dcrat | e717a0bd95ad8f0798d01d6cf0f10dcd18b162554d9555338a73b52a1db3e404

Analysis

max time kernel
1798s
max time network
1800s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DarkLoader.exe
Size 1.4MB
Sample240526-teaamabh4y
SHA256 e717a0bd95ad8f0798d01d6cf0f10dcd18b162554d9555338a73b52a1db3e404
MD5 2fa8b7d2efff94e2184a638f3858b4f1
SHA1 b2e33ef6e39f8d74dcd636b78299868e6fd6c651
SHA512 3af95a911f239e274d92883399225c61db9208701f3e950ecccad964acaebfce1abf8a484b09dfd25230961a5ebd80460a4259fa97c9a63d2973f8c5b6ddbd34
SSDEEP 24576:i5ZWs+OZVEWry8AFy0twmtCiSC+1o9AxfAd0GIZ8x69Xx2base9KePqigGF:6ZB1G8Y3btCLC+1sAxfAzIZF9XxqaseH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Mail\\WaaSMedicAgent.exe\""	bridgeBlockdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Mail\\WaaSMedicAgent.exe\", \"C:\\webruntimehost\\conhost.exe\""	bridgeBlockdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Mail\\WaaSMedicAgent.exe\", \"C:\\webruntimehost\\conhost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\TrustedInstaller.exe\""	bridgeBlockdhcp.exe

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4948	2808	schtasks.exe	99
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4400	2808	schtasks.exe	99
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4408	2808	schtasks.exe	99
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3912	2808	schtasks.exe	99
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4724	2808	schtasks.exe	99
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4296	2808	schtasks.exe	99
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	2808	schtasks.exe	99
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4212	2808	schtasks.exe	99
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2532	2808	schtasks.exe	99

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bridgeBlockdhcp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bridgeBlockdhcp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	bridgeBlockdhcp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WaaSMedicAgent.exe

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0008000000023415-6.dat	dcrat
behavioral2/files/0x000700000002341a-24.dat	dcrat
behavioral2/memory/3084-26-0x0000000000D20000-0x0000000000E68000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	DarkLoader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	DarkPatcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	bridgeBlockdhcp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	WaaSMedicAgent.exe

Executes dropped EXE 14 IoCs

pid	Process
3620	DarkPatcher.exe
3084	bridgeBlockdhcp.exe
4268	WaaSMedicAgent.exe
5112	conhost.exe
1164	conhost.exe
404	TrustedInstaller.exe
436	WaaSMedicAgent.exe
2396	conhost.exe
4284	conhost.exe
4852	TrustedInstaller.exe
1224	conhost.exe
2828	WaaSMedicAgent.exe
3620	conhost.exe
4380	TrustedInstaller.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\Program Files\\Windows Mail\\WaaSMedicAgent.exe\""	bridgeBlockdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\Program Files\\Windows Mail\\WaaSMedicAgent.exe\""	bridgeBlockdhcp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\webruntimehost\\conhost.exe\""	bridgeBlockdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\webruntimehost\\conhost.exe\""	bridgeBlockdhcp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TrustedInstaller = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\TrustedInstaller.exe\""	bridgeBlockdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TrustedInstaller = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\TrustedInstaller.exe\""	bridgeBlockdhcp.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bridgeBlockdhcp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bridgeBlockdhcp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WaaSMedicAgent.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
29	ip-api.com

