dcrat | e717a0bd95ad8f0798d01d6cf0f10dcd18b162554d9555338a73b52a1db3e404

General

Target

DarkLoader.exe
Size

1.4MB
MD5

2fa8b7d2efff94e2184a638f3858b4f1
SHA1

b2e33ef6e39f8d74dcd636b78299868e6fd6c651
SHA256

e717a0bd95ad8f0798d01d6cf0f10dcd18b162554d9555338a73b52a1db3e404
SHA512

3af95a911f239e274d92883399225c61db9208701f3e950ecccad964acaebfce1abf8a484b09dfd25230961a5ebd80460a4259fa97c9a63d2973f8c5b6ddbd34
SSDEEP

24576:i5ZWs+OZVEWry8AFy0twmtCiSC+1o9AxfAd0GIZ8x69Xx2base9KePqigGF:6ZB1G8Y3btCLC+1sAxfAzIZF9XxqaseH

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Mail\\WaaSMedicAgent.exe\""	bridgeBlockdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Mail\\WaaSMedicAgent.exe\", \"C:\\webruntimehost\\conhost.exe\""	bridgeBlockdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Mail\\WaaSMedicAgent.exe\", \"C:\\webruntimehost\\conhost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\TrustedInstaller.exe\""	bridgeBlockdhcp.exe

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4948	2808	schtasks.exe	99
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4400	2808	schtasks.exe	99
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4408	2808	schtasks.exe	99
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3912	2808	schtasks.exe	99
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4724	2808	schtasks.exe	99
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4296	2808	schtasks.exe	99
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	2808	schtasks.exe	99
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4212	2808	schtasks.exe	99
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2532	2808	schtasks.exe	99

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bridgeBlockdhcp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bridgeBlockdhcp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	bridgeBlockdhcp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WaaSMedicAgent.exe

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0008000000023415-6.dat	dcrat
behavioral2/files/0x000700000002341a-24.dat	dcrat
behavioral2/memory/3084-26-0x0000000000D20000-0x0000000000E68000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	DarkLoader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	DarkPatcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	bridgeBlockdhcp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	WaaSMedicAgent.exe

Executes dropped EXE 14 IoCs

pid	Process
3620	DarkPatcher.exe
3084	bridgeBlockdhcp.exe
4268	WaaSMedicAgent.exe
5112	conhost.exe
1164	conhost.exe
404	TrustedInstaller.exe
436	WaaSMedicAgent.exe
2396	conhost.exe
4284	conhost.exe
4852	TrustedInstaller.exe
1224	conhost.exe
2828	WaaSMedicAgent.exe
3620	conhost.exe
4380	TrustedInstaller.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\Program Files\\Windows Mail\\WaaSMedicAgent.exe\""	bridgeBlockdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\Program Files\\Windows Mail\\WaaSMedicAgent.exe\""	bridgeBlockdhcp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\webruntimehost\\conhost.exe\""	bridgeBlockdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\webruntimehost\\conhost.exe\""	bridgeBlockdhcp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TrustedInstaller = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\TrustedInstaller.exe\""	bridgeBlockdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TrustedInstaller = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\TrustedInstaller.exe\""	bridgeBlockdhcp.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bridgeBlockdhcp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bridgeBlockdhcp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WaaSMedicAgent.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
29	ip-api.com

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Mail\WaaSMedicAgent.exe	bridgeBlockdhcp.exe
File opened for modification	C:\Program Files\Windows Mail\WaaSMedicAgent.exe	bridgeBlockdhcp.exe
File created	C:\Program Files\Windows Mail\c82b8037eab33d	bridgeBlockdhcp.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\TrustedInstaller.exe	bridgeBlockdhcp.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\04c1e7795967e4	bridgeBlockdhcp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4400	schtasks.exe
4408	schtasks.exe
4724	schtasks.exe
872	schtasks.exe
2532	schtasks.exe
4948	schtasks.exe
3912	schtasks.exe
4296	schtasks.exe
4212	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	DarkPatcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	WaaSMedicAgent.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3084	bridgeBlockdhcp.exe
3084	bridgeBlockdhcp.exe
3084	bridgeBlockdhcp.exe
3084	bridgeBlockdhcp.exe
3084	bridgeBlockdhcp.exe
4268	WaaSMedicAgent.exe
4268	WaaSMedicAgent.exe
4268	WaaSMedicAgent.exe
4268	WaaSMedicAgent.exe
4268	WaaSMedicAgent.exe
4268	WaaSMedicAgent.exe
4268	WaaSMedicAgent.exe
4268	WaaSMedicAgent.exe
4268	WaaSMedicAgent.exe
4268	WaaSMedicAgent.exe
4268	WaaSMedicAgent.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4268	WaaSMedicAgent.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	3084	bridgeBlockdhcp.exe
Token: SeDebugPrivilege	4268	WaaSMedicAgent.exe
Token: SeDebugPrivilege	5112	conhost.exe
Token: SeDebugPrivilege	1164	conhost.exe
Token: SeDebugPrivilege	404	TrustedInstaller.exe
Token: SeDebugPrivilege	436	WaaSMedicAgent.exe
Token: SeDebugPrivilege	2396	conhost.exe
Token: SeDebugPrivilege	4284	conhost.exe
Token: SeDebugPrivilege	4852	TrustedInstaller.exe
Token: SeDebugPrivilege	1224	conhost.exe
Token: SeDebugPrivilege	2828	WaaSMedicAgent.exe
Token: SeDebugPrivilege	3620	conhost.exe
Token: SeDebugPrivilege	4380	TrustedInstaller.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3620	DarkPatcher.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 3620	228	DarkLoader.exe	85
PID 228 wrote to memory of 3620	228	DarkLoader.exe	85
PID 228 wrote to memory of 3620	228	DarkLoader.exe	85
PID 3620 wrote to memory of 1132	3620	DarkPatcher.exe	88
PID 3620 wrote to memory of 1132	3620	DarkPatcher.exe	88
PID 3620 wrote to memory of 1132	3620	DarkPatcher.exe	88
PID 228 wrote to memory of 3088	228	DarkLoader.exe	89
PID 228 wrote to memory of 3088	228	DarkLoader.exe	89
PID 3088 wrote to memory of 1528	3088	cmd.exe	91
PID 3088 wrote to memory of 1528	3088	cmd.exe	91
PID 1132 wrote to memory of 2912	1132	WScript.exe	103
PID 1132 wrote to memory of 2912	1132	WScript.exe	103
PID 1132 wrote to memory of 2912	1132	WScript.exe	103
PID 2912 wrote to memory of 3084	2912	cmd.exe	105
PID 2912 wrote to memory of 3084	2912	cmd.exe	105
PID 3084 wrote to memory of 4268	3084	bridgeBlockdhcp.exe	115
PID 3084 wrote to memory of 4268	3084	bridgeBlockdhcp.exe	115
PID 4268 wrote to memory of 4840	4268	WaaSMedicAgent.exe	116
PID 4268 wrote to memory of 4840	4268	WaaSMedicAgent.exe	116
PID 4268 wrote to memory of 2432	4268	WaaSMedicAgent.exe	117
PID 4268 wrote to memory of 2432	4268	WaaSMedicAgent.exe	117

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bridgeBlockdhcp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bridgeBlockdhcp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	bridgeBlockdhcp.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\DarkLoader.exe
"C:\Users\Admin\AppData\Local\Temp\DarkLoader.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:228
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\DarkPatcher.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\DarkPatcher.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\webruntimehost\uzRhfXiJ08p4ubq.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:1132
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\webruntimehost\xQ9PE.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2912
    - - C:\webruntimehost\bridgeBlockdhcp.exe
        
        "C:\webruntimehost\bridgeBlockdhcp.exe"
        5⤵
        Modifies WinLogon for persistence
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3084
      - C:\Program Files\Windows Mail\WaaSMedicAgent.exe
        
        "C:\Program Files\Windows Mail\WaaSMedicAgent.exe"
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4268
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8a6b8683-2d36-4e5d-9f7a-ed8ec6cface8.vbs"
        7⤵
        
        PID:4840
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1a7924cd-d6cf-49eb-8482-4d7ef09d9f04.vbs"
        7⤵
        
        PID:2432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\Loader.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\WaaSMedicAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Mail\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\webruntimehost\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\webruntimehost\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\webruntimehost\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\TrustedInstaller.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2532

C:\webruntimehost\conhost.exe
C:\webruntimehost\conhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5112

C:\webruntimehost\conhost.exe
C:\webruntimehost\conhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1164

C:\Program Files\Microsoft Office 15\ClientX64\TrustedInstaller.exe
"C:\Program Files\Microsoft Office 15\ClientX64\TrustedInstaller.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:404

C:\Program Files\Windows Mail\WaaSMedicAgent.exe
"C:\Program Files\Windows Mail\WaaSMedicAgent.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:436

C:\webruntimehost\conhost.exe
C:\webruntimehost\conhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2396

C:\webruntimehost\conhost.exe
C:\webruntimehost\conhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4284

C:\Program Files\Microsoft Office 15\ClientX64\TrustedInstaller.exe
"C:\Program Files\Microsoft Office 15\ClientX64\TrustedInstaller.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\webruntimehost\conhost.exe
C:\webruntimehost\conhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1224

C:\Program Files\Windows Mail\WaaSMedicAgent.exe
"C:\Program Files\Windows Mail\WaaSMedicAgent.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2828

C:\webruntimehost\conhost.exe
C:\webruntimehost\conhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3620

C:\Program Files\Microsoft Office 15\ClientX64\TrustedInstaller.exe
"C:\Program Files\Microsoft Office 15\ClientX64\TrustedInstaller.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Temp\1a7924cd-d6cf-49eb-8482-4d7ef09d9f04.vbs

