dcrat | cf1f6eb66912ff5ad30f8940accdb1df9bb2f8f8cdf3f8d45a4febd48c5641b9

Analysis

max time kernel
131s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nursultan.exe
Size 1.7MB
Sample240603-d7gmeabc56
SHA256 cf1f6eb66912ff5ad30f8940accdb1df9bb2f8f8cdf3f8d45a4febd48c5641b9
MD5 167a7a1acbb331c7120f7c523b77b63a
SHA1 e4ab977acdb17dbbf2caa51a75d7fb67c4dc433b
SHA512 2145a9c4414e814e2d6d88c403e0ade70eef266b1307f8c2cdc3822a7829e5e2273932f128981c96cfede5d719b5e9a0654c4fb395f19e74dd2bb020cf501a3f
SSDEEP 24576:P2G/nvxW3WayX0tmpK3Xgjh1gMTVn/8E6Oqi4yEBCknTXCZ/UzGGq1lM/XP2YFn+:PbA37ykwpKM+sHWyGXvAIbFCZ2XC1f
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat 55 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		1012	schtasks.exe
		3048	schtasks.exe
		3956	schtasks.exe
		2232	schtasks.exe
		3172	schtasks.exe
		4588	schtasks.exe
		2108	schtasks.exe
		2484	schtasks.exe
		4544	schtasks.exe
		4988	schtasks.exe
		4232	schtasks.exe
		4684	schtasks.exe
		948	schtasks.exe
		2572	schtasks.exe
		4980	schtasks.exe
		2348	schtasks.exe
		2092	schtasks.exe
		4956	schtasks.exe
		4324	schtasks.exe
		2236	schtasks.exe
		2228	schtasks.exe
		1912	schtasks.exe
		4952	schtasks.exe
		4528	schtasks.exe
		3928	schtasks.exe
		2496	schtasks.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation		Nursultan.exe
		3592	schtasks.exe
		456	schtasks.exe
		3388	schtasks.exe
		1128	schtasks.exe
		624	schtasks.exe
		5056	schtasks.exe
		2280	schtasks.exe
		4304	schtasks.exe
		3372	schtasks.exe
		2292	schtasks.exe
		1328	schtasks.exe
		4900	schtasks.exe
		3128	schtasks.exe
		2424	schtasks.exe
		1608	schtasks.exe
		672	schtasks.exe
		4488	schtasks.exe
		3416	schtasks.exe
		2832	schtasks.exe
		3344	schtasks.exe
		3712	schtasks.exe
		3480	schtasks.exe
		2256	schtasks.exe
		1236	schtasks.exe
		3796	schtasks.exe
		220	schtasks.exe
		4776	schtasks.exe
		1576	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 18 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Documents\\lsass.exe\", \"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\cmd.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Windows\\Temp\\Crashpad\\RuntimeBroker.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Documents\\lsass.exe\", \"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\cmd.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Windows\\Temp\\Crashpad\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Cookies\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Downloads\\WaaSMedicAgent.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Documents\\lsass.exe\", \"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\cmd.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Windows\\Temp\\Crashpad\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Cookies\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Downloads\\WaaSMedicAgent.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\TextInputHost.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Documents\\lsass.exe\", \"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\cmd.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Windows\\Temp\\Crashpad\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Cookies\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Downloads\\WaaSMedicAgent.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\TextInputHost.exe\", \"C:\\Users\\Default\\Favorites\\TextInputHost.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Documents\\lsass.exe\", \"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\cmd.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Documents\\lsass.exe\", \"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\cmd.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Windows\\Temp\\Crashpad\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Cookies\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Downloads\\WaaSMedicAgent.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\TextInputHost.exe\", \"C:\\Users\\Default\\Favorites\\TextInputHost.exe\", \"C:\\ProviderInto\\SearchApp.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Documents\\lsass.exe\", \"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\cmd.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Windows\\Temp\\Crashpad\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Cookies\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Downloads\\WaaSMedicAgent.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\TextInputHost.exe\", \"C:\\Users\\Default\\Favorites\\TextInputHost.exe\", \"C:\\ProviderInto\\SearchApp.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\WaaSMedicAgent.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\smss.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Documents\\lsass.exe\", \"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\cmd.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Windows\\Temp\\Crashpad\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Cookies\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Downloads\\WaaSMedicAgent.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\TextInputHost.exe\", \"C:\\Users\\Default\\Favorites\\TextInputHost.exe\", \"C:\\ProviderInto\\SearchApp.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\WaaSMedicAgent.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\smss.