dcrat | 1c1157e79cd0b4970829201f5ae02476eb20ed821af670004d8cea07f9fee77d

Analysis

max time kernel
153s
max time network
164s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
07/06/2024, 18:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
v2dc/123.exe
Size 1.2MB
Sample240607-w9d86sda34
SHA256 596be26e0d1db72ea7e9bc262390df67b0d096090dc11d134cf1f2af2e03dcb0
MD5 af1285ace59caeb75dd5dc3aaf7d80f1
SHA1 2984d4eef8d54e0c9c5d7c84af7c4cab1fe74f41
SHA512 1a42a8967dc6c0a6ab9a54e98392c5a02dab7184707ff7a43036877c4ce62b29a553637bbfab64f6316baf3c17cdbd2ec024b67d1bd09ca9173a8c6314e02680
SSDEEP 24576:32G/nvxW3Ww0t92L7cLU86oBqpddsq5DPJzPA:3bA30S7zo+ddsqY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat njrat piskosos evasion infostealer persistence rat trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

Piskosos

4.tcp.eu.ngrok.io:18895

Mutex

2a4acf48542c19bfacb0f6e95aab85b9

Attributes

reg_key
2a4acf48542c19bfacb0f6e95aab85b9
splitter
|'|'|

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 21 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4656	1412	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	828	1412	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3076	1412	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3624	1412	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4632	1412	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	1412	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4676	1412	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3168	1412	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4816	1412	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4124	1412	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3496	1412	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	1412	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4640	1412	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	1412	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3456	1412	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	1412	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	1412	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	1412	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3620	1412	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3228	1412	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8	1412	schtasks.exe	82

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000800000001aba6-8.dat	dcrat
behavioral1/memory/388-10-0x0000000000400000-0x0000000000532000-memory.dmp	dcrat
behavioral1/files/0x000800000001aba7-20.dat	dcrat
behavioral1/memory/1956-21-0x0000000000400000-0x0000000000526000-memory.dmp	dcrat
behavioral1/files/0x000700000001ad22-34.dat	dcrat
behavioral1/memory/1592-37-0x00000000008E0000-0x00000000009B6000-memory.dmp	dcrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
304	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2a4acf48542c19bfacb0f6e95aab85b9.exe	Google Chrome Update Service.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2a4acf48542c19bfacb0f6e95aab85b9.exe	Google Chrome Update Service.exe

Executes dropped EXE 6 IoCs

pid	Process
1444	Server.exe
1956	Result.bat
4796	123.bat
1592	ComSurrogateperf.exe
3804	unsecapp.exe
4596	Google Chrome Update Service.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Windows\CurrentVersion\Run\2a4acf48542c19bfacb0f6e95aab85b9 = "\"C:\\Users\\Admin\\Google Chrome Update Service.exe\" .."	Google Chrome Update Service.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\2a4acf48542c19bfacb0f6e95aab85b9 = "\"C:\\Users\\Admin\\Google Chrome Update Service.exe\" .."	Google Chrome Update Service.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
29	4.tcp.eu.ngrok.io
51	4.tcp.eu.ngrok.io
5	4.tcp.eu.ngrok.io

Drops autorun.inf file 1 TTPs 5 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\autorun.inf	Google Chrome Update Service.exe
File created	C:\autorun.inf	Google Chrome Update Service.exe
File opened for modification	C:\autorun.inf	Google Chrome Update Service.exe
File created	D:\autorun.inf	Google Chrome Update Service.exe
File created	F:\autorun.inf	Google Chrome Update Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Migration\WTR\conhost.exe	ComSurrogateperf.exe
File created	C:\Windows\Migration\WTR\088424020bedd6	ComSurrogateperf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
828	schtasks.exe
3168	schtasks.exe
4424	schtasks.exe
2480	schtasks.exe
3048	schtasks.exe
3076	schtasks.exe
2244	schtasks.exe
4816	schtasks.exe
3496	schtasks.exe
2932	schtasks.exe
3228	schtasks.exe
2060	schtasks.exe
4656	schtasks.exe
3624	schtasks.exe
4632	schtasks.exe
4676	schtasks.exe
4124	schtasks.exe
4640	schtasks.exe
3456	schtasks.exe
3620	schtasks.exe
8	schtasks.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2732	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings	123.bat