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Mail\WaaSMedicAgent.exe	bridgeBlockdhcp.exe
File opened for modification	C:\Program Files\Windows Mail\WaaSMedicAgent.exe	bridgeBlockdhcp.exe
File created	C:\Program Files\Windows Mail\c82b8037eab33d	bridgeBlockdhcp.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\TrustedInstaller.exe	bridgeBlockdhcp.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\04c1e7795967e4	bridgeBlockdhcp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4400	schtasks.exe
4408	schtasks.exe
4724	schtasks.exe
872	schtasks.exe
2532	schtasks.exe
4948	schtasks.exe
3912	schtasks.exe
4296	schtasks.exe
4212	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	DarkPatcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	WaaSMedicAgent.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3084	bridgeBlockdhcp.exe
3084	bridgeBlockdhcp.exe
3084	bridgeBlockdhcp.exe
3084	bridgeBlockdhcp.exe
3084	bridgeBlockdhcp.exe
4268	WaaSMedicAgent.exe
4268	WaaSMedicAgent.exe
4268	WaaSMedicAgent.exe
4268	WaaSMedicAgent.exe
4268	WaaSMedicAgent.exe
4268	WaaSMedicAgent.exe
4268	WaaSMedicAgent.exe
4268	WaaSMedicAgent.exe
4268	WaaSMedicAgent.exe
4268	WaaSMedicAgent.exe
4268	WaaSMedicAgent.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4268	WaaSMedicAgent.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	3084	bridgeBlockdhcp.exe
Token: SeDebugPrivilege	4268	WaaSMedicAgent.exe
Token: SeDebugPrivilege	5112	conhost.exe
Token: SeDebugPrivilege	1164	conhost.exe
Token: SeDebugPrivilege	404	TrustedInstaller.exe
Token: SeDebugPrivilege	436	WaaSMedicAgent.exe
Token: SeDebugPrivilege	2396	conhost.exe
Token: SeDebugPrivilege	4284	conhost.exe
Token: SeDebugPrivilege	4852	TrustedInstaller.exe
Token: SeDebugPrivilege	1224	conhost.exe
Token: SeDebugPrivilege	2828	WaaSMedicAgent.exe
Token: SeDebugPrivilege	3620	conhost.exe
Token: SeDebugPrivilege	4380	TrustedInstaller.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3620	DarkPatcher.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 3620	228	DarkLoader.exe	85
PID 228 wrote to memory of 3620	228	DarkLoader.exe	85
PID 228 wrote to memory of 3620	228	DarkLoader.exe	85
PID 3620 wrote to memory of 1132	3620	DarkPatcher.exe	88
PID 3620 wrote to memory of 1132	3620	DarkPatcher.exe	88
PID 3620 wrote to memory of 1132	3620	DarkPatcher.exe	88
PID 228 wrote to memory of 3088	228	DarkLoader.exe	89
PID 228 wrote to memory of 3088	228	DarkLoader.exe	89
PID 3088 wrote to memory of 1528	3088	cmd.exe	91
PID 3088 wrote to memory of 1528	3088	cmd.exe	91
PID 1132 wrote to memory of 2912	1132	WScript.exe	103
PID 1132 wrote to memory of 2912	1132	WScript.exe	103
PID 1132 wrote to memory of 2912	1132	WScript.exe	103
PID 2912 wrote to memory of 3084	2912	cmd.exe	105
PID 2912 wrote to memory of 3084	2912	cmd.exe	105
PID 3084 wrote to memory of 4268	3084	bridgeBlockdhcp.exe	115
PID 3084 wrote to memory of 4268	3084	bridgeBlockdhcp.exe	115
PID 4268 wrote to memory of 4840	4268	WaaSMedicAgent.exe	116
PID 4268 wrote to memory of 4840	4268	WaaSMedicAgent.exe	116
PID 4268 wrote to memory of 2432	4268	WaaSMedicAgent.exe	117
PID 4268 wrote to memory of 2432	4268	WaaSMedicAgent.exe	117

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bridgeBlockdhcp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bridgeBlockdhcp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	bridgeBlockdhcp.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\DarkLoader.exe
"C:\Users\Admin\AppData\Local\Temp\DarkLoader.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:228
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\DarkPatcher.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\DarkPatcher.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\webruntimehost\uzRhfXiJ08p4ubq.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:1132
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\webruntimehost\xQ9PE.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2912
    - - C:\webruntimehost\bridgeBlockdhcp.exe
        
        "C:\webruntimehost\bridgeBlockdhcp.exe"
        5⤵
        Modifies WinLogon for persistence
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3084
      - C:\Program Files\Windows Mail\WaaSMedicAgent.exe
        
