dcrat | 13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc

General

Target

13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe
Size

1.6MB
MD5

a0fc62e3b7ee3716781698677ef0a315
SHA1

679ee9e6c503af58943768fac7801a0c85149728
SHA256

13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc
SHA512

6d5f5cde273aebea5e97561c94e3a068e3b966dc0d8455d90f0bedcefbe2cd888457c60f639e77cdd3e6bd2b79b45fe1467f6eded81ddaf92ff6fde1bd2ba30b
SSDEEP

49152:BI3GKRB71HIfHaM+j4av2JIZF9YvOaXdFi:qPRB5HISGauJIn95eo

Score

10^/10

dcrat evasion infostealer rat spyware stealer trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1300	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	804	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1568	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1008	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	328	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2404	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	836	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2868	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	320	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	776	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1260	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	588	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1796	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1896	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2456	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1136	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	316	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1376	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	976	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	108	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	608	2940	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	704	2940	schtasks.exe

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

ComContainer.exeComContainer.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ComContainer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ComContainer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ComContainer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ComContainer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ComContainer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ComContainer.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe	dcrat
\Users\Admin\AppData\Local\Temp\bridgehyperblockreviewdhcp\ComContainer.exe	dcrat
behavioral1/memory/2756-23-0x0000000001100000-0x00000000012CE000-memory.dmp	dcrat
behavioral1/memory/2072-73-0x0000000000EE0000-0x00000000010AE000-memory.dmp	dcrat

Detects executables packed with SmartAssembly 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2756-28-0x0000000000B40000-0x0000000000B4A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/2756-33-0x0000000000E30000-0x0000000000E3C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral1/memory/2756-36-0x0000000000E60000-0x0000000000E6A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Executes dropped EXE 3 IoCs

Processes:

DCRatBuild.exeComContainer.exeComContainer.exe

pid process

1788 DCRatBuild.exe
2756 ComContainer.exe
2072 ComContainer.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

2764 cmd.exe
2764 cmd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
1788	DCRatBuild.exe
2756	ComContainer.exe
2072	ComContainer.exe

pid	process
2764	cmd.exe
2764	cmd.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

ComContainer.exeComContainer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ComContainer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ComContainer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ComContainer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ComContainer.exe

Drops file in Program Files directory 6 IoCs

Processes:

ComContainer.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\088424020bedd6	ComContainer.exe
File created	C:\Program Files\Windows Media Player\ja-JP\services.exe	ComContainer.exe
File created	C:\Program Files\Windows Media Player\ja-JP\c5b4cb5e9653cc	ComContainer.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\sppsvc.exe	ComContainer.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\0a1fd5f707cd16	ComContainer.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\conhost.exe	ComContainer.exe

Drops file in Windows directory 2 IoCs

Processes:

ComContainer.exe

description	ioc	process
File created	C:\Windows\BitLockerDiscoveryVolumeContents\explorer.exe	ComContainer.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\7a0fd90576e088	ComContainer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1260	schtasks.exe
976	schtasks.exe
760	schtasks.exe
2172	schtasks.exe
2056	schtasks.exe
2868	schtasks.exe
316	schtasks.exe
1376	schtasks.exe
1632	schtasks.exe
2404	schtasks.exe
3032	schtasks.exe
2904	schtasks.exe
776	schtasks.exe
3020	schtasks.exe
2784	schtasks.exe
804	schtasks.exe
328	schtasks.exe
1924	schtasks.exe
608	schtasks.exe
704	schtasks.exe
108	schtasks.exe
1644	schtasks.exe
836	schtasks.exe
2332	schtasks.exe
588	schtasks.exe
1796	schtasks.exe
1896	schtasks.exe
1136	schtasks.exe
1776	schtasks.exe
1300	schtasks.exe
1568	schtasks.exe
2428	schtasks.exe
2036	schtasks.exe
1312	schtasks.exe
2456	schtasks.exe
2372	schtasks.exe
1008	schtasks.exe
2480	schtasks.exe
320	schtasks.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

