dcrat | 09d240d54a5458bcc9362ea0f06e23a345b69e196e127462d5f33e8a475ccd57

Analysis

max time kernel
127s
max time network
148s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 17:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

LastActivityView.exe
Size

1.8MB
MD5

45008c4cc3fc25a5d5184742ae2fe72b
SHA1

f5e7b3110df6917df0e07a822c313c52eec335fd
SHA256

09d240d54a5458bcc9362ea0f06e23a345b69e196e127462d5f33e8a475ccd57
SHA512

3059e4e59cb103f08fd13f776bf65d41b4cfec7a7f6610a2c945e134d4b913185f64bdf357bbc3c52e26da77f9e04a19c121611ad11fb40bf486aade1751e335
SSDEEP

24576:J2G/nvxW3WtklQ1yLJg2WGBITqb6YtZuhH6bxzDtR8P56fpjPFWmU:JbA37lQ1FdrqeoAR4NfjSf

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat 42 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		2816	schtasks.exe
		2800	schtasks.exe
		2684	schtasks.exe
		748	schtasks.exe
		2144	schtasks.exe
		1884	schtasks.exe
		2932	schtasks.exe
		2812	schtasks.exe
		2320	schtasks.exe
		576	schtasks.exe
		1840	schtasks.exe
		3024	schtasks.exe
		900	schtasks.exe
		612	schtasks.exe
		2524	schtasks.exe
		1272	schtasks.exe
		2952	schtasks.exe
		1904	schtasks.exe
		2584	schtasks.exe
		1792	schtasks.exe
		1932	schtasks.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\it-IT\42af1c969fbb7b		savesref.exe
		572	schtasks.exe
		1764	schtasks.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\0a1fd5f707cd16		savesref.exe
		2092	schtasks.exe
		1916	schtasks.exe
		1380	schtasks.exe
		672	schtasks.exe
		1060	schtasks.exe
		1824	schtasks.exe
		2936	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		savesref.exe
		2060	schtasks.exe
		2496	schtasks.exe
		2084	schtasks.exe
		2380	schtasks.exe
		1028	schtasks.exe
		896	schtasks.exe
		2324	schtasks.exe
		1984	schtasks.exe
		1520	schtasks.exe

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	896	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	672	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	576	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1824	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	748	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1272	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1380	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	612	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1028	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	572	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	2220	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	2220	schtasks.exe	32

UAC bypass 3 TTPs 9 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	savesref.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	savesref.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	savesref.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	savesref.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	savesref.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	savesref.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000014b9e-10.dat	dcrat
behavioral1/memory/2656-13-0x0000000000090000-0x000000000021C000-memory.dmp	dcrat
behavioral1/files/0x000900000001615c-57.dat	dcrat
behavioral1/memory/1036-120-0x0000000000D60000-0x0000000000EEC000-memory.dmp	dcrat

Executes dropped EXE 3 IoCs

pid	Process
2656	savesref.exe
1328	savesref.exe
1036	taskhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2336	cmd.exe
2336	cmd.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	savesref.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	savesref.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	savesref.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	savesref.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe

Drops file in Program Files directory 28 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\0a1fd5f707cd16	savesref.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\it-IT\audiodg.exe	savesref.exe
File created	C:\Program Files\Windows Defender\es-ES\f3b6ecef712a24	savesref.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\lsm.exe	savesref.exe
File created	C:\Program Files (x86)\Microsoft.NET\lsm.exe	savesref.exe
File created	C:\Program Files (x86)\Microsoft.NET\101b941d020240	savesref.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\taskhost.exe	savesref.exe
File created	C:\Program Files\Windows Defender\6203df4a6bafc7	savesref.exe
File created	C:\Program Files\Windows Defender\es-ES\spoolsv.exe	savesref.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\it-IT\audiodg.exe	savesref.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\it-IT\RCX3EDA.tmp	savesref.exe
File opened for modification	C:\Program Files\Windows Defender\lsass.exe	savesref.exe
File opened for modification	C:\Program Files\Common Files\System\audiodg.exe	savesref.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\Idle.exe	savesref.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCX3CC6.tmp	savesref.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCX3CC7.tmp	savesref.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\sppsvc.exe	savesref.exe
File created	C:\Program Files\Windows Defender\lsass.exe	savesref.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\taskhost.exe	savesref.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\6ccacd8608530f	savesref.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\spoolsv.exe	savesref.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\sppsvc.exe	savesref.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\it-IT\42af1c969fbb7b	savesref.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\it-IT\RCX3F49.tmp	savesref.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\b75386f1303e64	savesref.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\Idle.exe	savesref.exe
File created	C:\Program Files\Common Files\System\audiodg.exe	savesref.exe
File created	C:\Program Files\Common Files\System\42af1c969fbb7b	savesref.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Web\Wallpaper\Windows\wininit.exe	savesref.exe
File opened for modification	C:\Windows\Web\Wallpaper\Windows\wininit.exe	savesref.exe
File created	C:\Windows\Web\Wallpaper\Windows\56085415360792	savesref.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2496	schtasks.exe
576	schtasks.exe
2952	schtasks.exe
2684	schtasks.exe
2812	schtasks.exe
2060	schtasks.exe
900	schtasks.exe
1272	schtasks.exe
2932	schtasks.exe
2380	schtasks.exe
1984	schtasks.exe
1060	schtasks.exe
1840	schtasks.exe
2144	schtasks.exe
3024	schtasks.exe
2324	schtasks.exe
2092	schtasks.exe
748	schtasks.exe
1520	schtasks.exe
612	schtasks.exe
1028	schtasks.exe
1932	schtasks.exe
2816	schtasks.exe
2320	schtasks.exe
672	schtasks.exe
1916	schtasks.exe
2936	schtasks.exe
2584	schtasks.exe
1824	schtasks.exe
1884	schtasks.exe
1792	schtasks.exe
2800	schtasks.exe
896	schtasks.exe
2084	schtasks.exe
1380	schtasks.exe
1904	schtasks.exe
1764	schtasks.exe
2524	schtasks.exe
572	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2656	savesref.exe
1328	savesref.exe
1036	taskhost.exe
1036	taskhost.exe
1036	taskhost.exe
1036	taskhost.exe
1036	taskhost.exe
1036	taskhost.exe
1036	taskhost.exe
1036	taskhost.exe
1036	taskhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1036	taskhost.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2656	savesref.exe
Token: SeDebugPrivilege	1328	savesref.exe
Token: SeDebugPrivilege	1036	taskhost.exe
Token: SeBackupPrivilege	2800	vssvc.exe
Token: SeRestorePrivilege	2800	vssvc.exe
Token: SeAuditPrivilege	2800	vssvc.exe
Token: SeRestorePrivilege	2392	7zFM.exe
Token: 35	2392	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2392	7zFM.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 2372	836	LastActivityView.exe	28
PID 836 wrote to memory of 2372	836	LastActivityView.exe	28
PID 836 wrote to memory of 2372	836	LastActivityView.exe	28
PID 836 wrote to memory of 2372	836	LastActivityView.exe	28
PID 2372 wrote to memory of 2336	2372	WScript.exe	29
PID 2372 wrote to memory of 2336	2372	WScript.exe	29
PID 2372 wrote to memory of 2336	2372	WScript.exe	29
PID 2372 wrote to memory of 2336	2372	WScript.exe	29
PID 2336 wrote to memory of 2656	2336	cmd.exe	31
PID 2336 wrote to memory of 2656	2336	cmd.exe	31
PID 2336 wrote to memory of 2656	2336	cmd.exe	31
PID 2336 wrote to memory of 2656	2336	cmd.exe	31
PID 2656 wrote to memory of 1328	2656	savesref.exe	42
PID 2656 wrote to memory of 1328	2656	savesref.exe	42
PID 2656 wrote to memory of 1328	2656	savesref.exe	42
PID 1328 wrote to memory of 2752	1328	savesref.exe	74
PID 1328 wrote to memory of 2752	1328	savesref.exe	74
PID 1328 wrote to memory of 2752	1328	savesref.exe	74
PID 2752 wrote to memory of 1636	2752	cmd.exe	76
PID 2752 wrote to memory of 1636	2752	cmd.exe	76
PID 2752 wrote to memory of 1636	2752	cmd.exe	76
PID 2752 wrote to memory of 1036	2752	cmd.exe	77
PID 2752 wrote to memory of 1036	2752	cmd.exe	77
PID 2752 wrote to memory of 1036	2752	cmd.exe	77

System policy modification 1 TTPs 9 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	savesref.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	savesref.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	savesref.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	savesref.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	savesref.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	savesref.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\LastActivityView.exe
"C:\Users\Admin\AppData\Local\Temp\LastActivityView.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\discord\KVGHJrchTtXZ1.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Roaming\discord\91XI5GEPShJXCgG0eVHRJ.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2336
  - - C:\Users\Admin\AppData\Roaming\discord\savesref.exe
      "C:\Users\Admin\AppData\Roaming\discord\savesref.exe"
      4⤵
      DcRat
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2656
    - - C:\Users\Admin\AppData\Roaming\discord\savesref.exe
        
        "C:\Users\Admin\AppData\Roaming\discord\savesref.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1328
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jNu1VgdjQO.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2752
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1636
        
        C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\taskhost.exe
        
        "C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\taskhost.exe"
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Recovery\8f60a382-0d98-11ef-817d-5aba25856535\lsm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\8f60a382-0d98-11ef-817d-5aba25856535\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Recovery\8f60a382-0d98-11ef-817d-5aba25856535\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\audiodg.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Windows\Web\Wallpaper\Windows\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Web\Wallpaper\Windows\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Windows\Web\Wallpaper\Windows\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Defender\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Program Files\Common Files\System\audiodg.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\Common Files\System\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Program Files\Common Files\System\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Desktop\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Public\Desktop\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Desktop\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Recovery\8f60a382-0d98-11ef-817d-5aba25856535\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\8f60a382-0d98-11ef-817d-5aba25856535\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Recovery\8f60a382-0d98-11ef-817d-5aba25856535\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\taskhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\es-ES\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\es-ES\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\es-ES\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Pictures\Sample Pictures\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Public\Pictures\Sample Pictures\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Pictures\Sample Pictures\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft.NET\lsm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft.NET\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1764

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2800

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Public\Desktop\56085415360792
1⤵
- Modifies registry class
PID:1808

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Public\Desktop\56085415360792"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCX3CC7.tmp

Filesize
1.5MB

MD5
bf164fec3cd078761a70462be31050fb

SHA1
48ebbb45426cbe2056e5f0bca1bd03e06ddfa5a2

SHA256
1d547dd97ae48345cae40c0a76258b3efa12dd8e9ea689f3d022e482584aa173

SHA512
fc4dbc0aa8d172b2b6c706e778acf5e49a5fc4c1c1fa763bd01a6d4332f1731ae5a87bfb500027067c3bb1b7508326c81b0462c08667b2b7a68bdc1ec38e748b

Download Submit
C:\Users\Admin\AppData\Local\Temp\jNu1VgdjQO.bat

Filesize
237B

MD5
67e720c2a02af6e1629a1e7b0aa89ae9

SHA1
187e072e6c223e54b835abe39fb0cde8680394a7

SHA256
80fbe4195c4c903d8011ca92e12ca51209fd78ed5fe4f13b6b4db31d879ae5a0

SHA512
a355f85d0c9fa01fb7d97bcf705a322213ec0e8d2df6c1d70b6c75ec838fd42371c5919c1a671c8b28e1da2d896224a8b5464c0da3f6c839708d6acbb128b51b

