dcrat | eb02a5967a610b6c1f6c4070426bfae82286404b0c12120c4538f6616046ac82

Analysis

max time kernel
193s
max time network
297s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 16:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Desktop.exe
Size 2.8MB
Sample240619-t2s19atdjb
SHA256 eb02a5967a610b6c1f6c4070426bfae82286404b0c12120c4538f6616046ac82
MD5 0eab9acd08b61cdf615cb068a37721ec
SHA1 abb40ff6143036f6fecf58c1ddcbb0db932d5c56
SHA512 9747726e1e384b82743cfe3e55d3da8b60451b7118b6f1b0e7403920e149e1836833f76367d591a5d31091366655b962919b16d03a9a8f4e65641ea320a96cef
SSDEEP 49152:lOtT5e0aSL6Z1zfbCW2aomgmFSD4HjLgfDFCfX9nViw3DNSV5F+5Q:lOtTU/SL41zfNgmFS8HjasftcwBg4Q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat 35 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		2076	schtasks.exe
		3560	schtasks.exe
		3528	schtasks.exe
		2784	schtasks.exe
		1868	schtasks.exe
		1044	schtasks.exe
		3636	schtasks.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation		Desktop.exe
		4592	schtasks.exe
		3492	schtasks.exe
		2764	schtasks.exe
		4224	schtasks.exe
		4620	schtasks.exe
		3680	schtasks.exe
		2504	schtasks.exe
		1916	schtasks.exe
		4112	schtasks.exe
		3688	schtasks.exe
		3840	schtasks.exe
		448	schtasks.exe
		1872	schtasks.exe
		2220	schtasks.exe
		2668	schtasks.exe
		4432	schtasks.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\5940a34987c991		bridgehypercom.exe
		4736	schtasks.exe
		4984	schtasks.exe
		3512	schtasks.exe
		1112	schtasks.exe
		4308	schtasks.exe
		3340	schtasks.exe
		3120	schtasks.exe
		1728	schtasks.exe
		2908	schtasks.exe
		1648	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 11 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\dllhost.exe\", \"C:\\Windows\\DiagTrack\\Settings\\MoUsoCoreWorker.exe\", \"C:\\Windows\\tracing\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\Autopilot\\sihost.exe\", \"C:\\Users\\Admin\\AppData\\LocalLow\\Adobe\\AcroCef\\dllhost.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\dllhost.exe\", \"C:\\Windows\\DiagTrack\\Settings\\MoUsoCoreWorker.exe\", \"C:\\Windows\\tracing\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\Autopilot\\sihost.exe\", \"C:\\Users\\Admin\\AppData\\LocalLow\\Adobe\\AcroCef\\dllhost.exe\", \"C:\\Windows\\Fonts\\dllhost.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\dllhost.exe\", \"C:\\Windows\\DiagTrack\\Settings\\MoUsoCoreWorker.exe\", \"C:\\Windows\\tracing\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\Autopilot\\sihost.exe\", \"C:\\Users\\Admin\\AppData\\LocalLow\\Adobe\\AcroCef\\dllhost.exe\", \"C:\\Windows\\Fonts\\dllhost.exe\", \"C:\\Windows\\twain_32\\csrss.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\dllhost.exe\", \"C:\\Windows\\DiagTrack\\Settings\\MoUsoCoreWorker.exe\", \"C:\\Windows\\tracing\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\Autopilot\\sihost.exe\", \"C:\\Users\\Admin\\AppData\\LocalLow\\Adobe\\AcroCef\\dllhost.exe\", \"C:\\Windows\\Fonts\\dllhost.exe\", \"C:\\Windows\\twain_32\\csrss.exe\", \"C:\\Program Files\\7-Zip\\Lang\\Idle.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\dllhost.exe\", \"C:\\Windows\\DiagTrack\\Settings\\MoUsoCoreWorker.exe\", \"C:\\Windows\\tracing\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\Autopilot\\sihost.exe\", \"C:\\Users\\Admin\\AppData\\LocalLow\\Adobe\\AcroCef\\dllhost.exe\", \"C:\\Windows\\Fonts\\dllhost.exe\", \"C:\\Windows\\twain_32\\csrss.exe\", \"C:\\Program Files\\7-Zip\\Lang\\Idle.exe\", \"C:\\Users\\Public\\Videos\\winlogon.exe\", \"C:\\Program Files\\Microsoft Office\\RuntimeBroker.exe\", \"C:\\blockComagentCommon\\taskhostw.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\dllhost.exe\", \"C:\\Windows\\DiagTrack\\Settings\\MoUsoCoreWorker.exe\", \"C:\\Windows\\tracing\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\Autopilot\\sihost.exe\", \"C:\\Users\\Admin\\AppData\\LocalLow\\Adobe\\AcroCef\\dllhost.exe\", \"C:\\Windows\\Fonts\\dllhost.exe\", \"C:\\Windows\\twain_32\\csrss.exe\", \"C:\\Program Files\\7-Zip\\Lang\\Idle.exe\", \"C:\\Users\\Public\\Videos\\winlogon.exe\", \"C:\\Program Files\\Microsoft Office\\RuntimeBroker.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\dllhost.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\dllhost.exe\", \"C:\\Windows\\DiagTrack\\Settings\\MoUsoCoreWorker.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\dllhost.exe\", \"C:\\Windows\\DiagTrack\\Settings\\MoUsoCoreWorker.exe\", \"C:\\Windows\\tracing\\RuntimeBroker.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\dllhost.exe\", \"C:\\Windows\\DiagTrack\\Settings\\MoUsoCoreWorker.exe\", \"C:\\Windows\\tracing\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\Autopilot\\sihost.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\dllhost.exe\", \"C:\\Windows\\DiagTrack\\Settings\\MoUsoCoreWorker.exe\", \"C:\\Windows\\tracing\\RuntimeBroker.exe\", \"C:\\Windows\\Provisioning\\Autopilot\\sihost.exe\", \"C:\\Users\\Admin\\AppData\\LocalLow\\Adobe\\AcroCef\\dllhost.exe\", \"C:\\Windows\\Fonts\\dllhost.exe\", \"C:\\Windows\\twain_32\\csrss.exe\", \"C:\\Program Files\\7-Zip\\Lang\\Idle.exe\", \"C:\\Users\\Public\\Videos\\winlogon.exe\""	bridgehypercom.exe