ComContainer.exeComContainer.exe

pid	process
2756	ComContainer.exe
2756	ComContainer.exe
2756	ComContainer.exe
2756	ComContainer.exe
2756	ComContainer.exe
2756	ComContainer.exe
2756	ComContainer.exe
2072	ComContainer.exe
2072	ComContainer.exe
2072	ComContainer.exe
2072	ComContainer.exe
2072	ComContainer.exe
2072	ComContainer.exe
2072	ComContainer.exe
2072	ComContainer.exe
2072	ComContainer.exe
2072	ComContainer.exe
2072	ComContainer.exe
2072	ComContainer.exe
2072	ComContainer.exe
2072	ComContainer.exe
2072	ComContainer.exe
2072	ComContainer.exe
2072	ComContainer.exe
2072	ComContainer.exe
2072	ComContainer.exe
2072	ComContainer.exe
2072	ComContainer.exe
2072	ComContainer.exe
2072	ComContainer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

ComContainer.exe

pid process

2072 ComContainer.exe

pid	process
2072	ComContainer.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

ComContainer.exeComContainer.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	2756	ComContainer.exe
Token: SeDebugPrivilege	2072	ComContainer.exe
Token: SeBackupPrivilege	2660	vssvc.exe
Token: SeRestorePrivilege	2660	vssvc.exe
Token: SeAuditPrivilege	2660	vssvc.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exeDCRatBuild.exeWScript.execmd.exeComContainer.exeComContainer.exe

description	pid	process	target process
PID 2236 wrote to memory of 1788	2236	13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe	DCRatBuild.exe
PID 2236 wrote to memory of 1788	2236	13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe	DCRatBuild.exe
PID 2236 wrote to memory of 1788	2236	13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe	DCRatBuild.exe
PID 2236 wrote to memory of 1788	2236	13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe	DCRatBuild.exe
PID 1788 wrote to memory of 2648	1788	DCRatBuild.exe	WScript.exe
PID 1788 wrote to memory of 2648	1788	DCRatBuild.exe	WScript.exe
PID 1788 wrote to memory of 2648	1788	DCRatBuild.exe	WScript.exe
PID 1788 wrote to memory of 2648	1788	DCRatBuild.exe	WScript.exe
PID 2648 wrote to memory of 2764	2648	WScript.exe	cmd.exe
PID 2648 wrote to memory of 2764	2648	WScript.exe	cmd.exe
PID 2648 wrote to memory of 2764	2648	WScript.exe	cmd.exe
PID 2648 wrote to memory of 2764	2648	WScript.exe	cmd.exe
PID 2764 wrote to memory of 2756	2764	cmd.exe	ComContainer.exe
PID 2764 wrote to memory of 2756	2764	cmd.exe	ComContainer.exe
PID 2764 wrote to memory of 2756	2764	cmd.exe	ComContainer.exe
PID 2764 wrote to memory of 2756	2764	cmd.exe	ComContainer.exe
PID 2756 wrote to memory of 2072	2756	ComContainer.exe	ComContainer.exe
PID 2756 wrote to memory of 2072	2756	ComContainer.exe	ComContainer.exe
PID 2756 wrote to memory of 2072	2756	ComContainer.exe	ComContainer.exe
PID 2072 wrote to memory of 2092	2072	ComContainer.exe	WScript.exe
PID 2072 wrote to memory of 2092	2072	ComContainer.exe	WScript.exe
PID 2072 wrote to memory of 2092	2072	ComContainer.exe	WScript.exe
PID 2072 wrote to memory of 1188	2072	ComContainer.exe	WScript.exe
PID 2072 wrote to memory of 1188	2072	ComContainer.exe	WScript.exe
PID 2072 wrote to memory of 1188	2072	ComContainer.exe	WScript.exe

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

Processes:

ComContainer.exeComContainer.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ComContainer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ComContainer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ComContainer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ComContainer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ComContainer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ComContainer.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe
"C:\Users\Admin\AppData\Local\Temp\13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2236

C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
"C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bridgehyperblockreviewdhcp\JFcWz5uGBCcQNylIeBn.vbe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2648

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\bridgehyperblockreviewdhcp\FCDPQha3l1059hFdl7xiPA.bat" "
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764

C:\Users\Admin\AppData\Local\Temp\bridgehyperblockreviewdhcp\ComContainer.exe
"C:\Users\Admin\AppData\Local\Temp\bridgehyperblockreviewdhcp\ComContainer.exe"
5⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2756

C:\MSOCache\All Users\ComContainer.exe
"C:\MSOCache\All Users\ComContainer.exe"
6⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2072

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\07085f87-a864-4eda-baf9-96ef83e90f37.vbs"
7⤵
PID:2092

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\94c71a51-516e-4497-b394-68692f2d15d9.vbs"
7⤵
PID:1188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ComContainerC" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ComContainer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ComContainer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ComContainer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ComContainerC" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ComContainer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Documents\My Music\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default\Documents\My Music\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Documents\My Music\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\ja-JP\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\ja-JP\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Media Player\ja-JP\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ComContainerC" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\ComContainer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ComContainer" /sc ONLOGON /tr "'C:\MSOCache\All Users\ComContainer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ComContainerC" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\ComContainer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:704

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2660

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1672

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

2

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\07085f87-a864-4eda-baf9-96ef83e90f37.vbs
Filesize
714B

MD5
20916b8531cfc8e7ee4b05a83503cd28

SHA1
916b49c4024443f6bbe2695c0b56bebf3944a108

SHA256
823da829c8409896596a129361ab012651ccf8f15d471eae8a1cd506385f125e

SHA512
3d2ad76e218bdf18250c145b0b96a4e918f29fa7a3ab7c17ea9a913525ed18d234947dfec865b8e07cd7d4f9f9baaad35c16490ee5b2891676032856e46aa4e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\94c71a51-516e-4497-b394-68692f2d15d9.vbs
Filesize
490B

MD5
eb6efd5b22857df0e548b94a109bfa81

SHA1
3273203e0475259819d4d456ea628acaf77387ba

SHA256
63452b2e563758abeaf6ebffe818af242cb955919157625f8a7b5fae76d3419c

SHA512
a6dba916abda712518e447a2767abe74d87fba1472384b0eceb480bea40331dc180949b0db43a9518db1432b9b5b2dc0b7af6e79939199f3a6c87af8ffef97d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
Filesize
2.1MB

MD5
84c02f6e1108d21bc6d871d4f0e67dd1

SHA1
fc46781b941cb8b9493d1f89a835e60eebad1fe1

SHA256
0b3af1714c58b112a179b1efe5d9b381cba0c06450860ae8134b386fe2fe5e8f

SHA512
c4ca21b5b571eaaa58f63134337b2d01f9aba2dd1684a5ca2e57c8df34cf266b846fddc21f2b567cec3c714d08d47103059cb848a1a5e9efcaf6b3efde069510

Download Submit
C:\Users\Admin\AppData\Local\Temp\bridgehyperblockreviewdhcp\FCDPQha3l1059hFdl7xiPA.bat
Filesize
52B

MD5
b56593dfa47cd5d585cf8f8d88c11b05

SHA1
c70b8eec01fe9102c2e7cd3605dab47756f9643e

SHA256
bae7494aa08a5d634830c205febb819b546b1633d2d2c74be6b78eee19c5514c

SHA512
402da79f69e08391217210a273eb735036760ebfd5115537c8965128e11640071ba76438d7d236b6c93db697e90f9a994a2fcc29fed02edcb7ef6195a703c7b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\bridgehyperblockreviewdhcp\JFcWz5uGBCcQNylIeBn.vbe
Filesize
229B

MD5
8f6a53617f67becfab8753b32ce07e70

SHA1
111bfba12a529a29baf5c80300dd5f4432be5c20

SHA256
146e2cc8c7a342377dde4a2d323fba53afa9833e66539de23d120f414c4ffd4e

SHA512
e40ee02738f686db97275ab9c87c2b96081d7395c3fe6365ee19c3348dd3f09ee3d423ad686af4e2f9214a0e1e3078bd4e7e4c2030ea87545b2b57cc60f531dc

Download Submit
\Users\Admin\AppData\Local\Temp\bridgehyperblockreviewdhcp\ComContainer.exe
Filesize
1.8MB

MD5
d4d11ed815db57efe9580e29900df34e

SHA1
14b275d8df38bad245b92c1980a1e0eb6491dbce

SHA256
fb41a0fd339ab301f2f33eb97a562af1876e394493fe9f114fa6ff5f9f7d82b8

SHA512
375d489af26b7c48e8d73f31e2105bab5f84e80e7f8c32813a6ca574583c3ace0dfc23720964fc10000b3eeda70ab34ca692b22c9c696fc046c6509f38f8263b

Download Submit
memory/2072-73-0x0000000000EE0000-0x00000000010AE000-memory.dmp

Filesize
1.8MB

Download
memory/2236-0-0x000007FEF5483000-0x000007FEF5484000-memory.dmp

Filesize
4KB

Download
memory/2236-1-0x0000000000090000-0x0000000000226000-memory.dmp

Filesize
1.6MB

Download
memory/2236-3-0x000007FEF5480000-0x000007FEF5E6C000-memory.dmp

Filesize
9.9MB

Download
memory/2236-8-0x000007FEF5480000-0x000007FEF5E6C000-memory.dmp

Filesize
9.9MB

Download
memory/2756-29-0x0000000000B50000-0x0000000000B5C000-memory.dmp

Filesize
48KB

Download
memory/2756-35-0x0000000000E50000-0x0000000000E5C000-memory.dmp

Filesize
48KB

Download
memory/2756-28-0x0000000000B40000-0x0000000000B4A000-memory.dmp

Filesize
40KB

Download
memory/2756-26-0x0000000000B20000-0x0000000000B36000-memory.dmp

Filesize
88KB

Download
memory/2756-30-0x0000000000B60000-0x0000000000B68000-memory.dmp

Filesize
32KB

Download
memory/2756-31-0x0000000000D70000-0x0000000000D7C000-memory.dmp

Filesize
48KB

Download
memory/2756-32-0x0000000000E00000-0x0000000000E12000-memory.dmp

Filesize
72KB

Download
memory/2756-33-0x0000000000E30000-0x0000000000E3C000-memory.dmp

Filesize
48KB

Download
memory/2756-34-0x0000000000E40000-0x0000000000E48000-memory.dmp

Filesize
32KB

Download
memory/2756-27-0x0000000000A10000-0x0000000000A20000-memory.dmp

Filesize
64KB

Download
memory/2756-36-0x0000000000E60000-0x0000000000E6A000-memory.dmp

Filesize
40KB

Download
memory/2756-37-0x0000000000EF0000-0x0000000000EFE000-memory.dmp

Filesize
56KB

Download
memory/2756-38-0x0000000000F00000-0x0000000000F08000-memory.dmp

Filesize
32KB

Download
memory/2756-39-0x0000000000F10000-0x0000000000F1E000-memory.dmp

Filesize
56KB

Download
memory/2756-25-0x00000000009D0000-0x00000000009EC000-memory.dmp

Filesize
112KB

Download
memory/2756-24-0x00000000009C0000-0x00000000009CE000-memory.dmp

Filesize
56KB

Download
memory/2756-23-0x0000000001100000-0x00000000012CE000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads