Malware Analysis Report

2024-10-10 12:53

Sample ID 240531-l7fzwaec8w
Target 3ce1f92e5a13d2d381d630bd5a5b258f7838147f1f88d679a98a40030976aa75.exe
SHA256 3ce1f92e5a13d2d381d630bd5a5b258f7838147f1f88d679a98a40030976aa75
Tags
rat dcrat infostealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3ce1f92e5a13d2d381d630bd5a5b258f7838147f1f88d679a98a40030976aa75

Threat Level: Known bad

The file 3ce1f92e5a13d2d381d630bd5a5b258f7838147f1f88d679a98a40030976aa75.exe was found to be: Known bad.

Malicious Activity Summary

rat dcrat infostealer

Dcrat family

DCRat payload

Process spawned unexpected child process

DcRat

DCRat payload

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-31 10:10

Signatures

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Dcrat family

dcrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-31 10:10

Reported

2024-05-31 10:12

Platform

win7-20240215-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3ce1f92e5a13d2d381d630bd5a5b258f7838147f1f88d679a98a40030976aa75.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\BlockagentServernetcommon\chaindhcp.exe N/A
N/A N/A C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsm.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsm.exe C:\BlockagentServernetcommon\chaindhcp.exe N/A
File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\101b941d020240 C:\BlockagentServernetcommon\chaindhcp.exe N/A
File created C:\Program Files (x86)\Windows Mail\es-ES\explorer.exe C:\BlockagentServernetcommon\chaindhcp.exe N/A
File created C:\Program Files (x86)\Windows Mail\es-ES\7a0fd90576e088 C:\BlockagentServernetcommon\chaindhcp.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\AppPatch\6203df4a6bafc7 C:\BlockagentServernetcommon\chaindhcp.exe N/A
File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\taskhost.exe C:\BlockagentServernetcommon\chaindhcp.exe N/A
File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\b75386f1303e64 C:\BlockagentServernetcommon\chaindhcp.exe N/A
File created C:\Windows\AppPatch\lsass.exe C:\BlockagentServernetcommon\chaindhcp.exe N/A
File opened for modification C:\Windows\AppPatch\lsass.exe C:\BlockagentServernetcommon\chaindhcp.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\BlockagentServernetcommon\chaindhcp.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2896 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\3ce1f92e5a13d2d381d630bd5a5b258f7838147f1f88d679a98a40030976aa75.exe C:\Windows\SysWOW64\WScript.exe
PID 2896 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\3ce1f92e5a13d2d381d630bd5a5b258f7838147f1f88d679a98a40030976aa75.exe C:\Windows\SysWOW64\WScript.exe
PID 2896 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\3ce1f92e5a13d2d381d630bd5a5b258f7838147f1f88d679a98a40030976aa75.exe C:\Windows\SysWOW64\WScript.exe
PID 2896 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\3ce1f92e5a13d2d381d630bd5a5b258f7838147f1f88d679a98a40030976aa75.exe C:\Windows\SysWOW64\WScript.exe
PID 1564 wrote to memory of 2556 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1564 wrote to memory of 2556 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1564 wrote to memory of 2556 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1564 wrote to memory of 2556 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2556 wrote to memory of 2480 N/A C:\Windows\SysWOW64\cmd.exe C:\BlockagentServernetcommon\chaindhcp.exe
PID 2556 wrote to memory of 2480 N/A C:\Windows\SysWOW64\cmd.exe C:\BlockagentServernetcommon\chaindhcp.exe
PID 2556 wrote to memory of 2480 N/A C:\Windows\SysWOW64\cmd.exe C:\BlockagentServernetcommon\chaindhcp.exe
PID 2556 wrote to memory of 2480 N/A C:\Windows\SysWOW64\cmd.exe C:\BlockagentServernetcommon\chaindhcp.exe
PID 2480 wrote to memory of 2424 N/A C:\BlockagentServernetcommon\chaindhcp.exe C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsm.exe
PID 2480 wrote to memory of 2424 N/A C:\BlockagentServernetcommon\chaindhcp.exe C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsm.exe
PID 2480 wrote to memory of 2424 N/A C:\BlockagentServernetcommon\chaindhcp.exe C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsm.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\3ce1f92e5a13d2d381d630bd5a5b258f7838147f1f88d679a98a40030976aa75.exe

"C:\Users\Admin\AppData\Local\Temp\3ce1f92e5a13d2d381d630bd5a5b258f7838147f1f88d679a98a40030976aa75.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\BlockagentServernetcommon\dWMX88gCACXoKvtETHr5LRHJRP.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\BlockagentServernetcommon\iMMFNCJn73wO9QJjxuedDCGIZ.bat" "