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\ProviderInto\\WaaSMedicAgent.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Documents\\lsass.exe\", \"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\cmd.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Windows\\Temp\\Crashpad\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Cookies\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Downloads\\WaaSMedicAgent.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\TextInputHost.exe\", \"C:\\Users\\Default\\Favorites\\TextInputHost.exe\", \"C:\\ProviderInto\\SearchApp.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\WaaSMedicAgent.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\smss.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\ProviderInto\\WaaSMedicAgent.exe\", \"C:\\Program Files\\Microsoft Office\\PackageManifests\\spoolsv.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Documents\\lsass.exe\", \"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\cmd.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\wininit.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Documents\\lsass.exe\", \"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\cmd.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Windows\\Temp\\Crashpad\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Cookies\\RuntimeBroker.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Documents\\lsass.exe\", \"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\cmd.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Windows\\Temp\\Crashpad\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Cookies\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Downloads\\WaaSMedicAgent.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\TextInputHost.exe\", \"C:\\Users\\Default\\Favorites\\TextInputHost.exe\", \"C:\\ProviderInto\\SearchApp.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\WaaSMedicAgent.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\smss.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\ProviderInto\\WaaSMedicAgent.exe\", \"C:\\Program Files\\Microsoft Office\\PackageManifests\\spoolsv.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Documents\\lsass.exe\", \"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\cmd.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Windows\\Temp\\Crashpad\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Cookies\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Downloads\\WaaSMedicAgent.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\TextInputHost.exe\", \"C:\\Users\\Default\\Favorites\\TextInputHost.exe\", \"C:\\ProviderInto\\SearchApp.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\WaaSMedicAgent.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\smss.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\ProviderInto\\WaaSMedicAgent.exe\", \"C:\\Program Files\\Microsoft Office\\PackageManifests\\spoolsv.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\conhost.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Documents\\lsass.exe\", \"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\cmd.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Documents\\lsass.exe\", \"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\cmd.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Windows\\Temp\\Crashpad\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Cookies\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Downloads\\WaaSMedicAgent.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\TextInputHost.exe\", \"C:\\Users\\Default\\Favorites\\TextInputHost.exe\", \"C:\\ProviderInto\\SearchApp.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\WaaSMedicAgent.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Documents\\lsass.exe\", \"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\cmd.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Windows\\Temp\\Crashpad\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Cookies\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Downloads\\WaaSMedicAgent.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\TextInputHost.exe\", \"C:\\Users\\Default\\Favorites\\TextInputHost.exe\", \"C:\\ProviderInto\\SearchApp.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\WaaSMedicAgent.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\smss.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Documents\\lsass.exe\", \"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\cmd.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Windows\\Temp\\Crashpad\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Cookies\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Downloads\\WaaSMedicAgent.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\TextInputHost.exe\", \"C:\\Users\\Default\\Favorites\\TextInputHost.exe\", \"C:\\ProviderInto\\SearchApp.exe\", \"C:\\Program Files\\Mozilla Firefox\\uninstall\\WaaSMedicAgent.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\smss.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\ProviderInto\\WaaSMedicAgent.exe\", \"C:\\Program Files\\Microsoft Office\\PackageManifests\\spoolsv.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\conhost.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Documents\\lsass.exe\""	blocksurrogate.exe

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4544	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3372	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3344	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4988	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1912	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4232	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4952	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3712	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4684	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3172	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3592	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1236	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4588	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4956	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	456	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3480	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1328	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4900	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4324	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4304	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3796	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3388	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4528	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	220	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	948	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4980	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1128	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3956	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3928	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3128	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	624	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3416	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	672	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	3680	schtasks.exe	90

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000700000002340f-9.dat	dcrat
behavioral2/memory/3212-13-0x0000000000150000-0x00000000002AC000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	blocksurrogate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	blocksurrogate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	Nursultan.exe

Executes dropped EXE 3 IoCs

pid	Process
3212	blocksurrogate.exe
4360	blocksurrogate.exe
2636	StartMenuExperienceHost.exe

Adds Run key to start application 2 TTPs 34 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Recovery\\WindowsRE\\upfc.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\Users\\Default\\Downloads\\WaaSMedicAgent.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\conhost.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\Temp\\Crashpad\\RuntimeBroker.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Users\\Default\\Favorites\\TextInputHost.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Users\\Default\\Favorites\\TextInputHost.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\conhost.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\wininit.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\ProviderInto\\WaaSMedicAgent.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\Users\\Default\\Downloads\\WaaSMedicAgent.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\Program Files\\Mozilla Firefox\\uninstall\\WaaSMedicAgent.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files\\Microsoft Office\\PackageManifests\\spoolsv.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Default\\Cookies\\RuntimeBroker.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\ProviderInto\\SearchApp.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Windows Defender\\es-ES\\smss.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Windows Defender\\es-ES\\smss.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\ProviderInto\\WaaSMedicAgent.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Windows\\Performance\\WinSAT\\DataStore\\TextInputHost.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\Program Files\\Mozilla Firefox\\uninstall\\WaaSMedicAgent.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Resource\\wininit.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Recovery\\WindowsRE\\upfc.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Default\\Documents\\lsass.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\cmd.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DAO\\cmd.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\Temp\\Crashpad\\RuntimeBroker.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Windows\\Performance\\WinSAT\\DataStore\\TextInputHost.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\ProviderInto\\SearchApp.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files\\Microsoft Office\\PackageManifests\\spoolsv.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Default\\Documents\\lsass.exe\""	blocksurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Default\\Cookies\\RuntimeBroker.exe\""	blocksurrogate.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\56085415360792	blocksurrogate.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\smss.exe	blocksurrogate.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\cmd.exe	blocksurrogate.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\WaaSMedicAgent.exe	blocksurrogate.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\c82b8037eab33d	blocksurrogate.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\69ddcba757bf72	blocksurrogate.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\ebf1f9fa8afd6d	blocksurrogate.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\wininit.exe	blocksurrogate.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\wininit.exe	blocksurrogate.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\f3b6ecef712a24	blocksurrogate.exe
File created	C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe	blocksurrogate.exe
File created	C:\Program Files\VideoLAN\VLC\skins\fonts\088424020bedd6	blocksurrogate.exe
File created	C:\Program Files\ModifiableWindowsApps\TrustedInstaller.exe	blocksurrogate.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\spoolsv.exe	blocksurrogate.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Performance\WinSAT\DataStore\TextInputHost.exe	blocksurrogate.exe
File created	C:\Windows\Performance\WinSAT\DataStore\22eafd247d37c3	blocksurrogate.exe
File created	C:\Windows\OCR\en-us\System.exe	blocksurrogate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
624	schtasks.exe
2424	schtasks.exe
1012	schtasks.exe
4232	schtasks.exe
3592	schtasks.exe
4488	schtasks.exe
4900	schtasks.exe
3128	schtasks.exe
3956	schtasks.exe
2496	schtasks.exe
4776	schtasks.exe
2572	schtasks.exe
1328	schtasks.exe
1576	schtasks.exe
2280	schtasks.exe
4304	schtasks.exe
3388	schtasks.exe
4528	schtasks.exe
456	schtasks.exe
2228	schtasks.exe
3480	schtasks.exe
2484	schtasks.exe
2832	schtasks.exe
1912	schtasks.exe
3172	schtasks.exe
1608	schtasks.exe
3416	schtasks.exe
3372	schtasks.exe
5056	schtasks.exe
3712	schtasks.exe
4952	schtasks.exe
2292	schtasks.exe
4988	schtasks.exe
4324	schtasks.exe
3796	schtasks.exe
1128	schtasks.exe
4588	schtasks.exe
672	schtasks.exe
2232	schtasks.exe
3048	schtasks.exe
3928	schtasks.exe
4544	schtasks.exe
4684	schtasks.exe
2348	schtasks.exe
1236	schtasks.exe
948	schtasks.exe
2092	schtasks.exe
4956	schtasks.exe
2108	schtasks.exe
220	schtasks.exe
4980	schtasks.exe
2236	schtasks.exe
3344	schtasks.exe
2256	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	Nursultan.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
3212	blocksurrogate.exe
4360	blocksurrogate.exe
4360	blocksurrogate.exe
4360	blocksurrogate.exe
4360	blocksurrogate.exe
4360	blocksurrogate.exe
4360	blocksurrogate.exe
4360	blocksurrogate.exe
4360	blocksurrogate.exe
4360	blocksurrogate.exe
4360	blocksurrogate.exe
4360	blocksurrogate.exe
4360	blocksurrogate.exe
4360	blocksurrogate.exe
4360	blocksurrogate.exe
4360	blocksurrogate.exe
4360	blocksurrogate.exe
4360	blocksurrogate.exe
4360	blocksurrogate.exe
4360	blocksurrogate.exe
2636	StartMenuExperienceHost.exe
2636	StartMenuExperienceHost.exe
2636	StartMenuExperienceHost.exe
2636	StartMenuExperienceHost.exe
2636	StartMenuExperienceHost.exe
2636	StartMenuExperienceHost.exe
2636	StartMenuExperienceHost.exe
2636	StartMenuExperienceHost.exe
2636	StartMenuExperienceHost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2636	StartMenuExperienceHost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3212	blocksurrogate.exe
Token: SeDebugPrivilege	4360	blocksurrogate.exe
Token: SeDebugPrivilege	2636	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 4004	4136	Nursultan.exe	83
PID 4136 wrote to memory of 4004	4136	Nursultan.exe	83
PID 4136 wrote to memory of 4004	4136	Nursultan.exe	83
PID 4004 wrote to memory of 4380	4004	WScript.exe	92
PID 4004 wrote to memory of 4380	4004	WScript.exe	92
PID 4004 wrote to memory of 4380	4004	WScript.exe	92
PID 4380 wrote to memory of 3212	4380	cmd.exe	94
PID 4380 wrote to memory of 3212	4380	cmd.exe	94
PID 3212 wrote to memory of 4360	3212	blocksurrogate.exe	101
PID 3212 wrote to memory of 4360	3212	blocksurrogate.exe	101
PID 4360 wrote to memory of 2636	4360	blocksurrogate.exe	152
PID 4360 wrote to memory of 2636	4360	blocksurrogate.exe	152

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Nursultan.exe
"C:\Users\Admin\AppData\Local\Temp\Nursultan.exe"
1⤵
- DcRat
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ProviderInto\bg4vLJUaDkf5tC.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ProviderInto\NmoUHUSCIv.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4380
  - - C:\ProviderInto\blocksurrogate.exe
      "C:\ProviderInto\blocksurrogate.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3212
    - - C:\ProviderInto\blocksurrogate.exe
        
        "C:\ProviderInto\blocksurrogate.exe"
        5⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4360
      - C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
        
        "C:\Recovery\WindowsRE\StartMenuExperienceHost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Documents\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default\Documents\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Documents\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\cmd.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\Temp\Crashpad\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Temp\Crashpad\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\Temp\Crashpad\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Cookies\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Cookies\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Cookies\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Downloads\WaaSMedicAgent.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Users\Default\Downloads\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Downloads\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Windows\Performance\WinSAT\DataStore\TextInputHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\DataStore\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Windows\Performance\WinSAT\DataStore\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Favorites\TextInputHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Default\Favorites\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Favorites\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\ProviderInto\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\ProviderInto\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\ProviderInto\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 14 /tr "'C:\Program Files\Mozilla Firefox\uninstall\WaaSMedicAgent.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\uninstall\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 13 /tr "'C:\Program Files\Mozilla Firefox\uninstall\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\es-ES\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 11 /tr "'C:\ProviderInto\WaaSMedicAgent.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\ProviderInto\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 8 /tr "'C:\ProviderInto\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office\PackageManifests\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\PackageManifests\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office\PackageManifests\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NmoUHUSCIv.bat

Path C:\ProviderInto\NmoUHUSCIv.bat
Size 36B
SHA256 ea164f49511be36687b6c8aba7115701c6dd583f58589d948a72ea12de1c672e
MD5 f6f5d0c8f6feac0cb30c89fd1657cb64
SHA1 be50cec1500209cf68fe55f56b9dcc340546f454
SHA512 69a7947e16c893818a04887bf8b2e4a8cd22ad91ec9bfaa603c4eec99204c762d6d46493b0298520419f9818e2459ae372a8876b18f470b9138a1fb80f6ad258
MD5 SHA1 SHA512

Submit Download

bg4vLJUaDkf5tC.vbe

Path C:\ProviderInto\bg4vLJUaDkf5tC.vbe
Size 199B
SHA256 3478b04d7b9a3accf9d74e14f39493a5802938dbc774b2946a4c810ad3ee94af
MD5 7f1bd72e83931ae16e0939d3dbc24d5b
SHA1 8e4ebd32d84a2e9e415c86b82332cf467e8ff1ab
SHA512 d22cad0ce50bfd7fd81c9b067d8388765f51d3fbe406e9008cce04fd0863e591781f26b6259a4b5c528ece7696f7ce3997720961582143ec5627306cce48c57c
MD5 SHA1 SHA512

Submit Download

blocksurrogate.exe

Path C:\ProviderInto\blocksurrogate.exe
Size 1.3MB
SHA256 9de7ec4d1da007ad17d08ae860b474fec5ab46dd834584ba9fb36ff8a00b52f0
MD5 7ca99a0ca6db34fcfa842e5f6c203c94
SHA1 cf1a8e002cdd663e810281ff2b9093ddfa9527d0
SHA512 17ae7000770c2f2e7918fad9e202c033bcf3c92490ca04f955142abe164b0583ac22a3659f4dc120643df8c51a9d11b832071dfe66fe2032d6d778d3d4b53a33
SSDEEP 24576:RmpK3Xgjh1gMTVn/8E6Oqi4yEBCknTXCZ/UzGGq1lM/XP2YFnCZ2XKdf1et:0pKM+sHWyGXvAIbFCZ2XC1
MD5 SHA1 SHA512 SSDEEP

Submit Download

blocksurrogate.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\blocksurrogate.exe.log
Size 1KB
SHA256 eb70c64ae99d14ac2588b7a84854fbf3c420532d7fe4dfd49c7b5a70c869943a
MD5 bbb951a34b516b66451218a3ec3b0ae1
SHA1 7393835a2476ae655916e0a9687eeaba3ee876e9
SHA512 63bcbfcf8e7421c66855c487c31b2991a989bdea0c1edd4c40066b52fa3eb3d9d37db1cd21b8eb4f33dd5870cc20532c8f485eab9c0b4f6b0793a35c077f2d6f
MD5 SHA1 SHA512

Submit Download

memory/3212-15-0x000000001B490000-0x000000001B4E0000-memory.dmp

Download

memory/3212-14-0x0000000002390000-0x00000000023AC000-memory.dmp

Download

memory/3212-13-0x0000000000150000-0x00000000002AC000-memory.dmp

Download

memory/3212-16-0x0000000002520000-0x0000000002536000-memory.dmp

Download

memory/3212-17-0x0000000002370000-0x0000000002382000-memory.dmp

Download

memory/3212-18-0x000000001BB40000-0x000000001C068000-memory.dmp

Download

memory/3212-19-0x00000000023B0000-0x00000000023BE000-memory.dmp

Download

memory/3212-20-0x000000001B440000-0x000000001B44C000-memory.dmp

Download

memory/3212-12-0x00007FFAE4D13000-0x00007FFAE4D15000-memory.dmp

Download

memory/4360-28-0x0000000002A40000-0x0000000002A52000-memory.dmp

Download