dcrat | 596be26e0d1db72ea7e9bc262390df67b0d096090dc11d134cf1f2af2e03dcb0

Analysis

max time kernel
120s
max time network
120s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
07/06/2024, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
123.exe
Size 1.2MB
Sample240607-v7jkfabe4x
SHA256 596be26e0d1db72ea7e9bc262390df67b0d096090dc11d134cf1f2af2e03dcb0
MD5 af1285ace59caeb75dd5dc3aaf7d80f1
SHA1 2984d4eef8d54e0c9c5d7c84af7c4cab1fe74f41
SHA512 1a42a8967dc6c0a6ab9a54e98392c5a02dab7184707ff7a43036877c4ce62b29a553637bbfab64f6316baf3c17cdbd2ec024b67d1bd09ca9173a8c6314e02680
SSDEEP 24576:32G/nvxW3Ww0t92L7cLU86oBqpddsq5DPJzPA:3bA30S7zo+ddsqY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat njrat piskosos evasion infostealer persistence rat trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

Piskosos

4.tcp.eu.ngrok.io:18895

Mutex

2a4acf48542c19bfacb0f6e95aab85b9

Attributes

reg_key
2a4acf48542c19bfacb0f6e95aab85b9
splitter
|'|'|

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4184	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1468	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	880	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	712	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4608	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4696	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3276	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5012	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5104	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3076	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4676	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	604	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4312	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	920	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4352	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3336	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4504	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4744	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1412	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4576	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	972	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	972	schtasks.exe	82

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000800000001ac3b-8.dat	dcrat
behavioral1/memory/4240-9-0x0000000000400000-0x0000000000532000-memory.dmp	dcrat
behavioral1/files/0x000700000001ac3c-20.dat	dcrat
behavioral1/memory/756-23-0x0000000000400000-0x0000000000526000-memory.dmp	dcrat
behavioral1/files/0x000700000001ac3f-37.dat	dcrat
behavioral1/memory/1584-39-0x0000000000A70000-0x0000000000B46000-memory.dmp	dcrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1328	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2a4acf48542c19bfacb0f6e95aab85b9.exe	Google Chrome Update Service.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2a4acf48542c19bfacb0f6e95aab85b9.exe	Google Chrome Update Service.exe

Executes dropped EXE 6 IoCs

pid	Process
3888	Server.exe
756	Result.bat
2732	123.bat
1584	ComSurrogateperf.exe
2432	RuntimeBroker.exe
1908	Google Chrome Update Service.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Run\2a4acf48542c19bfacb0f6e95aab85b9 = "\"C:\\Users\\Admin\\Google Chrome Update Service.exe\" .."	Google Chrome Update Service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\2a4acf48542c19bfacb0f6e95aab85b9 = "\"C:\\Users\\Admin\\Google Chrome Update Service.exe\" .."	Google Chrome Update Service.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
9	4.tcp.eu.ngrok.io
23	4.tcp.eu.ngrok.io
4	4.tcp.eu.ngrok.io

Drops autorun.inf file 1 TTPs 5 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	D:\autorun.inf	Google Chrome Update Service.exe
File created	F:\autorun.inf	Google Chrome Update Service.exe
File opened for modification	F:\autorun.inf	Google Chrome Update Service.exe
File created	C:\autorun.inf	Google Chrome Update Service.exe
File opened for modification	C:\autorun.inf	Google Chrome Update Service.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\f8c8f1285d826b	ComSurrogateperf.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\RuntimeBroker.exe	ComSurrogateperf.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\RuntimeBroker.exe	ComSurrogateperf.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\9e8d7a4ca61bd9	ComSurrogateperf.exe
File created	C:\Program Files (x86)\Internet Explorer\fr-FR\sysmon.exe	ComSurrogateperf.exe
File created	C:\Program Files (x86)\Internet Explorer\fr-FR\121e5b5079f7c0	ComSurrogateperf.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ShellExperienceHost.exe	ComSurrogateperf.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SchCache\taskhostw.exe	ComSurrogateperf.exe
File created	C:\Windows\SchCache\ea9f0e6c9e2dcd	ComSurrogateperf.exe
File created	C:\Windows\Prefetch\ReadyBoot\sppsvc.exe	ComSurrogateperf.exe
File created	C:\Windows\Prefetch\ReadyBoot\0a1fd5f707cd16	ComSurrogateperf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4184	schtasks.exe
4696	schtasks.exe
3276	schtasks.exe
5104	schtasks.exe
2428	schtasks.exe
4480	schtasks.exe
2668	schtasks.exe
712	schtasks.exe
5012	schtasks.exe
2568	schtasks.exe
1468	schtasks.exe
2320	schtasks.exe
3076	schtasks.exe
4676	schtasks.exe
1412	schtasks.exe
2116	schtasks.exe
604	schtasks.exe
4744	schtasks.exe
4576	schtasks.exe
2500	schtasks.exe
4308	schtasks.exe
920	schtasks.exe
3336	schtasks.exe
4608	schtasks.exe
4504	schtasks.exe
2204	schtasks.exe
4512	schtasks.exe
880	schtasks.exe
4312	schtasks.exe
4352	schtasks.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1896	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings	123.bat