Process spawned unexpected child process 33 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4592	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1112	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4736	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4224	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3688	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3840	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4984	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3492	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3512	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1044	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	448	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3636	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3560	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3528	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3680	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4432	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3340	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3120	4352	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4112	4352	schtasks.exe	89

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023416-6.dat	dcrat
behavioral2/files/0x000700000002341c-23.dat	dcrat
behavioral2/memory/2204-25-0x0000000000D00000-0x0000000000E32000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	DCRatBuild_protected.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	bridgehypercom.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	Desktop.exe

Executes dropped EXE 3 IoCs

pid	Process
2176	DCRatBuild_protected.exe
2204	bridgehypercom.exe
756	dllhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\dllhost.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MoUsoCoreWorker = "\"C:\\Windows\\DiagTrack\\Settings\\MoUsoCoreWorker.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Windows\\Provisioning\\Autopilot\\sihost.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\Fonts\\dllhost.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Microsoft Office\\RuntimeBroker.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Windows\\Provisioning\\Autopilot\\sihost.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Admin\\AppData\\LocalLow\\Adobe\\AcroCef\\dllhost.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Public\\Videos\\winlogon.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\blockComagentCommon\\taskhostw.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\dllhost.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MoUsoCoreWorker = "\"C:\\Windows\\DiagTrack\\Settings\\MoUsoCoreWorker.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Admin\\AppData\\LocalLow\\Adobe\\AcroCef\\dllhost.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\Fonts\\dllhost.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\twain_32\\csrss.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\7-Zip\\Lang\\Idle.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Microsoft Office\\RuntimeBroker.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\tracing\\RuntimeBroker.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\tracing\\RuntimeBroker.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\twain_32\\csrss.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\7-Zip\\Lang\\Idle.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Public\\Videos\\winlogon.exe\""	bridgehypercom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\blockComagentCommon\\taskhostw.exe\""	bridgehypercom.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2176	DCRatBuild_protected.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\9e8d7a4ca61bd9	bridgehypercom.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\dllhost.exe	bridgehypercom.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\dllhost.exe	bridgehypercom.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\5940a34987c991	bridgehypercom.exe