Download Submit
C:\Users\Admin\AppData\Roaming\discord\91XI5GEPShJXCgG0eVHRJ.bat

Filesize
32B

MD5
84814a18997996f8a95ba8e868396e90

SHA1
30b79b2158d922433ba25117fb79f8720470fb44

SHA256
92c8ccb6b3a9abc0798ad760255c47356c3750a74b11e38590876c68927f3797

SHA512
b1b820e12c49fe4993229222a218a769e5d6913f303d382baaff735f3b24a5b068adcfb344397004dd9d7aa637c4e9baedf2e3ca3dfb3f56e86c8c8f8cf9cf7e

Download Submit
C:\Users\Admin\AppData\Roaming\discord\KVGHJrchTtXZ1.vbe

Filesize
212B

MD5
cdb5dc99d1017d58fdbfce66f048da76

SHA1
e1903f365d81996da9810b9f0dc40bc65b3324c7

SHA256
bd9e0e5f3e6379d03907896d71843cc2dbfef7e209cc0896b4755fa0422a3b43

SHA512
72e3e2f3b5f385c402faf7ac89690a99806f648f90e85f46b01db66284f247c10dbe03e612e41c46775cd29fecaeede2fd26bc8dc2e22e252f9f1ce9b801f88d

Download Submit
C:\Users\Admin\AppData\Roaming\discord\savesref.exe

Filesize
1.5MB

MD5
0a32536cc1d5e2a35d7d289b4ff0e76b

SHA1
98736b0b5a6f3709f81365c9e6477819074c3170

SHA256
8d31ae46e123de0d23937d664298428e37b45a7a135a95d73f5887779ee48710

SHA512
b2d5d91eb7ecfc6eb295c63ecba5c3ceb4b4a865fc9a9f90bd1e82bff4bc39905baf9ab2962580ee708761632e5499694f3f823aa2f139bce809398262eb3b73

Download Submit
C:\Users\Public\Desktop\56085415360792

Filesize
702B

MD5
862746af12afed661d5ba831615f4194

SHA1
417fb175d2b1f44322338570a4143afd1bf02a64

SHA256
a9282078a6f5ec51869b92081d641a273f2ed147f2c6a21acf481bdc3d198a36

SHA512
19c01958e625fd897accb81d59134966c0f023185a89b9bfcff55c30ff2df1d03f0af0a91e16d4513aa7d3e59057c4956db39e0330091aa5a87a8f9cc54ab4da

Download Submit
memory/1036-120-0x0000000000D60000-0x0000000000EEC000-memory.dmp

Filesize
1.5MB

Download
memory/2656-20-0x0000000000650000-0x000000000065C000-memory.dmp

Filesize
48KB

Download
memory/2656-18-0x00000000005B0000-0x00000000005BA000-memory.dmp

Filesize
40KB

Download
memory/2656-19-0x00000000005C0000-0x00000000005C8000-memory.dmp

Filesize
32KB

Download
memory/2656-17-0x0000000000590000-0x00000000005A0000-memory.dmp

Filesize
64KB

Download
memory/2656-21-0x0000000000660000-0x0000000000668000-memory.dmp

Filesize
32KB

Download
memory/2656-22-0x0000000000670000-0x0000000000678000-memory.dmp

Filesize
32KB

Download
memory/2656-23-0x0000000000680000-0x000000000068C000-memory.dmp

Filesize
48KB

Download
memory/2656-24-0x0000000000690000-0x000000000069A000-memory.dmp

Filesize
40KB

Download
memory/2656-25-0x00000000006A0000-0x00000000006AC000-memory.dmp

Filesize
48KB

Download
memory/2656-16-0x0000000000570000-0x0000000000586000-memory.dmp

Filesize
88KB

Download
memory/2656-15-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2656-14-0x00000000002D0000-0x00000000002EC000-memory.dmp

Filesize
112KB

Download
memory/2656-13-0x0000000000090000-0x000000000021C000-memory.dmp

Filesize
1.5MB

Download