        "C:\Program Files\Windows Mail\WaaSMedicAgent.exe"
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4268
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8a6b8683-2d36-4e5d-9f7a-ed8ec6cface8.vbs"
        7⤵
        
        PID:4840
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1a7924cd-d6cf-49eb-8482-4d7ef09d9f04.vbs"
        7⤵
        
        PID:2432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\Loader.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\WaaSMedicAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Mail\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\webruntimehost\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\webruntimehost\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\webruntimehost\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\TrustedInstaller.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2532

C:\webruntimehost\conhost.exe
C:\webruntimehost\conhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5112

C:\webruntimehost\conhost.exe
C:\webruntimehost\conhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1164

C:\Program Files\Microsoft Office 15\ClientX64\TrustedInstaller.exe
"C:\Program Files\Microsoft Office 15\ClientX64\TrustedInstaller.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:404

C:\Program Files\Windows Mail\WaaSMedicAgent.exe
"C:\Program Files\Windows Mail\WaaSMedicAgent.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:436

C:\webruntimehost\conhost.exe
C:\webruntimehost\conhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2396

C:\webruntimehost\conhost.exe
C:\webruntimehost\conhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4284

C:\Program Files\Microsoft Office 15\ClientX64\TrustedInstaller.exe
"C:\Program Files\Microsoft Office 15\ClientX64\TrustedInstaller.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\webruntimehost\conhost.exe
C:\webruntimehost\conhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1224

C:\Program Files\Windows Mail\WaaSMedicAgent.exe
"C:\Program Files\Windows Mail\WaaSMedicAgent.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2828

C:\webruntimehost\conhost.exe
C:\webruntimehost\conhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3620

C:\Program Files\Microsoft Office 15\ClientX64\TrustedInstaller.exe
"C:\Program Files\Microsoft Office 15\ClientX64\TrustedInstaller.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

conhost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
MD5 SHA1 SHA512

Submit Download

1a7924cd-d6cf-49eb-8482-4d7ef09d9f04.vbs

Path C:\Users\Admin\AppData\Local\Temp\1a7924cd-d6cf-49eb-8482-4d7ef09d9f04.vbs
Size 500B
SHA256 aaa9f685cd7057a124abe4a38628228cce4de972e90aa0ffd4611f39a1dd5295
MD5 25df56c122a067337c70b661a0b952d1
SHA1 4305c91ae21481b60cfe763420b55f171a191c52
SHA512 c8b6a153055c4d4b11cfd841304db8c0632154dcccaa756b2e9452c0d80d4d353c61638d8cf5fdba7b567011768f25dc75e9d7e8aa1dcd76608132a87148e883
MD5 SHA1 SHA512

Submit Download

8a6b8683-2d36-4e5d-9f7a-ed8ec6cface8.vbs

Path C:\Users\Admin\AppData\Local\Temp\8a6b8683-2d36-4e5d-9f7a-ed8ec6cface8.vbs
Size 724B
SHA256 6c18936c596cd5a0c0925e6fa407b1a94760926576ff056dbdb3edd6ac4c8245
MD5 a1f0c041f3dbb3a386a45c3ede0d6ae5
SHA1 3326f985a316d0e9ea8eae6474de6f6b5a6c14bf
SHA512 f718193679fee11d9bb0289726cb4884b6deeb87bde528632537a938033e3aa4a8c86b9b6978f3b943feb432b2eb617b4e8060e95e1a3fd9adcf0418eccacd30
MD5 SHA1 SHA512