File created	C:\Program Files\7-Zip\Lang\Idle.exe	bridgehypercom.exe
File created	C:\Program Files\7-Zip\Lang\6ccacd8608530f	bridgehypercom.exe
File created	C:\Program Files\Microsoft Office\RuntimeBroker.exe	bridgehypercom.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\DiagTrack\Settings\1f93f77a7f4778	bridgehypercom.exe
File created	C:\Windows\tracing\9e8d7a4ca61bd9	bridgehypercom.exe
File created	C:\Windows\Provisioning\Autopilot\sihost.exe	bridgehypercom.exe
File created	C:\Windows\Provisioning\Autopilot\66fc9ff0ee96c2	bridgehypercom.exe
File created	C:\Windows\Fonts\dllhost.exe	bridgehypercom.exe
File created	C:\Windows\twain_32\csrss.exe	bridgehypercom.exe
File created	C:\Windows\DiagTrack\Settings\MoUsoCoreWorker.exe	bridgehypercom.exe
File created	C:\Windows\servicing\Sessions\TiWorker.exe	bridgehypercom.exe
File created	C:\Windows\tracing\RuntimeBroker.exe	bridgehypercom.exe
File created	C:\Windows\Fonts\5940a34987c991	bridgehypercom.exe
File created	C:\Windows\twain_32\886983d96e3d3e	bridgehypercom.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings	DCRatBuild_protected.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1112	schtasks.exe
3688	schtasks.exe
448	schtasks.exe
2076	schtasks.exe
1916	schtasks.exe
1868	schtasks.exe
4224	schtasks.exe
4984	schtasks.exe
1044	schtasks.exe
1872	schtasks.exe
3528	schtasks.exe
4112	schtasks.exe
4736	schtasks.exe
4620	schtasks.exe
3636	schtasks.exe
4308	schtasks.exe
2908	schtasks.exe
3560	schtasks.exe
2668	schtasks.exe
3680	schtasks.exe
2784	schtasks.exe
3840	schtasks.exe
1728	schtasks.exe
3512	schtasks.exe
2504	schtasks.exe
4432	schtasks.exe
3340	schtasks.exe
3492	schtasks.exe
2220	schtasks.exe
2764	schtasks.exe
1648	schtasks.exe
3120	schtasks.exe
4592	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
2204	bridgehypercom.exe
2204	bridgehypercom.exe
2204	bridgehypercom.exe
2204	bridgehypercom.exe
2204	bridgehypercom.exe
2204	bridgehypercom.exe
2204	bridgehypercom.exe
2204	bridgehypercom.exe
2204	bridgehypercom.exe
2204	bridgehypercom.exe
2204	bridgehypercom.exe
2204	bridgehypercom.exe
756	dllhost.exe
756	dllhost.exe
756	dllhost.exe
756	dllhost.exe
756	dllhost.exe
756	dllhost.exe
756	dllhost.exe
756	dllhost.exe
756	dllhost.exe
756	dllhost.exe
756	dllhost.exe
756	dllhost.exe
756	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
756	dllhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2204	bridgehypercom.exe
Token: SeDebugPrivilege	756	dllhost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2176	DCRatBuild_protected.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2176	2964	Desktop.exe	98
PID 2964 wrote to memory of 2176	2964	Desktop.exe	98
PID 2964 wrote to memory of 2176	2964	Desktop.exe	98
PID 2176 wrote to memory of 1108	2176	DCRatBuild_protected.exe	100
PID 2176 wrote to memory of 1108	2176	DCRatBuild_protected.exe	100
PID 2176 wrote to memory of 1108	2176	DCRatBuild_protected.exe	100
PID 1108 wrote to memory of 1212	1108	WScript.exe	101
PID 1108 wrote to memory of 1212	1108	WScript.exe	101
PID 1108 wrote to memory of 1212	1108	WScript.exe	101
PID 1212 wrote to memory of 2204	1212	cmd.exe	103
PID 1212 wrote to memory of 2204	1212	cmd.exe	103
PID 2204 wrote to memory of 756	2204	bridgehypercom.exe	137
PID 2204 wrote to memory of 756	2204	bridgehypercom.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Desktop.exe
"C:\Users\Admin\AppData\Local\Temp\Desktop.exe"
1⤵
- DcRat
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.exe
  "C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\blockComagentCommon\XXy2W.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\blockComagentCommon\0xQrS65tkQIWur3PmtNOw.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1212
    - - C:\blockComagentCommon\bridgehypercom.exe
        
        "C:\blockComagentCommon\bridgehypercom.exe"
        5⤵
        DcRat
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2204
      - C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\dllhost.exe
        
        "C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\dllhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 12 /tr "'C:\Windows\DiagTrack\Settings\MoUsoCoreWorker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\Windows\DiagTrack\Settings\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 10 /tr "'C:\Windows\DiagTrack\Settings\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\tracing\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\tracing\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\tracing\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Windows\Provisioning\Autopilot\sihost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\Provisioning\Autopilot\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Windows\Provisioning\Autopilot\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Windows\Fonts\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Fonts\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\Fonts\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows\twain_32\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\twain_32\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\twain_32\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files\7-Zip\Lang\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files\7-Zip\Lang\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Videos\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Public\Videos\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Videos\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\blockComagentCommon\taskhostw.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\blockComagentCommon\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\blockComagentCommon\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DCRatBuild_protected.exe

Path C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.exe
Size 2.5MB
SHA256 18fdd096e9679a79cd0bd34094861950354f8e26d890458ecc944aab966c2473
MD5 64ed6494574d0ba822e98074dabda896
SHA1 6e845b1a861ca646e3313376bf87c429f84a991e
SHA512 5f67126746c522e2d73dccf194aa04eb3a5a896a9e7ea69cfe263dc8eaf05c5685353b02c06b7609456bc81ce580b8eaa16b4393632f74fbe93b1afae66928b9
SSDEEP 49152:bQ9bxrWULR9VhvVgUT70Ak7sxvfQ3cX8ElfM:bQhVvDnVvXlAC9sElfM
MD5 SHA1 SHA512 SSDEEP

Submit Download

0xQrS65tkQIWur3PmtNOw.bat

Path C:\blockComagentCommon\0xQrS65tkQIWur3PmtNOw.bat
Size 54B
SHA256 cc2d6e7836cc1772f50b3b10b0514139b5ecd5d3270607b60a1713b383f3c03f
MD5 ec36e67c09c4a57473bdb8237c55d18b
SHA1 03793c2750fca27259996873fb22c26ce8868cd1
SHA512 97bbdc60b22d2710a8b63108b544db7cb0c5da995334ad44ee347dbb84e0482e42ccee1d6881eec61cf6648e5c1e950450e828af85ffeed40b7778c26c1cf52c
MD5 SHA1 SHA512

Submit Download

XXy2W.vbe

Path C:\blockComagentCommon\XXy2W.vbe
Size 228B
SHA256 b482dc0529de14c5771702f8b4bdcc5a256c26611a84b569e4a997b466637b0d
MD5 ee52ea71feea8207e6afa75e86438d08
SHA1 8c833feedc8ac64a1424e663eb3dbb2013ba6142
SHA512 b09342f5caa69c1bf9481d9fc2284379626f6d2c3131d763d3a2198ccb0ddc5caf3a4f464a150cd9b0ebfc9b9c7aa1689af9000e14eaace36fe5247152ebc1c4
MD5 SHA1 SHA512

Submit Download

bridgehypercom.exe

Path C:\blockComagentCommon\bridgehypercom.exe
Size 1.2MB
SHA256 c093b10412252d75b8da533e378a0766d7e7db00db41d5c0f4794ed0ef95a863
MD5 33776154d16b2ab16c0dc64063eecab0
SHA1 3a28e93ed82b8cc4081ec29abbb83fa35c25d9f4
SHA512 2c67ca3b79deb45ed0917390c2c226dc804ebd6548b2feff38457161312561cad8e7729796053269ce24d9f08ac25cfe6aaff82efd1c7e2766158eb732ec2869
SSDEEP 12288:yFV+rxc8woTS6nKU6+/JicEGBABCOCS3zunENt2T7So0C8pi4L2v1KRCEFmw8:y6rxnwoHnf6YkBCY3CE63SjC8ElvCmR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2176-11-0x0000000000630000-0x0000000000A32000-memory.dmp

Download

memory/2176-19-0x0000000000630000-0x0000000000A32000-memory.dmp

Download

memory/2204-25-0x0000000000D00000-0x0000000000E32000-memory.dmp

Download

memory/2204-26-0x0000000003170000-0x000000000318C000-memory.dmp

Download

memory/2204-27-0x000000001C130000-0x000000001C180000-memory.dmp

Download

memory/2204-28-0x000000001BA60000-0x000000001BA76000-memory.dmp

Download

memory/2204-29-0x000000001BA80000-0x000000001BA8C000-memory.dmp

Download