C:\BlockagentServernetcommon\chaindhcp.exe

"C:\BlockagentServernetcommon\chaindhcp.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Windows\AppPatch\lsass.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\AppPatch\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Windows\AppPatch\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Mail\es-ES\explorer.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\es-ES\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\es-ES\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\LocalLow\Mozilla\wininit.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Admin\AppData\LocalLow\Mozilla\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\AppData\LocalLow\Mozilla\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\BlockagentServernetcommon\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\BlockagentServernetcommon\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\BlockagentServernetcommon\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\BlockagentServernetcommon\conhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\BlockagentServernetcommon\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\BlockagentServernetcommon\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\taskhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\taskhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\taskhost.exe'" /rl HIGHEST /f

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsm.exe

"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsm.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 a0987339.xsph.ru udp
RU 141.8.192.103:80 a0987339.xsph.ru tcp

Files

C:\BlockagentServernetcommon\dWMX88gCACXoKvtETHr5LRHJRP.vbe

MD5 d40a0d6875e6223f9e5c4c9613c975b4
SHA1 c605b32b588597dce9916053944eccef138d3b6e
SHA256 2304bdc77b852533e29614bd26e244c64fee9c2e9c5ea2a8c4e4579fd8ade547
SHA512 2e2570f2d0af1fde57fd7ef1812981e75daed6a906f2a359e89713dabf2df204b4788c76adcdaca8bb9f3046a3ee9cf5731bc84105ce82af17953c7f7197ff78

C:\BlockagentServernetcommon\iMMFNCJn73wO9QJjxuedDCGIZ.bat

MD5 eb6b7f7bea1252f5f5bfcc2c9e0164e5
SHA1 ec7bfe67793b4b3f4842334e9476a5e9a2f95688
SHA256 31f24dac6e2778c338307d6ccdf2e7e8b8626266bfef12af006b20b4a27c05af
SHA512 02807c217a7e93cdfd7cb60c0bf9110ef7585b0d1843599bc3c4537481ebfe942f3f41b9b71c4aa26b2f4ef5619338d81f0474a387c859942e5814d49f8f3939

\BlockagentServernetcommon\chaindhcp.exe

MD5 64bce0f72bd60afa24806c4e8184ba5d
SHA1 633df6157e70b70a4606e3f9f63fdc9db17dba14
SHA256 ce9beff66fd8ae2b916b2490e5c8da04c4316f98de24304c56417ea0bfd28451
SHA512 efeb232f08d86465cf88d2050e3e52818b877621d29b9bb1eab8f44238ef02b7495bb11910ed1709b8058d104269e05d0e31557f4bbe1afc0ba0bf3baf8f5191

memory/2480-13-0x0000000000960000-0x0000000000A36000-memory.dmp

memory/2424-34-0x0000000000AF0000-0x0000000000BC6000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-31 10:10

Reported

2024-05-31 10:12

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3ce1f92e5a13d2d381d630bd5a5b258f7838147f1f88d679a98a40030976aa75.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\BlockagentServernetcommon\chaindhcp.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3ce1f92e5a13d2d381d630bd5a5b258f7838147f1f88d679a98a40030976aa75.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\BlockagentServernetcommon\chaindhcp.exe N/A
N/A N/A C:\Recovery\WindowsRE\sysmon.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\dotnet\swidtag\9e8d7a4ca61bd9 C:\BlockagentServernetcommon\chaindhcp.exe N/A
File created C:\Program Files (x86)\Windows Mail\886983d96e3d3e C:\BlockagentServernetcommon\chaindhcp.exe N/A
File created C:\Program Files\Windows Portable Devices\ea9f0e6c9e2dcd C:\BlockagentServernetcommon\chaindhcp.exe N/A
File created C:\Program Files (x86)\Windows Mail\conhost.exe C:\BlockagentServernetcommon\chaindhcp.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\088424020bedd6 C:\BlockagentServernetcommon\chaindhcp.exe N/A
File created C:\Program Files\Windows NT\Accessories\smss.exe C:\BlockagentServernetcommon\chaindhcp.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\RuntimeBroker.exe C:\BlockagentServernetcommon\chaindhcp.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\conhost.exe C:\BlockagentServernetcommon\chaindhcp.exe N/A
File created C:\Program Files\dotnet\swidtag\RuntimeBroker.exe C:\BlockagentServernetcommon\chaindhcp.exe N/A
File created C:\Program Files (x86)\Microsoft.NET\winlogon.exe C:\BlockagentServernetcommon\chaindhcp.exe N/A
File created C:\Program Files (x86)\Microsoft.NET\cc11b995f2a76d C:\BlockagentServernetcommon\chaindhcp.exe N/A
File created C:\Program Files (x86)\Windows Mail\csrss.exe C:\BlockagentServernetcommon\chaindhcp.exe N/A
File created C:\Program Files (x86)\Windows Mail\088424020bedd6 C:\BlockagentServernetcommon\chaindhcp.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft.NET\winlogon.exe C:\BlockagentServernetcommon\chaindhcp.exe N/A
File created C:\Program Files\Windows NT\Accessories\69ddcba757bf72 C:\BlockagentServernetcommon\chaindhcp.exe N/A
File created C:\Program Files\Windows Portable Devices\taskhostw.exe C:\BlockagentServernetcommon\chaindhcp.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\9e8d7a4ca61bd9 C:\BlockagentServernetcommon\chaindhcp.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\LanguageOverlayCache\sihost.exe C:\BlockagentServernetcommon\chaindhcp.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\3ce1f92e5a13d2d381d630bd5a5b258f7838147f1f88d679a98a40030976aa75.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\BlockagentServernetcommon\chaindhcp.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\sysmon.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\3ce1f92e5a13d2d381d630bd5a5b258f7838147f1f88d679a98a40030976aa75.exe

"C:\Users\Admin\AppData\Local\Temp\3ce1f92e5a13d2d381d630bd5a5b258f7838147f1f88d679a98a40030976aa75.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\BlockagentServernetcommon\dWMX88gCACXoKvtETHr5LRHJRP.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\BlockagentServernetcommon\iMMFNCJn73wO9QJjxuedDCGIZ.bat" "

C:\BlockagentServernetcommon\chaindhcp.exe

"C:\BlockagentServernetcommon\chaindhcp.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\winlogon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows NT\Accessories\smss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows NT\Accessories\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Public\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\Public\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\BlockagentServernetcommon\fontdrvhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\BlockagentServernetcommon\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\BlockagentServernetcommon\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Portable Devices\taskhostw.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\taskhostw.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Portable Devices\taskhostw.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\BlockagentServernetcommon\OfficeClickToRun.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\BlockagentServernetcommon\OfficeClickToRun.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\BlockagentServernetcommon\OfficeClickToRun.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Desktop\fontdrvhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default\Desktop\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Desktop\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft\Temp\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Temp\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft\Temp\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\conhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Java\jdk-1.8\legal\jdk\conhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Java\jdk-1.8\legal\jdk\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Java\jdk-1.8\legal\jdk\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\dotnet\swidtag\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\dotnet\swidtag\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\dotnet\swidtag\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Recovery\WindowsRE\sysmon.exe

"C:\Recovery\WindowsRE\sysmon.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
NL 23.62.61.113:443 www.bing.com tcp
US 8.8.8.8:53 113.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 a0987339.xsph.ru udp
RU 141.8.192.103:80 a0987339.xsph.ru tcp
US 8.8.8.8:53 103.192.8.141.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 13.173.189.20.in-addr.arpa udp

Files

C:\BlockagentServernetcommon\dWMX88gCACXoKvtETHr5LRHJRP.vbe

MD5 d40a0d6875e6223f9e5c4c9613c975b4
SHA1 c605b32b588597dce9916053944eccef138d3b6e
SHA256 2304bdc77b852533e29614bd26e244c64fee9c2e9c5ea2a8c4e4579fd8ade547
SHA512 2e2570f2d0af1fde57fd7ef1812981e75daed6a906f2a359e89713dabf2df204b4788c76adcdaca8bb9f3046a3ee9cf5731bc84105ce82af17953c7f7197ff78

C:\BlockagentServernetcommon\iMMFNCJn73wO9QJjxuedDCGIZ.bat

MD5 eb6b7f7bea1252f5f5bfcc2c9e0164e5
SHA1 ec7bfe67793b4b3f4842334e9476a5e9a2f95688
SHA256 31f24dac6e2778c338307d6ccdf2e7e8b8626266bfef12af006b20b4a27c05af
SHA512 02807c217a7e93cdfd7cb60c0bf9110ef7585b0d1843599bc3c4537481ebfe942f3f41b9b71c4aa26b2f4ef5619338d81f0474a387c859942e5814d49f8f3939

C:\BlockagentServernetcommon\chaindhcp.exe

MD5 64bce0f72bd60afa24806c4e8184ba5d
SHA1 633df6157e70b70a4606e3f9f63fdc9db17dba14
SHA256 ce9beff66fd8ae2b916b2490e5c8da04c4316f98de24304c56417ea0bfd28451
SHA512 efeb232f08d86465cf88d2050e3e52818b877621d29b9bb1eab8f44238ef02b7495bb11910ed1709b8058d104269e05d0e31557f4bbe1afc0ba0bf3baf8f5191

memory/3880-12-0x00007FFE96CF3000-0x00007FFE96CF5000-memory.dmp

memory/3880-13-0x0000000000FB0000-0x0000000001086000-memory.dmp