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1584	ComSurrogateperf.exe
1584	ComSurrogateperf.exe
1584	ComSurrogateperf.exe
2432	RuntimeBroker.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe
1908	Google Chrome Update Service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1908	Google Chrome Update Service.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: 33	4336	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4336	AUDIODG.EXE
Token: SeDebugPrivilege	1584	ComSurrogateperf.exe
Token: SeDebugPrivilege	2432	RuntimeBroker.exe
Token: SeDebugPrivilege	1908	Google Chrome Update Service.exe
Token: SeDebugPrivilege	1896	taskkill.exe
Token: 33	1908	Google Chrome Update Service.exe
Token: SeIncBasePriorityPrivilege	1908	Google Chrome Update Service.exe
Token: 33	1908	Google Chrome Update Service.exe
Token: SeIncBasePriorityPrivilege	1908	Google Chrome Update Service.exe
Token: 33	1908	Google Chrome Update Service.exe
Token: SeIncBasePriorityPrivilege	1908	Google Chrome Update Service.exe
Token: 33	1908	Google Chrome Update Service.exe
Token: SeIncBasePriorityPrivilege	1908	Google Chrome Update Service.exe
Token: 33	1908	Google Chrome Update Service.exe
Token: SeIncBasePriorityPrivilege	1908	Google Chrome Update Service.exe
Token: 33	1908	Google Chrome Update Service.exe
Token: SeIncBasePriorityPrivilege	1908	Google Chrome Update Service.exe
Token: 33	1908	Google Chrome Update Service.exe
Token: SeIncBasePriorityPrivilege	1908	Google Chrome Update Service.exe
Token: 33	1908	Google Chrome Update Service.exe
Token: SeIncBasePriorityPrivilege	1908	Google Chrome Update Service.exe
Token: 33	1908	Google Chrome Update Service.exe
Token: SeIncBasePriorityPrivilege	1908	Google Chrome Update Service.exe
Token: 33	1908	Google Chrome Update Service.exe
Token: SeIncBasePriorityPrivilege	1908	Google Chrome Update Service.exe
Token: 33	1908	Google Chrome Update Service.exe
Token: SeIncBasePriorityPrivilege	1908	Google Chrome Update Service.exe
Token: 33	1908	Google Chrome Update Service.exe
Token: SeIncBasePriorityPrivilege	1908	Google Chrome Update Service.exe
Token: 33	1908	Google Chrome Update Service.exe
Token: SeIncBasePriorityPrivilege	1908	Google Chrome Update Service.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 3888	4240	123.exe	72
PID 4240 wrote to memory of 3888	4240	123.exe	72
PID 4240 wrote to memory of 3888	4240	123.exe	72
PID 4240 wrote to memory of 756	4240	123.exe	73
PID 4240 wrote to memory of 756	4240	123.exe	73
PID 4240 wrote to memory of 756	4240	123.exe	73
PID 756 wrote to memory of 4408	756	Result.bat	74
PID 756 wrote to memory of 4408	756	Result.bat	74
PID 756 wrote to memory of 4408	756	Result.bat	74
PID 756 wrote to memory of 2732	756	Result.bat	76
PID 756 wrote to memory of 2732	756	Result.bat	76
PID 756 wrote to memory of 2732	756	Result.bat	76
PID 2732 wrote to memory of 656	2732	123.bat	78
PID 2732 wrote to memory of 656	2732	123.bat	78
PID 2732 wrote to memory of 656	2732	123.bat	78
PID 656 wrote to memory of 4008	656	WScript.exe	79
PID 656 wrote to memory of 4008	656	WScript.exe	79
PID 656 wrote to memory of 4008	656	WScript.exe	79
PID 4008 wrote to memory of 1584	4008	cmd.exe	81
PID 4008 wrote to memory of 1584	4008	cmd.exe	81
PID 1584 wrote to memory of 2432	1584	ComSurrogateperf.exe	113
PID 1584 wrote to memory of 2432	1584	ComSurrogateperf.exe	113
PID 3888 wrote to memory of 1908	3888	Server.exe	114
PID 3888 wrote to memory of 1908	3888	Server.exe	114
PID 3888 wrote to memory of 1908	3888	Server.exe	114
PID 1908 wrote to memory of 1328	1908	Google Chrome Update Service.exe	115
PID 1908 wrote to memory of 1328	1908	Google Chrome Update Service.exe	115
PID 1908 wrote to memory of 1328	1908	Google Chrome Update Service.exe	115
PID 1908 wrote to memory of 1896	1908	Google Chrome Update Service.exe	117
PID 1908 wrote to memory of 1896	1908	Google Chrome Update Service.exe	117
PID 1908 wrote to memory of 1896	1908	Google Chrome Update Service.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\123.exe
"C:\Users\Admin\AppData\Local\Temp\123.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  "C:\Users\Admin\AppData\Local\Temp\Server.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3888
- - C:\Users\Admin\Google Chrome Update Service.exe
    "C:\Users\Admin\Google Chrome Update Service.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops autorun.inf file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1908
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\Google Chrome Update Service.exe" "Google Chrome Update Service.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:1328
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM taskmgr.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1896
- C:\Users\Admin\AppData\Local\Temp\Result.bat
  "C:\Users\Admin\AppData\Local\Temp\Result.bat"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\123.bat" "
    3⤵
    PID:4408
- - C:\Users\Admin\AppData\Local\Temp\123.bat
    "C:\Users\Admin\AppData\Local\Temp\123.bat"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\chainbrowserDhcp\tIgTTExzXZkUXR.vbe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:656
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\chainbrowserDhcp\1JcS8lT1m5uQWJq3BPgILHLZUP4Xg.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4008
      - C:\chainbrowserDhcp\ComSurrogateperf.exe
        
        "C:\chainbrowserDhcp\ComSurrogateperf.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1584
        
        C:\Users\Default User\RuntimeBroker.exe
        
        "C:\Users\Default User\RuntimeBroker.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2432

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x398
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Windows\SchCache\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\SchCache\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Windows\SchCache\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Windows\Prefetch\ReadyBoot\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Windows\Prefetch\ReadyBoot\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ApplicationFrameHostA" /sc MINUTE /mo 10 /tr "'C:\chainbrowserDhcp\ApplicationFrameHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ApplicationFrameHost" /sc ONLOGON /tr "'C:\chainbrowserDhcp\ApplicationFrameHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ApplicationFrameHostA" /sc MINUTE /mo 6 /tr "'C:\chainbrowserDhcp\ApplicationFrameHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\chainbrowserDhcp\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\chainbrowserDhcp\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\chainbrowserDhcp\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Users\Default\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Users\Default\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ShellExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

123.bat

Path C:\Users\Admin\AppData\Local\Temp\123.bat
Size 1.1MB
SHA256 9b8ec8757d9293941711a7bed618c2bff68781d718b2c0f9c24c18e77f85d50b
MD5 a4e5a0ebceea813c990832fd018956d6
SHA1 66fe20d6279e356b31c878554758887eeb46fe9b
SHA512 9a6fec45f9047e52f6199346d6e02d603f33306061ac866bc445d0bdcd5eeb9fdc9ecd142c6954285748dc18bbfd33bb8d564595adfcf70f9219f8daef241121
SSDEEP 24576:U2G/nvxW3Ww0t92L7cLU86oBqpddsq5DPJzPH:UbA30S7zo+ddsq/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Result.bat

Path C:\Users\Admin\AppData\Local\Temp\Result.bat
Size 1.1MB
SHA256 d2d1206ae413f6f36cd8f64ae20316dad96d4cdbd0206f844017a070aa98fe2f
MD5 1f1462b7dd7b430cb96ee2f34685a3d2
SHA1 6b257e68cf20d1083c2dd7e70f23574c410df40b
SHA512 05dade2d260d3ec2a50af33956fd756dd7c2dc3edebf2bedecd076cc6da3108d32174510a29da65d373d86097e50cd9da6d02e15381c80e728b278e0324bff20
SSDEEP 24576:32G/nvxW3Ww0t92L7cLU86oBqpddsq5DPJzPS:3bA30S7zo+ddsqK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Users\Admin\AppData\Local\Temp\Server.exe
Size 37KB
SHA256 c5e801de358cc8eded9b0b8dff4cbe94a331129b1c616d28d9f5fff90a6a9436
MD5 5fa099fd871e54c88ea71752b4aefc3c
SHA1 a3228e37bb3b340cacc66d6864969f86800dedbd
SHA512 9e5da7706a0798811ede100df662a9804680a77c9b22e93126b37938a743b9014c797bbbcc5bbae0d555c514e13340621c21e438d661ce380d87d99be9a8cddb
SSDEEP 384:RE4c6ibYnFLr557Jgyk/Rcovh24wz6vDrAF+rMRTyN/0L+EcoinblneHQM3epzX+:e4mOFnJbk/RcowBz6LrM+rMRa8Nut6t
MD5 SHA1 SHA512 SSDEEP

Submit Download

1JcS8lT1m5uQWJq3BPgILHLZUP4Xg.bat

Path C:\chainbrowserDhcp\1JcS8lT1m5uQWJq3BPgILHLZUP4Xg.bat
Size 42B
SHA256 2d4e1b122657d183cb75da725c16d61b77e19c1d8c4e0fbc153587df2c7a86f1
MD5 d3d6bad1e028b45afc998ac9e4d80792
SHA1 6363d7a70562f4b0253bc869ac31a3fefaccd2a4
SHA512 7be90921e44adc7ad86c0ce7cc721f529a635dfea55e09e999f3493aaebcf38eb30dd589f0d1f2e0754b0d7b8106b783891eda567ea5591c0d5435a77cd25dde
MD5 SHA1 SHA512

Submit Download

ComSurrogateperf.exe

Path C:\chainbrowserDhcp\ComSurrogateperf.exe
Size 828KB
SHA256 5246ca60c6d83c0760e836aa0821dc7ef99d977381d98ddef3f02e50151800ca
MD5 d36bf2320339fd2fdc4003b49c82003a
SHA1 95b79d547c20c70aa44e76fc848cdcf653dcf8d7
SHA512 125955eaa10ed844a8ce9e43780d70b719a08c983a29786674483805d7d70d23354fc13b705d94eb993198b12c7bb92674771a03d04330330ecd274d65a1324a
SSDEEP 12288:MxkL7cLUdM36oBq6yddsquMall8Fm4d4UJ6WP:M2L7cLU86oBqpddsq5DPJzP
MD5 SHA1 SHA512 SSDEEP

Submit Download

tIgTTExzXZkUXR.vbe

Path C:\chainbrowserDhcp\tIgTTExzXZkUXR.vbe
Size 222B
SHA256 e37057d3754d14998bf18895b83b157a536e9bc109242e3d9f62703badacf44a
MD5 8b11c6d4202f5e5465e7bc4f891b78b8
SHA1 407eee6dabf607a7737c8f029f21400633292398
SHA512 6b8b6f21f4296f8432c3002dbf2eaaeac247f7d9b7984de5c4ae629640949252fa29ef1e079c0e001c2f13752ed2214bfd9cbbe5db013e6ac5c576613a09e893
MD5 SHA1 SHA512

Submit Download

memory/756-23-0x0000000000400000-0x0000000000526000-memory.dmp

Download

memory/1584-39-0x0000000000A70000-0x0000000000B46000-memory.dmp

Download

memory/3888-13-0x00000000734A0000-0x0000000073A50000-memory.dmp

Download

memory/3888-16-0x00000000734A0000-0x0000000073A50000-memory.dmp

Download

memory/3888-12-0x00000000734A1000-0x00000000734A2000-memory.dmp

Download

memory/3888-72-0x00000000734A0000-0x0000000073A50000-memory.dmp

Download

memory/4240-9-0x0000000000400000-0x0000000000532000-memory.dmp

Download