Malware Analysis Report

2024-10-10 13:07

Sample ID 240619-t5m96stdqg
Target Desktop.exe
SHA256 d9312c235d45c023d09e60464da291fe362ce2618b4205e19edc52625652fae9
Tags
dcrat infostealer persistence rat spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d9312c235d45c023d09e60464da291fe362ce2618b4205e19edc52625652fae9

Threat Level: Known bad

The file Desktop.exe was found to be: Known bad.

Malicious Activity Summary

dcrat infostealer persistence rat spyware stealer

DcRat

Modifies WinLogon for persistence

Process spawned unexpected child process

DCRat payload

Executes dropped EXE

Reads user/profile data of web browsers

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Suspicious use of SetWindowsHookEx

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Scheduled Task/Job: Scheduled Task

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-19 16:38

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-19 16:38

Reported

2024-06-19 16:48

Platform

win7-20240221-en

Max time kernel

566s

Max time network

598s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Desktop.exe"

Signatures

DcRat

rat infostealer dcrat
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
File created C:\Program Files\Windows NT\TableTextService\it-IT\cmd.exe C:\blockComagentCommon\bridgehypercom.exe N/A
File created C:\Program Files\Windows NT\TableTextService\it-IT\ebf1f9fa8afd6d C:\blockComagentCommon\bridgehypercom.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\TableTextService\\it-IT\\cmd.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\TableTextService\\it-IT\\cmd.exe\", \"C:\\Recovery\\5b7985c2-d100-11ee-bb00-c695cbc44580\\csrss.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\TableTextService\\it-IT\\cmd.exe\", \"C:\\Recovery\\5b7985c2-d100-11ee-bb00-c695cbc44580\\csrss.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\csrss.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\TableTextService\\it-IT\\cmd.exe\", \"C:\\Recovery\\5b7985c2-d100-11ee-bb00-c695cbc44580\\csrss.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\csrss.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\ja\\lsm.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files\\Windows NT\\TableTextService\\it-IT\\cmd.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files\\Windows NT\\TableTextService\\it-IT\\cmd.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\5b7985c2-d100-11ee-bb00-c695cbc44580\\csrss.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\5b7985c2-d100-11ee-bb00-c695cbc44580\\csrss.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\csrss.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\csrss.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\ja\\lsm.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\ja\\lsm.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\886983d96e3d3e C:\blockComagentCommon\bridgehypercom.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\lsm.exe C:\blockComagentCommon\bridgehypercom.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\101b941d020240 C:\blockComagentCommon\bridgehypercom.exe N/A
File created C:\Program Files\Windows NT\TableTextService\it-IT\cmd.exe C:\blockComagentCommon\bridgehypercom.exe N/A
File opened for modification C:\Program Files\Windows NT\TableTextService\it-IT\cmd.exe C:\blockComagentCommon\bridgehypercom.exe N/A
File created C:\Program Files\Windows NT\TableTextService\it-IT\ebf1f9fa8afd6d C:\blockComagentCommon\bridgehypercom.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe C:\blockComagentCommon\bridgehypercom.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\blockComagentCommon\bridgehypercom.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Windows NT\TableTextService\it-IT\cmd.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Windows NT\TableTextService\it-IT\cmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2524 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\Desktop.exe C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.sfx.exe
PID 2524 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\Desktop.exe C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.sfx.exe
PID 2524 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\Desktop.exe C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.sfx.exe
PID 2524 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\Desktop.exe C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.sfx.exe
PID 2100 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.sfx.exe C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.exe
PID 2100 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.sfx.exe C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.exe
PID 2100 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.sfx.exe C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.exe
PID 2100 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.sfx.exe C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.exe
PID 2024 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.exe C:\Windows\SysWOW64\WScript.exe
PID 2024 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.exe C:\Windows\SysWOW64\WScript.exe
PID 2024 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.exe C:\Windows\SysWOW64\WScript.exe
PID 2024 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.exe C:\Windows\SysWOW64\WScript.exe
PID 2604 wrote to memory of 2512 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2604 wrote to memory of 2512 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2604 wrote to memory of 2512 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2604 wrote to memory of 2512 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2512 wrote to memory of 2904 N/A C:\Windows\SysWOW64\cmd.exe C:\blockComagentCommon\bridgehypercom.exe
PID 2512 wrote to memory of 2904 N/A C:\Windows\SysWOW64\cmd.exe C:\blockComagentCommon\bridgehypercom.exe
PID 2512 wrote to memory of 2904 N/A C:\Windows\SysWOW64\cmd.exe C:\blockComagentCommon\bridgehypercom.exe
PID 2512 wrote to memory of 2904 N/A C:\Windows\SysWOW64\cmd.exe C:\blockComagentCommon\bridgehypercom.exe
PID 2904 wrote to memory of 2036 N/A C:\blockComagentCommon\bridgehypercom.exe C:\Windows\System32\cmd.exe
PID 2904 wrote to memory of 2036 N/A C:\blockComagentCommon\bridgehypercom.exe C:\Windows\System32\cmd.exe
PID 2904 wrote to memory of 2036 N/A C:\blockComagentCommon\bridgehypercom.exe C:\Windows\System32\cmd.exe
PID 2036 wrote to memory of 1972 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2036 wrote to memory of 1972 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2036 wrote to memory of 1972 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2036 wrote to memory of 2260 N/A C:\Windows\System32\cmd.exe C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe
PID 2036 wrote to memory of 2260 N/A C:\Windows\System32\cmd.exe C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe
PID 2036 wrote to memory of 2260 N/A C:\Windows\System32\cmd.exe C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe
PID 1952 wrote to memory of 956 N/A C:\Windows\system32\taskeng.exe C:\Program Files\Windows NT\TableTextService\it-IT\cmd.exe
PID 1952 wrote to memory of 956 N/A C:\Windows\system32\taskeng.exe C:\Program Files\Windows NT\TableTextService\it-IT\cmd.exe
PID 1952 wrote to memory of 956 N/A C:\Windows\system32\taskeng.exe C:\Program Files\Windows NT\TableTextService\it-IT\cmd.exe
PID 1952 wrote to memory of 1744 N/A C:\Windows\system32\taskeng.exe C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe
PID 1952 wrote to memory of 1744 N/A C:\Windows\system32\taskeng.exe C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe
PID 1952 wrote to memory of 1744 N/A C:\Windows\system32\taskeng.exe C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe
PID 1952 wrote to memory of 892 N/A C:\Windows\system32\taskeng.exe C:\Program Files\Windows NT\TableTextService\it-IT\cmd.exe
PID 1952 wrote to memory of 892 N/A C:\Windows\system32\taskeng.exe C:\Program Files\Windows NT\TableTextService\it-IT\cmd.exe
PID 1952 wrote to memory of 892 N/A C:\Windows\system32\taskeng.exe C:\Program Files\Windows NT\TableTextService\it-IT\cmd.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\Desktop.exe

"C:\Users\Admin\AppData\Local\Temp\Desktop.exe"

C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.sfx.exe

"C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.sfx.exe"

C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.exe

"C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\blockComagentCommon\XXy2W.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\blockComagentCommon\0xQrS65tkQIWur3PmtNOw.bat" "

C:\blockComagentCommon\bridgehypercom.exe

"C:\blockComagentCommon\bridgehypercom.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\TableTextService\it-IT\cmd.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\it-IT\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows NT\TableTextService\it-IT\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\5b7985c2-d100-11ee-bb00-c695cbc44580\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\5b7985c2-d100-11ee-bb00-c695cbc44580\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\5b7985c2-d100-11ee-bb00-c695cbc44580\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\lsm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\lsm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\lsm.exe'" /rl HIGHEST /f

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TNyqWpzlLk.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {577BD73D-0D5C-4263-A1E8-495DE310CCD3} S-1-5-21-1298544033-3225604241-2703760938-1000:IZKCKOTP\Admin:Interactive:[1]

C:\Program Files\Windows NT\TableTextService\it-IT\cmd.exe

"C:\Program Files\Windows NT\TableTextService\it-IT\cmd.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe"

C:\Program Files\Windows NT\TableTextService\it-IT\cmd.exe

"C:\Program Files\Windows NT\TableTextService\it-IT\cmd.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 a0997784.xsph.ru udp
RU 141.8.192.6:80 a0997784.xsph.ru tcp
RU 141.8.192.6:80 a0997784.xsph.ru tcp
RU 141.8.192.6:80 a0997784.xsph.ru tcp
RU 141.8.192.6:80 a0997784.xsph.ru tcp

Files

\Users\Admin\AppData\Roaming\DCRatBuild_protected.sfx.exe

MD5 442a5dbe203bf1dfe043c44a45df38b6
SHA1 2d06e45186f6856e02644ab8550b85469a84afbc
SHA256 3c2e56fa690da037a3fa6e5aca8864a15c9a402103f7db8387dff08d5ebeb217
SHA512 320237df5d3101ab4925eb875198a21a341da2cb176af2f0dc7f51c3952bbedb83f473d47730f6d2b989ee3e4ce659ceee5fec6263476b2d61fa1569f95d9a79

\Users\Admin\AppData\Roaming\DCRatBuild_protected.exe

MD5 9ca5c1afa78261d0666a0182c6749517
SHA1 6eb3162ed05bc0fddae625682cf14606d53bc2ec
SHA256 5fe6e35645bffadcc493be5c9a70779d3b688678c2a944099eabf86c66deb8a3
SHA512 d4e6ee59f2ade7fba1a93a80afcaf1017e2beaa72e39b2ae15c386e44dfd1dcc2594364b0379a4c615a5a554200493dd163ca02b43e37a1c4a0c34694f0e3d2e

memory/2100-29-0x0000000003E20000-0x0000000004226000-memory.dmp

memory/2100-28-0x0000000003E20000-0x0000000004226000-memory.dmp

memory/2024-31-0x0000000001070000-0x0000000001476000-memory.dmp

memory/2024-41-0x0000000001070000-0x0000000001476000-memory.dmp

C:\blockComagentCommon\XXy2W.vbe

MD5 ee52ea71feea8207e6afa75e86438d08
SHA1 8c833feedc8ac64a1424e663eb3dbb2013ba6142
SHA256 b482dc0529de14c5771702f8b4bdcc5a256c26611a84b569e4a997b466637b0d
SHA512 b09342f5caa69c1bf9481d9fc2284379626f6d2c3131d763d3a2198ccb0ddc5caf3a4f464a150cd9b0ebfc9b9c7aa1689af9000e14eaace36fe5247152ebc1c4

C:\blockComagentCommon\0xQrS65tkQIWur3PmtNOw.bat

MD5 ec36e67c09c4a57473bdb8237c55d18b
SHA1 03793c2750fca27259996873fb22c26ce8868cd1
SHA256 cc2d6e7836cc1772f50b3b10b0514139b5ecd5d3270607b60a1713b383f3c03f
SHA512 97bbdc60b22d2710a8b63108b544db7cb0c5da995334ad44ee347dbb84e0482e42ccee1d6881eec61cf6648e5c1e950450e828af85ffeed40b7778c26c1cf52c

\blockComagentCommon\bridgehypercom.exe

MD5 33776154d16b2ab16c0dc64063eecab0
SHA1 3a28e93ed82b8cc4081ec29abbb83fa35c25d9f4
SHA256 c093b10412252d75b8da533e378a0766d7e7db00db41d5c0f4794ed0ef95a863
SHA512 2c67ca3b79deb45ed0917390c2c226dc804ebd6548b2feff38457161312561cad8e7729796053269ce24d9f08ac25cfe6aaff82efd1c7e2766158eb732ec2869

memory/2904-48-0x0000000000B90000-0x0000000000CC2000-memory.dmp

memory/2904-49-0x00000000003B0000-0x00000000003CC000-memory.dmp

memory/2904-50-0x00000000003E0000-0x00000000003F6000-memory.dmp

memory/2904-51-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TNyqWpzlLk.bat

MD5 7ad53ac6acc561126ff7da71d6ddf5d6
SHA1 d72abbb2cdf130df7170a2ba972f088e4fe9ca5c
SHA256 fa29cccd60f10a6c0e65d1b468c0f92da29867d7b1df8791e9ded37fdcf2c768
SHA512 fcd690987f893634ece1d584f22bfcbd04e5c7658d1f17b4a4e397945148e4d2fde3117f66c38b2418dc9ca42b9a918ae5f7d3b620294862733121539649b3e8

memory/2260-67-0x0000000000AF0000-0x0000000000C22000-memory.dmp

memory/956-93-0x0000000000DC0000-0x0000000000EF2000-memory.dmp

memory/892-96-0x0000000000340000-0x0000000000472000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-19 16:38

Reported

2024-06-19 16:48

Platform

win10v2004-20240611-en

Max time kernel

566s

Max time network

601s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Desktop.exe"

Signatures

DcRat

rat infostealer dcrat
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Desktop.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
File created C:\Program Files\Mozilla Firefox\uninstall\6cb0b6c459d5d3 C:\blockComagentCommon\bridgehypercom.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Mozilla Firefox\\uninstall\\dwm.exe\", \"C:\\Program Files\\Microsoft Office\\Office16\\sppsvc.exe\", \"C:\\blockComagentCommon\\fontdrvhost.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Mozilla Firefox\\uninstall\\dwm.exe\", \"C:\\Program Files\\Microsoft Office\\Office16\\sppsvc.exe\", \"C:\\blockComagentCommon\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\de-DE\\RuntimeBroker.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Mozilla Firefox\\uninstall\\dwm.exe\", \"C:\\Program Files\\Microsoft Office\\Office16\\sppsvc.exe\", \"C:\\blockComagentCommon\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\de-DE\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\blockComagentCommon\\cmd.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Mozilla Firefox\\uninstall\\dwm.exe\", \"C:\\Program Files\\Microsoft Office\\Office16\\sppsvc.exe\", \"C:\\blockComagentCommon\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\de-DE\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\blockComagentCommon\\cmd.exe\", \"C:\\Program Files\\Java\\csrss.exe\", \"C:\\blockComagentCommon\\fontdrvhost.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Mozilla Firefox\\uninstall\\dwm.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Mozilla Firefox\\uninstall\\dwm.exe\", \"C:\\Program Files\\Microsoft Office\\Office16\\sppsvc.exe\", \"C:\\blockComagentCommon\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\de-DE\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Mozilla Firefox\\uninstall\\dwm.exe\", \"C:\\Program Files\\Microsoft Office\\Office16\\sppsvc.exe\", \"C:\\blockComagentCommon\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\de-DE\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\blockComagentCommon\\cmd.exe\", \"C:\\Program Files\\Java\\csrss.exe\", \"C:\\blockComagentCommon\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\lsass.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\conhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\cmd.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Mozilla Firefox\\uninstall\\dwm.exe\", \"C:\\Program Files\\Microsoft Office\\Office16\\sppsvc.exe\", \"C:\\blockComagentCommon\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\de-DE\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\blockComagentCommon\\cmd.exe\", \"C:\\Program Files\\Java\\csrss.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Mozilla Firefox\\uninstall\\dwm.exe\", \"C:\\Program Files\\Microsoft Office\\Office16\\sppsvc.exe\", \"C:\\blockComagentCommon\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\de-DE\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\blockComagentCommon\\cmd.exe\", \"C:\\Program Files\\Java\\csrss.exe\", \"C:\\blockComagentCommon\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\lsass.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\conhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\cmd.exe\", \"C:\\Program Files\\Windows Defender\\de-DE\\conhost.exe\", \"C:\\Windows\\SysWOW64\\winrm\\TrustedInstaller.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Mozilla Firefox\\uninstall\\dwm.exe\", \"C:\\Program Files\\Microsoft Office\\Office16\\sppsvc.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Mozilla Firefox\\uninstall\\dwm.exe\", \"C:\\Program Files\\Microsoft Office\\Office16\\sppsvc.exe\", \"C:\\blockComagentCommon\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\de-DE\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\blockComagentCommon\\cmd.exe\", \"C:\\Program Files\\Java\\csrss.exe\", \"C:\\blockComagentCommon\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\lsass.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Mozilla Firefox\\uninstall\\dwm.exe\", \"C:\\Program Files\\Microsoft Office\\Office16\\sppsvc.exe\", \"C:\\blockComagentCommon\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\de-DE\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\blockComagentCommon\\cmd.exe\", \"C:\\Program Files\\Java\\csrss.exe\", \"C:\\blockComagentCommon\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\lsass.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\conhost.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Mozilla Firefox\\uninstall\\dwm.exe\", \"C:\\Program Files\\Microsoft Office\\Office16\\sppsvc.exe\", \"C:\\blockComagentCommon\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\de-DE\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\blockComagentCommon\\cmd.exe\", \"C:\\Program Files\\Java\\csrss.exe\", \"C:\\blockComagentCommon\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\lsass.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\conhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\cmd.exe\", \"C:\\Program Files\\Windows Defender\\de-DE\\conhost.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Desktop.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.sfx.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\blockComagentCommon\bridgehypercom.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\conhost.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files\\Windows Defender\\de-DE\\conhost.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TrustedInstaller = "\"C:\\Windows\\SysWOW64\\winrm\\TrustedInstaller.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files\\Microsoft Office\\Office16\\sppsvc.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\blockComagentCommon\\fontdrvhost.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\blockComagentCommon\\fontdrvhost.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Recovery\\WindowsRE\\upfc.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Java\\csrss.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TrustedInstaller = "\"C:\\Windows\\SysWOW64\\winrm\\TrustedInstaller.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\conhost.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\Mozilla Firefox\\uninstall\\dwm.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\de-DE\\RuntimeBroker.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Recovery\\WindowsRE\\upfc.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\blockComagentCommon\\cmd.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Java\\csrss.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files\\Windows Defender\\de-DE\\conhost.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\Mozilla Firefox\\uninstall\\dwm.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files\\Microsoft Office\\Office16\\sppsvc.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\blockComagentCommon\\cmd.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\lsass.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Windows\\Performance\\WinSAT\\DataStore\\cmd.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\de-DE\\RuntimeBroker.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\lsass.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Windows\\Performance\\WinSAT\\DataStore\\cmd.exe\"" C:\blockComagentCommon\bridgehypercom.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\winrm\TrustedInstaller.exe C:\blockComagentCommon\bridgehypercom.exe N/A
File created C:\Windows\SysWOW64\winrm\04c1e7795967e4 C:\blockComagentCommon\bridgehypercom.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Windows Photo Viewer\de-DE\RuntimeBroker.exe C:\blockComagentCommon\bridgehypercom.exe N/A
File created C:\Program Files\Windows Defender\de-DE\088424020bedd6 C:\blockComagentCommon\bridgehypercom.exe N/A
File created C:\Program Files\Mozilla Firefox\uninstall\dwm.exe C:\blockComagentCommon\bridgehypercom.exe N/A
File created C:\Program Files\Java\csrss.exe C:\blockComagentCommon\bridgehypercom.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\6203df4a6bafc7 C:\blockComagentCommon\bridgehypercom.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\conhost.exe C:\blockComagentCommon\bridgehypercom.exe N/A
File created C:\Program Files\Windows Defender\de-DE\conhost.exe C:\blockComagentCommon\bridgehypercom.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\dwm.exe C:\blockComagentCommon\bridgehypercom.exe N/A
File created C:\Program Files\Mozilla Firefox\uninstall\6cb0b6c459d5d3 C:\blockComagentCommon\bridgehypercom.exe N/A
File created C:\Program Files\Java\886983d96e3d3e C:\blockComagentCommon\bridgehypercom.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\lsass.exe C:\blockComagentCommon\bridgehypercom.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\088424020bedd6 C:\blockComagentCommon\bridgehypercom.exe N/A
File created C:\Program Files\Microsoft Office\Office16\sppsvc.exe C:\blockComagentCommon\bridgehypercom.exe N/A
File created C:\Program Files\Microsoft Office\Office16\0a1fd5f707cd16 C:\blockComagentCommon\bridgehypercom.exe N/A
File created C:\Program Files (x86)\Windows Photo Viewer\de-DE\9e8d7a4ca61bd9 C:\blockComagentCommon\bridgehypercom.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Performance\WinSAT\DataStore\cmd.exe C:\blockComagentCommon\bridgehypercom.exe N/A
File created C:\Windows\Performance\WinSAT\DataStore\ebf1f9fa8afd6d C:\blockComagentCommon\bridgehypercom.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings C:\blockComagentCommon\bridgehypercom.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Mozilla Maintenance Service\conhost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\blockComagentCommon\bridgehypercom.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Mozilla Maintenance Service\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\uninstall\dwm.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Java\csrss.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\winrm\TrustedInstaller.exe N/A
Token: SeDebugPrivilege N/A C:\blockComagentCommon\fontdrvhost.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Windows Defender\de-DE\conhost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1608 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\Desktop.exe C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.sfx.exe
PID 1608 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\Desktop.exe C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.sfx.exe
PID 1608 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\Desktop.exe C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.sfx.exe
PID 464 wrote to memory of 4184 N/A C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.sfx.exe C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.exe
PID 464 wrote to memory of 4184 N/A C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.sfx.exe C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.exe
PID 464 wrote to memory of 4184 N/A C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.sfx.exe C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.exe
PID 4184 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.exe C:\Windows\SysWOW64\WScript.exe
PID 4184 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.exe C:\Windows\SysWOW64\WScript.exe
PID 4184 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.exe C:\Windows\SysWOW64\WScript.exe
PID 1652 wrote to memory of 2576 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 2576 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 2576 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2576 wrote to memory of 432 N/A C:\Windows\SysWOW64\cmd.exe C:\blockComagentCommon\bridgehypercom.exe
PID 2576 wrote to memory of 432 N/A C:\Windows\SysWOW64\cmd.exe C:\blockComagentCommon\bridgehypercom.exe
PID 432 wrote to memory of 1760 N/A C:\blockComagentCommon\bridgehypercom.exe C:\Windows\System32\cmd.exe
PID 432 wrote to memory of 1760 N/A C:\blockComagentCommon\bridgehypercom.exe C:\Windows\System32\cmd.exe
PID 1760 wrote to memory of 384 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1760 wrote to memory of 384 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1760 wrote to memory of 3348 N/A C:\Windows\System32\cmd.exe C:\Program Files (x86)\Mozilla Maintenance Service\conhost.exe
PID 1760 wrote to memory of 3348 N/A C:\Windows\System32\cmd.exe C:\Program Files (x86)\Mozilla Maintenance Service\conhost.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\Desktop.exe

"C:\Users\Admin\AppData\Local\Temp\Desktop.exe"

C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.sfx.exe

"C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.sfx.exe"

C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.exe

"C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\blockComagentCommon\XXy2W.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\blockComagentCommon\0xQrS65tkQIWur3PmtNOw.bat" "

C:\blockComagentCommon\bridgehypercom.exe

"C:\blockComagentCommon\bridgehypercom.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Mozilla Firefox\uninstall\dwm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\uninstall\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Mozilla Firefox\uninstall\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office\Office16\sppsvc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office16\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office\Office16\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\blockComagentCommon\fontdrvhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\blockComagentCommon\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\blockComagentCommon\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\blockComagentCommon\cmd.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\blockComagentCommon\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\blockComagentCommon\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Java\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Java\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Java\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\blockComagentCommon\fontdrvhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\blockComagentCommon\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\blockComagentCommon\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\lsass.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\conhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Windows\Performance\WinSAT\DataStore\cmd.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\DataStore\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Windows\Performance\WinSAT\DataStore\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender\de-DE\conhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\de-DE\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Defender\de-DE\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 13 /tr "'C:\Windows\SysWOW64\winrm\TrustedInstaller.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Windows\SysWOW64\winrm\TrustedInstaller.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 7 /tr "'C:\Windows\SysWOW64\winrm\TrustedInstaller.exe'" /rl HIGHEST /f

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eyfeuxiT9t.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files (x86)\Mozilla Maintenance Service\conhost.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\conhost.exe"

C:\Program Files\Mozilla Firefox\uninstall\dwm.exe

"C:\Program Files\Mozilla Firefox\uninstall\dwm.exe"

C:\Program Files\Java\csrss.exe

"C:\Program Files\Java\csrss.exe"

C:\Windows\SysWOW64\winrm\TrustedInstaller.exe

C:\Windows\SysWOW64\winrm\TrustedInstaller.exe

C:\blockComagentCommon\fontdrvhost.exe

C:\blockComagentCommon\fontdrvhost.exe

C:\Program Files\Windows Defender\de-DE\conhost.exe

"C:\Program Files\Windows Defender\de-DE\conhost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 208.131.50.23.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
NL 23.62.61.155:443 www.bing.com tcp
US 8.8.8.8:53 155.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 a0997784.xsph.ru udp
RU 141.8.192.6:80 a0997784.xsph.ru tcp
RU 141.8.192.6:80 a0997784.xsph.ru tcp
US 8.8.8.8:53 6.192.8.141.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 216.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
RU 141.8.192.6:80 a0997784.xsph.ru tcp
US 8.8.8.8:53 88.16.208.104.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.sfx.exe

MD5 442a5dbe203bf1dfe043c44a45df38b6
SHA1 2d06e45186f6856e02644ab8550b85469a84afbc
SHA256 3c2e56fa690da037a3fa6e5aca8864a15c9a402103f7db8387dff08d5ebeb217
SHA512 320237df5d3101ab4925eb875198a21a341da2cb176af2f0dc7f51c3952bbedb83f473d47730f6d2b989ee3e4ce659ceee5fec6263476b2d61fa1569f95d9a79

C:\Users\Admin\AppData\Roaming\DCRatBuild_protected.exe

MD5 9ca5c1afa78261d0666a0182c6749517
SHA1 6eb3162ed05bc0fddae625682cf14606d53bc2ec
SHA256 5fe6e35645bffadcc493be5c9a70779d3b688678c2a944099eabf86c66deb8a3
SHA512 d4e6ee59f2ade7fba1a93a80afcaf1017e2beaa72e39b2ae15c386e44dfd1dcc2594364b0379a4c615a5a554200493dd163ca02b43e37a1c4a0c34694f0e3d2e

memory/4184-19-0x0000000000500000-0x0000000000906000-memory.dmp

memory/4184-28-0x0000000000500000-0x0000000000906000-memory.dmp

C:\blockComagentCommon\XXy2W.vbe

MD5 ee52ea71feea8207e6afa75e86438d08
SHA1 8c833feedc8ac64a1424e663eb3dbb2013ba6142
SHA256 b482dc0529de14c5771702f8b4bdcc5a256c26611a84b569e4a997b466637b0d
SHA512 b09342f5caa69c1bf9481d9fc2284379626f6d2c3131d763d3a2198ccb0ddc5caf3a4f464a150cd9b0ebfc9b9c7aa1689af9000e14eaace36fe5247152ebc1c4

C:\blockComagentCommon\0xQrS65tkQIWur3PmtNOw.bat

MD5 ec36e67c09c4a57473bdb8237c55d18b
SHA1 03793c2750fca27259996873fb22c26ce8868cd1
SHA256 cc2d6e7836cc1772f50b3b10b0514139b5ecd5d3270607b60a1713b383f3c03f
SHA512 97bbdc60b22d2710a8b63108b544db7cb0c5da995334ad44ee347dbb84e0482e42ccee1d6881eec61cf6648e5c1e950450e828af85ffeed40b7778c26c1cf52c

C:\blockComagentCommon\bridgehypercom.exe

MD5 33776154d16b2ab16c0dc64063eecab0
SHA1 3a28e93ed82b8cc4081ec29abbb83fa35c25d9f4
SHA256 c093b10412252d75b8da533e378a0766d7e7db00db41d5c0f4794ed0ef95a863
SHA512 2c67ca3b79deb45ed0917390c2c226dc804ebd6548b2feff38457161312561cad8e7729796053269ce24d9f08ac25cfe6aaff82efd1c7e2766158eb732ec2869

memory/432-34-0x0000000000DA0000-0x0000000000ED2000-memory.dmp

memory/432-35-0x00000000030E0000-0x00000000030FC000-memory.dmp

memory/432-36-0x000000001C200000-0x000000001C250000-memory.dmp

memory/432-37-0x000000001BB20000-0x000000001BB36000-memory.dmp

memory/432-38-0x0000000002FA0000-0x0000000002FAC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\eyfeuxiT9t.bat

MD5 ddcfb3568882d50ae7e0adf7b60ee498
SHA1 19bafd03ea13b423f03be9867b9f58fa07c9e999
SHA256 ee528f583905170887af733e511e6881f95d7c7d9601535f756ce2037f792537
SHA512 61722a850a0f0ab95cadee74f1b532f3b7bd3a3bb9c12a0272428b3f74084d75bc5e79b738ae4f765a569afc86899ef8c5c5d9357401dbe5c7c8f153e11d515f

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545