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1592	ComSurrogateperf.exe
1592	ComSurrogateperf.exe
1592	ComSurrogateperf.exe
1592	ComSurrogateperf.exe
1592	ComSurrogateperf.exe
1592	ComSurrogateperf.exe
1592	ComSurrogateperf.exe
3804	unsecapp.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe
4596	Google Chrome Update Service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4596	Google Chrome Update Service.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	1592	ComSurrogateperf.exe
Token: SeDebugPrivilege	3804	unsecapp.exe
Token: SeDebugPrivilege	4596	Google Chrome Update Service.exe
Token: SeDebugPrivilege	2732	taskkill.exe
Token: 33	4596	Google Chrome Update Service.exe
Token: SeIncBasePriorityPrivilege	4596	Google Chrome Update Service.exe
Token: 33	4596	Google Chrome Update Service.exe
Token: SeIncBasePriorityPrivilege	4596	Google Chrome Update Service.exe
Token: 33	4596	Google Chrome Update Service.exe
Token: SeIncBasePriorityPrivilege	4596	Google Chrome Update Service.exe
Token: 33	4596	Google Chrome Update Service.exe
Token: SeIncBasePriorityPrivilege	4596	Google Chrome Update Service.exe
Token: 33	4596	Google Chrome Update Service.exe
Token: SeIncBasePriorityPrivilege	4596	Google Chrome Update Service.exe
Token: 33	4596	Google Chrome Update Service.exe
Token: SeIncBasePriorityPrivilege	4596	Google Chrome Update Service.exe
Token: 33	4596	Google Chrome Update Service.exe
Token: SeIncBasePriorityPrivilege	4596	Google Chrome Update Service.exe
Token: 33	4596	Google Chrome Update Service.exe
Token: SeIncBasePriorityPrivilege	4596	Google Chrome Update Service.exe
Token: 33	4596	Google Chrome Update Service.exe
Token: SeIncBasePriorityPrivilege	4596	Google Chrome Update Service.exe
Token: 33	4596	Google Chrome Update Service.exe
Token: SeIncBasePriorityPrivilege	4596	Google Chrome Update Service.exe
Token: 33	4596	Google Chrome Update Service.exe
Token: SeIncBasePriorityPrivilege	4596	Google Chrome Update Service.exe
Token: 33	4596	Google Chrome Update Service.exe
Token: SeIncBasePriorityPrivilege	4596	Google Chrome Update Service.exe
Token: 33	4596	Google Chrome Update Service.exe
Token: SeIncBasePriorityPrivilege	4596	Google Chrome Update Service.exe
Token: 33	4596	Google Chrome Update Service.exe
Token: SeIncBasePriorityPrivilege	4596	Google Chrome Update Service.exe
Token: 33	4596	Google Chrome Update Service.exe
Token: SeIncBasePriorityPrivilege	4596	Google Chrome Update Service.exe
Token: 33	4596	Google Chrome Update Service.exe
Token: SeIncBasePriorityPrivilege	4596	Google Chrome Update Service.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 1444	388	123.exe	72
PID 388 wrote to memory of 1444	388	123.exe	72
PID 388 wrote to memory of 1444	388	123.exe	72
PID 388 wrote to memory of 1956	388	123.exe	73
PID 388 wrote to memory of 1956	388	123.exe	73
PID 388 wrote to memory of 1956	388	123.exe	73
PID 1956 wrote to memory of 3468	1956	Result.bat	74
PID 1956 wrote to memory of 3468	1956	Result.bat	74
PID 1956 wrote to memory of 3468	1956	Result.bat	74
PID 1956 wrote to memory of 4796	1956	Result.bat	76
PID 1956 wrote to memory of 4796	1956	Result.bat	76
PID 1956 wrote to memory of 4796	1956	Result.bat	76
PID 4796 wrote to memory of 4716	4796	123.bat	78
PID 4796 wrote to memory of 4716	4796	123.bat	78
PID 4796 wrote to memory of 4716	4796	123.bat	78
PID 4716 wrote to memory of 788	4716	WScript.exe	79
PID 4716 wrote to memory of 788	4716	WScript.exe	79
PID 4716 wrote to memory of 788	4716	WScript.exe	79
PID 788 wrote to memory of 1592	788	cmd.exe	81
PID 788 wrote to memory of 1592	788	cmd.exe	81
PID 1592 wrote to memory of 3804	1592	ComSurrogateperf.exe	104
PID 1592 wrote to memory of 3804	1592	ComSurrogateperf.exe	104
PID 1444 wrote to memory of 4596	1444	Server.exe	105
PID 1444 wrote to memory of 4596	1444	Server.exe	105
PID 1444 wrote to memory of 4596	1444	Server.exe	105
PID 4596 wrote to memory of 304	4596	Google Chrome Update Service.exe	106
PID 4596 wrote to memory of 304	4596	Google Chrome Update Service.exe	106
PID 4596 wrote to memory of 304	4596	Google Chrome Update Service.exe	106
PID 4596 wrote to memory of 2732	4596	Google Chrome Update Service.exe	108
PID 4596 wrote to memory of 2732	4596	Google Chrome Update Service.exe	108
PID 4596 wrote to memory of 2732	4596	Google Chrome Update Service.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\v2dc\123.exe
"C:\Users\Admin\AppData\Local\Temp\v2dc\123.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:388
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  "C:\Users\Admin\AppData\Local\Temp\Server.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Users\Admin\Google Chrome Update Service.exe
    "C:\Users\Admin\Google Chrome Update Service.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops autorun.inf file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\Google Chrome Update Service.exe" "Google Chrome Update Service.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:304
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM taskmgr.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2732
- C:\Users\Admin\AppData\Local\Temp\Result.bat
  "C:\Users\Admin\AppData\Local\Temp\Result.bat"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\123.bat" "
    3⤵
    PID:3468
- - C:\Users\Admin\AppData\Local\Temp\123.bat
    "C:\Users\Admin\AppData\Local\Temp\123.bat"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\chainbrowserDhcp\tIgTTExzXZkUXR.vbe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4716
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\chainbrowserDhcp\1JcS8lT1m5uQWJq3BPgILHLZUP4Xg.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:788
      - C:\chainbrowserDhcp\ComSurrogateperf.exe
        
        "C:\chainbrowserDhcp\ComSurrogateperf.exe"
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1592
        
        C:\Users\Default\Start Menu\unsecapp.exe
        
        "C:\Users\Default\Start Menu\unsecapp.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3804

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2bc
1⤵
PID:1308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ApplicationFrameHostA" /sc MINUTE /mo 7 /tr "'C:\chainbrowserDhcp\ApplicationFrameHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ApplicationFrameHost" /sc ONLOGON /tr "'C:\chainbrowserDhcp\ApplicationFrameHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ApplicationFrameHostA" /sc MINUTE /mo 10 /tr "'C:\chainbrowserDhcp\ApplicationFrameHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Desktop\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default\Desktop\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Desktop\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\All Users\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Windows\Migration\WTR\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Windows\Migration\WTR\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "InstallAgentI" /sc MINUTE /mo 7 /tr "'C:\chainbrowserDhcp\InstallAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "InstallAgent" /sc ONLOGON /tr "'C:\chainbrowserDhcp\InstallAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "InstallAgentI" /sc MINUTE /mo 10 /tr "'C:\chainbrowserDhcp\InstallAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Start Menu\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\Default\Start Menu\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Start Menu\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:8

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

123.bat

Path C:\Users\Admin\AppData\Local\Temp\123.bat
Size 1.1MB
SHA256 9b8ec8757d9293941711a7bed618c2bff68781d718b2c0f9c24c18e77f85d50b
MD5 a4e5a0ebceea813c990832fd018956d6
SHA1 66fe20d6279e356b31c878554758887eeb46fe9b
SHA512 9a6fec45f9047e52f6199346d6e02d603f33306061ac866bc445d0bdcd5eeb9fdc9ecd142c6954285748dc18bbfd33bb8d564595adfcf70f9219f8daef241121
SSDEEP 24576:U2G/nvxW3Ww0t92L7cLU86oBqpddsq5DPJzPH:UbA30S7zo+ddsq/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Result.bat

Path C:\Users\Admin\AppData\Local\Temp\Result.bat
Size 1.1MB
SHA256 d2d1206ae413f6f36cd8f64ae20316dad96d4cdbd0206f844017a070aa98fe2f
MD5 1f1462b7dd7b430cb96ee2f34685a3d2
SHA1 6b257e68cf20d1083c2dd7e70f23574c410df40b
SHA512 05dade2d260d3ec2a50af33956fd756dd7c2dc3edebf2bedecd076cc6da3108d32174510a29da65d373d86097e50cd9da6d02e15381c80e728b278e0324bff20
SSDEEP 24576:32G/nvxW3Ww0t92L7cLU86oBqpddsq5DPJzPS:3bA30S7zo+ddsqK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Server.exe

Path C:\Users\Admin\AppData\Local\Temp\Server.exe
Size 37KB
SHA256 c5e801de358cc8eded9b0b8dff4cbe94a331129b1c616d28d9f5fff90a6a9436
MD5 5fa099fd871e54c88ea71752b4aefc3c
SHA1 a3228e37bb3b340cacc66d6864969f86800dedbd
SHA512 9e5da7706a0798811ede100df662a9804680a77c9b22e93126b37938a743b9014c797bbbcc5bbae0d555c514e13340621c21e438d661ce380d87d99be9a8cddb
SSDEEP 384:RE4c6ibYnFLr557Jgyk/Rcovh24wz6vDrAF+rMRTyN/0L+EcoinblneHQM3epzX+:e4mOFnJbk/RcowBz6LrM+rMRa8Nut6t
MD5 SHA1 SHA512 SSDEEP

Submit Download

1JcS8lT1m5uQWJq3BPgILHLZUP4Xg.bat

Path C:\chainbrowserDhcp\1JcS8lT1m5uQWJq3BPgILHLZUP4Xg.bat
Size 42B
SHA256 2d4e1b122657d183cb75da725c16d61b77e19c1d8c4e0fbc153587df2c7a86f1
MD5 d3d6bad1e028b45afc998ac9e4d80792
SHA1 6363d7a70562f4b0253bc869ac31a3fefaccd2a4
SHA512 7be90921e44adc7ad86c0ce7cc721f529a635dfea55e09e999f3493aaebcf38eb30dd589f0d1f2e0754b0d7b8106b783891eda567ea5591c0d5435a77cd25dde
MD5 SHA1 SHA512

Submit Download

ComSurrogateperf.exe

Path C:\chainbrowserDhcp\ComSurrogateperf.exe
Size 828KB
SHA256 5246ca60c6d83c0760e836aa0821dc7ef99d977381d98ddef3f02e50151800ca
MD5 d36bf2320339fd2fdc4003b49c82003a
SHA1 95b79d547c20c70aa44e76fc848cdcf653dcf8d7
SHA512 125955eaa10ed844a8ce9e43780d70b719a08c983a29786674483805d7d70d23354fc13b705d94eb993198b12c7bb92674771a03d04330330ecd274d65a1324a
SSDEEP 12288:MxkL7cLUdM36oBq6yddsquMall8Fm4d4UJ6WP:M2L7cLU86oBqpddsq5DPJzP
MD5 SHA1 SHA512 SSDEEP

Submit Download

tIgTTExzXZkUXR.vbe

Path C:\chainbrowserDhcp\tIgTTExzXZkUXR.vbe
Size 222B
SHA256 e37057d3754d14998bf18895b83b157a536e9bc109242e3d9f62703badacf44a
MD5 8b11c6d4202f5e5465e7bc4f891b78b8
SHA1 407eee6dabf607a7737c8f029f21400633292398
SHA512 6b8b6f21f4296f8432c3002dbf2eaaeac247f7d9b7984de5c4ae629640949252fa29ef1e079c0e001c2f13752ed2214bfd9cbbe5db013e6ac5c576613a09e893
MD5 SHA1 SHA512

Submit Download

memory/388-10-0x0000000000400000-0x0000000000532000-memory.dmp

Download

memory/1444-13-0x0000000073F00000-0x00000000744B0000-memory.dmp

Download

memory/1444-16-0x0000000073F00000-0x00000000744B0000-memory.dmp

Download

memory/1444-12-0x0000000073F01000-0x0000000073F02000-memory.dmp

Download

memory/1444-64-0x0000000073F00000-0x00000000744B0000-memory.dmp

Download

memory/1592-37-0x00000000008E0000-0x00000000009B6000-memory.dmp

Download

memory/1956-21-0x0000000000400000-0x0000000000526000-memory.dmp

Download