E00000-0x0000000001AE5000-memory.dmp
                          Download

                          memory/4604-163-0x0000000000CD0000-0x0000000000CD1000-memory.dmp
                          Download

                          memory/4772-506-0x0000000000400000-0x0000000000ECD000-memory.dmp
                          Download

                          memory/4904-451-0x0000000001210000-0x000000000125B000-memory.dmp
                          Download

                          memory/4904-448-0x0000000001210000-0x000000000125B000-memory.dmp
                          Download