Submit Download

DarkPatcher.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\DarkPatcher.exe
Size 1.8MB
SHA256 f9b1beddd0d4f8f58a8c4a83b7f9543c49991722bf6fdf87e41e8122ebf3951a
MD5 9ca4c8b8366f7d3b051b4c2bf799c113
SHA1 f15bdce66ffea163b1a6a4bb709435095a91e989
SHA512 957a9610ce112df27c9042ea633b7031ec4847c434a6bdb3d105bf127f3eb44ca87168e3aea59d5647b6ab72ac6a2fc5074e2333961425313692ed1c9f113d63
SSDEEP 49152:hbA3yB9I825ruqHNiCTdByhKtAIcvFRIvM:hbM5runCZBOsAIcvbd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Loader.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Loader.bat
Size 665B
SHA256 db26bf2b4b50d48e760d2bd8d75b5d0249d8edd2b909a05dff6d69abf1b43a34
MD5 56d276709d2ac7b7299b0be004c06ccc
SHA1 887824ea4ba0bcc82189979d4d0e6cb9687131ce
SHA512 4e854c8d032c35f1ed9e5613625e7f51da00f4110b9b364281f66faaf6ee6130b398d644a3e79c49712df9c60d6eba0abaa25a0f58e87685e1da2030a5e92030
MD5 SHA1 SHA512

Submit Download

bridgeBlockdhcp.exe

Path C:\webruntimehost\bridgeBlockdhcp.exe
Size 1.3MB
SHA256 979e9c0fbc3e74ea555cfa6c0f1ba262fa3b0641e91be3aca4e89ba7eb69da97
MD5 d5dc5de300bce716abd115b44af50e24
SHA1 d33c2df549a28035325e85496fca4f3e130b9c39
SHA512 b3552291626a4c1449c1a3ac2c8abfd1d096cc95f03176d6a4469b2be2614c455cd615343b244917f08b09c1d27bfa6ecfa0a313a1142a61a5aa8b3143431df9
SSDEEP 24576:gIli4gs3OwhnrjaoxL3mQNNiCTd7ty2CQ8OtAIcvppQmRIfjbB:gI825ruqHNiCTdByhKtAIcvFRIv
MD5 SHA1 SHA512 SSDEEP

Submit Download

uzRhfXiJ08p4ubq.vbe

Path C:\webruntimehost\uzRhfXiJ08p4ubq.vbe
Size 197B
SHA256 69687c36f9e9c8674c379d72490eec8a74ae586ed3dc9f0b97490f90bb9d7013
MD5 bb13714c399f433729633fe5fee4eb4e
SHA1 ceff8f080401c8ea3c308292db53369b2b82ce4c
SHA512 a4b95068bcc6365ba664a5c44a25e91915ff4a817b5f7029fb81ae88a96931c8f266a018fee6dd00ab3abe702f7d0b7bf844c186efd340fd8ee7d915e8d2ea89
MD5 SHA1 SHA512

Submit Download

xQ9PE.bat

Path C:\webruntimehost\xQ9PE.bat
Size 39B
SHA256 ad7a789712a9c7ff89c73fc8a7a5e9f3f7c8e8ccb0bbe33b8421b8c0d24b48aa
MD5 6e8856747e64707063a7df412e1b41ff
SHA1 1bebe8751cdfeb697bb5829554aaa93006b50513
SHA512 1707ba87d800b6c8331a0646b74b8f0c1d03e1e5616bf4431ad84d01d11728314b673b1b7844aab01f6b275257e2019d5da23b5e8b02b1f0a28b330883748967
MD5 SHA1 SHA512

Submit Download

memory/3084-29-0x000000001BAB0000-0x000000001BAC6000-memory.dmp

Download

memory/3084-30-0x000000001BAD0000-0x000000001BADA000-memory.dmp

Download

memory/3084-31-0x000000001BAE0000-0x000000001BAEC000-memory.dmp

Download

memory/3084-32-0x000000001BAF0000-0x000000001BAFA000-memory.dmp

Download

memory/3084-33-0x000000001C010000-0x000000001C01E000-memory.dmp

Download

memory/3084-34-0x000000001C6D0000-0x000000001C6DC000-memory.dmp

Download

memory/3084-28-0x000000001BAA0000-0x000000001BAA8000-memory.dmp

Download

memory/3084-27-0x0000000001540000-0x000000000154E000-memory.dmp

Download

memory/3084-26-0x0000000000D20000-0x0000000000E68000-memory.dmp

Download