Filesize
500B

MD5
25df56c122a067337c70b661a0b952d1

SHA1
4305c91ae21481b60cfe763420b55f171a191c52

SHA256
aaa9f685cd7057a124abe4a38628228cce4de972e90aa0ffd4611f39a1dd5295

SHA512
c8b6a153055c4d4b11cfd841304db8c0632154dcccaa756b2e9452c0d80d4d353c61638d8cf5fdba7b567011768f25dc75e9d7e8aa1dcd76608132a87148e883

Download Submit
C:\Users\Admin\AppData\Local\Temp\8a6b8683-2d36-4e5d-9f7a-ed8ec6cface8.vbs

Filesize
724B

MD5
a1f0c041f3dbb3a386a45c3ede0d6ae5

SHA1
3326f985a316d0e9ea8eae6474de6f6b5a6c14bf

SHA256
6c18936c596cd5a0c0925e6fa407b1a94760926576ff056dbdb3edd6ac4c8245

SHA512
f718193679fee11d9bb0289726cb4884b6deeb87bde528632537a938033e3aa4a8c86b9b6978f3b943feb432b2eb617b4e8060e95e1a3fd9adcf0418eccacd30

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\DarkPatcher.exe

Filesize
1.8MB

MD5
9ca4c8b8366f7d3b051b4c2bf799c113

SHA1
f15bdce66ffea163b1a6a4bb709435095a91e989

SHA256
f9b1beddd0d4f8f58a8c4a83b7f9543c49991722bf6fdf87e41e8122ebf3951a

SHA512
957a9610ce112df27c9042ea633b7031ec4847c434a6bdb3d105bf127f3eb44ca87168e3aea59d5647b6ab72ac6a2fc5074e2333961425313692ed1c9f113d63

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Loader.bat

Filesize
665B

MD5
56d276709d2ac7b7299b0be004c06ccc

SHA1
887824ea4ba0bcc82189979d4d0e6cb9687131ce

SHA256
db26bf2b4b50d48e760d2bd8d75b5d0249d8edd2b909a05dff6d69abf1b43a34

SHA512
4e854c8d032c35f1ed9e5613625e7f51da00f4110b9b364281f66faaf6ee6130b398d644a3e79c49712df9c60d6eba0abaa25a0f58e87685e1da2030a5e92030

Download Submit
C:\webruntimehost\bridgeBlockdhcp.exe

Filesize
1.3MB

MD5
d5dc5de300bce716abd115b44af50e24

SHA1
d33c2df549a28035325e85496fca4f3e130b9c39

SHA256
979e9c0fbc3e74ea555cfa6c0f1ba262fa3b0641e91be3aca4e89ba7eb69da97

SHA512
b3552291626a4c1449c1a3ac2c8abfd1d096cc95f03176d6a4469b2be2614c455cd615343b244917f08b09c1d27bfa6ecfa0a313a1142a61a5aa8b3143431df9

Download Submit
C:\webruntimehost\uzRhfXiJ08p4ubq.vbe

Filesize
197B

MD5
bb13714c399f433729633fe5fee4eb4e

SHA1
ceff8f080401c8ea3c308292db53369b2b82ce4c

SHA256
69687c36f9e9c8674c379d72490eec8a74ae586ed3dc9f0b97490f90bb9d7013

SHA512
a4b95068bcc6365ba664a5c44a25e91915ff4a817b5f7029fb81ae88a96931c8f266a018fee6dd00ab3abe702f7d0b7bf844c186efd340fd8ee7d915e8d2ea89

Download Submit
C:\webruntimehost\xQ9PE.bat

Filesize
39B

MD5
6e8856747e64707063a7df412e1b41ff

SHA1
1bebe8751cdfeb697bb5829554aaa93006b50513

SHA256
ad7a789712a9c7ff89c73fc8a7a5e9f3f7c8e8ccb0bbe33b8421b8c0d24b48aa

SHA512
1707ba87d800b6c8331a0646b74b8f0c1d03e1e5616bf4431ad84d01d11728314b673b1b7844aab01f6b275257e2019d5da23b5e8b02b1f0a28b330883748967

Download Submit
memory/3084-29-0x000000001BAB0000-0x000000001BAC6000-memory.dmp

Filesize
88KB

Download
memory/3084-30-0x000000001BAD0000-0x000000001BADA000-memory.dmp

Filesize
40KB

Download
memory/3084-31-0x000000001BAE0000-0x000000001BAEC000-memory.dmp

Filesize
48KB

Download
memory/3084-32-0x000000001BAF0000-0x000000001BAFA000-memory.dmp

Filesize
40KB

Download
memory/3084-33-0x000000001C010000-0x000000001C01E000-memory.dmp

Filesize
56KB

Download
memory/3084-34-0x000000001C6D0000-0x000000001C6DC000-memory.dmp

Filesize
48KB

Download
memory/3084-28-0x000000001BAA0000-0x000000001BAA8000-memory.dmp

Filesize
32KB

Download
memory/3084-27-0x0000000001540000-0x000000000154E000-memory.dmp

Filesize
56KB

Download
memory/3084-26-0x0000000000D20000-0x0000000000E68000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads