dcrat | aeca1f26394dc38fcfb796bfc990c7a357ded47db72f6dbfb71b96fdf5ee98f1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 00:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6262fc337fdee4940d78732b8f8a2abb.exe
Size 2.9MB
Sample240625-a4msga1dmb
SHA256 aeca1f26394dc38fcfb796bfc990c7a357ded47db72f6dbfb71b96fdf5ee98f1
MD5 6262fc337fdee4940d78732b8f8a2abb
SHA1 c2b4280f6be4b365e461ecf5ee216c07d7f86cb5
SHA512 e1bab7d99139b41fd6da5b3ffc78b970816cb4ca5fee8948467d242089aff2b5ad0c17d33812fec28832c9e3c421a15896a801acd4968396864e3fe1771250f3
SSDEEP 49152:DHKeec9XYZ7w4P21O1iVAEUzXm+iAVI3532pim:HectYZ9iV/UDmNA053ii
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat upx

Malware Config

Signatures

DcRat 25 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		4600	schtasks.exe
		3188	schtasks.exe
		2540	schtasks.exe
		4120	schtasks.exe
		1172	schtasks.exe
		4072	schtasks.exe
		3988	schtasks.exe
		2228	schtasks.exe
		940	schtasks.exe
		3968	schtasks.exe
		4608	schtasks.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation		6262fc337fdee4940d78732b8f8a2abb.exe
		1440	schtasks.exe
		512	schtasks.exe
		4896	schtasks.exe
		4460	schtasks.exe
		3172	schtasks.exe
		4108	schtasks.exe
		4564	schtasks.exe
		4900	schtasks.exe
		688	schtasks.exe
		4760	schtasks.exe
		404	schtasks.exe
		8	schtasks.exe
		2964	schtasks.exe

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1440	4972	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	940	4972	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1172	4972	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4760	4972	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	512	4972	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4600	4972	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4896	4972	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3172	4972	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	404	4972	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4072	4972	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4900	4972	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3968	4972	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3988	4972	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4108	4972	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3188	4972	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4608	4972	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8	4972	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	688	4972	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	4972	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	4972	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4460	4972	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4120	4972	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	4972	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4564	4972	schtasks.exe	91

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/716-0-0x0000000000400000-0x00000000006E2000-memory.dmp	dcrat
behavioral2/files/0x000800000002340a-5.dat	dcrat
behavioral2/files/0x0007000000023415-55.dat	dcrat
behavioral2/memory/3360-57-0x0000000000700000-0x0000000000858000-memory.dmp	dcrat

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	6262fc337fdee4940d78732b8f8a2abb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	DCRatBuild.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	fontDriverCommon.exe

Executes dropped EXE 4 IoCs

pid	Process
4860	DCRatBuild.exe
1352	pawno.exe
3360	fontDriverCommon.exe
4580	smss.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023411-36.dat	upx
behavioral2/memory/1352-41-0x0000000000400000-0x00000000004D3000-memory.dmp	upx
behavioral2/memory/1352-87-0x0000000000400000-0x00000000004D3000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Multimedia Platform\fontdrvhost.exe	fontDriverCommon.exe
File created	C:\Program Files\Windows Multimedia Platform\5b884080fd4f94	fontDriverCommon.exe
File created	C:\Program Files\Java\conhost.exe	fontDriverCommon.exe
File created	C:\Program Files\Java\088424020bedd6	fontDriverCommon.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Downloaded Program Files\lsass.exe	fontDriverCommon.exe
File created	C:\Windows\Downloaded Program Files\6203df4a6bafc7	fontDriverCommon.exe
File created	C:\Windows\INF\MSDTC Bridge 3.0.0.0\0411\fontDriverCommon.exe	fontDriverCommon.exe
File created	C:\Windows\INF\MSDTC Bridge 3.0.0.0\0411\b236168f2cf5a1	fontDriverCommon.exe
File created	C:\Windows\rescache\dwm.exe	fontDriverCommon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	6262fc337fdee4940d78732b8f8a2abb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\DefaultIcon	pawno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\shell\ = "Open"	pawno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\shell\Open\command	pawno.exe
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings	DCRatBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings	fontDriverCommon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\shell	pawno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pwn	pawno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script	pawno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pawno.exe,1"	pawno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\shell\Open	pawno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\shell\Open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pawno.exe \"%1\""	pawno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pwn\ = "PAWN.Script"	pawno.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
388	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4460	schtasks.exe
4120	schtasks.exe
4564	schtasks.exe
1440	schtasks.exe
512	schtasks.exe
4896	schtasks.exe
4900	schtasks.exe
2964	schtasks.exe
940	schtasks.exe
4072	schtasks.exe
3988	schtasks.exe
4108	schtasks.exe
2540	schtasks.exe
688	schtasks.exe
4600	schtasks.exe
3968	schtasks.exe
3188	schtasks.exe
4608	schtasks.exe
8	schtasks.exe
1172	schtasks.exe
4760	schtasks.exe
3172	schtasks.exe
404	schtasks.exe
2228	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3360	fontDriverCommon.exe
3360	fontDriverCommon.exe
3360	fontDriverCommon.exe
3360	fontDriverCommon.exe
4580	smss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3360	fontDriverCommon.exe
Token: SeDebugPrivilege	4580	smss.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 4860	716	6262fc337fdee4940d78732b8f8a2abb.exe	83
PID 716 wrote to memory of 4860	716	6262fc337fdee4940d78732b8f8a2abb.exe	83
PID 716 wrote to memory of 4860	716	6262fc337fdee4940d78732b8f8a2abb.exe	83
PID 716 wrote to memory of 1352	716	6262fc337fdee4940d78732b8f8a2abb.exe	85
PID 716 wrote to memory of 1352	716	6262fc337fdee4940d78732b8f8a2abb.exe	85
PID 716 wrote to memory of 1352	716	6262fc337fdee4940d78732b8f8a2abb.exe	85
PID 4860 wrote to memory of 3300	4860	DCRatBuild.exe	86
PID 4860 wrote to memory of 3300	4860	DCRatBuild.exe	86
PID 4860 wrote to memory of 3300	4860	DCRatBuild.exe	86
PID 3300 wrote to memory of 4968	3300	WScript.exe	93
PID 3300 wrote to memory of 4968	3300	WScript.exe	93
PID 3300 wrote to memory of 4968	3300	WScript.exe	93
PID 4968 wrote to memory of 3360	4968	cmd.exe	95
PID 4968 wrote to memory of 3360	4968	cmd.exe	95
PID 3360 wrote to memory of 3852	3360	fontDriverCommon.exe	121
PID 3360 wrote to memory of 3852	3360	fontDriverCommon.exe	121
PID 4968 wrote to memory of 388	4968	cmd.exe	123
PID 4968 wrote to memory of 388	4968	cmd.exe	123
PID 4968 wrote to memory of 388	4968	cmd.exe	123
PID 3852 wrote to memory of 4664	3852	cmd.exe	124
PID 3852 wrote to memory of 4664	3852	cmd.exe	124
PID 3852 wrote to memory of 4580	3852	cmd.exe	126
PID 3852 wrote to memory of 4580	3852	cmd.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6262fc337fdee4940d78732b8f8a2abb.exe
"C:\Users\Admin\AppData\Local\Temp\6262fc337fdee4940d78732b8f8a2abb.exe"
1⤵
- DcRat
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:716
- C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\chainblockProviderwebwin\CX4tCkhBTViD49uibXL2.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3300
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\chainblockProviderwebwin\Dej3gat7UeNGrS7mYrbtyhamb8bY.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4968
    - - C:\Users\Admin\AppData\Roaming\chainblockProviderwebwin\fontDriverCommon.exe
        
        "C:\Users\Admin\AppData\Roaming\chainblockProviderwebwin\fontDriverCommon.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3360
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vtDvsd392E.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3852
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:4664
        
        C:\Users\Default User\smss.exe
        
        "C:\Users\Default User\smss.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4580
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:388
- C:\Users\Admin\AppData\Local\Temp\pawno.exe
  "C:\Users\Admin\AppData\Local\Temp\pawno.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Multimedia Platform\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Multimedia Platform\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontDriverCommonf" /sc MINUTE /mo 14 /tr "'C:\Windows\INF\MSDTC Bridge 3.0.0.0\0411\fontDriverCommon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontDriverCommon" /sc ONLOGON /tr "'C:\Windows\INF\MSDTC Bridge 3.0.0.0\0411\fontDriverCommon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontDriverCommonf" /sc MINUTE /mo 12 /tr "'C:\Windows\INF\MSDTC Bridge 3.0.0.0\0411\fontDriverCommon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Java\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Java\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Java\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Pictures\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Public\Pictures\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Pictures\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Windows\Downloaded Program Files\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Downloaded Program Files\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Windows\Downloaded Program Files\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DCRatBuild.exe

Path C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
Size 1.6MB
SHA256 6c95f36b126c21674b5c6f815f7afb8f961ddaa4452ec612b1c7ce287c01902c
MD5 1165c3d2c05dc760b0e5fb544f386e17
SHA1 a58fb549f61d25fadb20de136d32d342c8d0846a
SHA512 5e748efcedc686d0ba47621247fd14122e724c6c72bd4e7f74bdde97a68d15052b1f652f7f4cd1ebde731b3861e6d54a9aaee0fa5942d0ae13151bd95f33c798
SSDEEP 24576:U2G/nvxW3Ww0tBQ35U7yQNdKbdvyPcMVNO4l3IzZzSm0l8/xJjdwPKU:UbA30BQ3UNfPcMH3uZ0OxJ5+
MD5 SHA1 SHA512 SSDEEP

Submit Download

pawno.exe

Path C:\Users\Admin\AppData\Local\Temp\pawno.exe
Size 297KB
SHA256 796a94ddcdb41b32d32bee020ca85371cf6bbeb968036448d0e3b0b559d7e90b
MD5 325558d389c149c420a2753e0d163d09
SHA1 3d1ac2fafe3ce5f5348a77c891074551a51e8fda
SHA512 182358763d3565c4d29b51479eafeeee060b876a3884d7636caa47152d0edee1b531db955664f14e5b03e1820d960a2a532444b33702acb1a6b23b1bc450ce8e
SSDEEP 6144:8qV54oUeSsMY3j0cI8rdYEylF2EHJ8Sj6vzHrh8wDVU3wMs9ZFW:8qV5dU7oTWKYEEF5J87vzLh8aVJS
MD5 SHA1 SHA512 SSDEEP

Submit Download

vtDvsd392E.bat

Path C:\Users\Admin\AppData\Local\Temp\vtDvsd392E.bat
Size 195B
SHA256 7972b61246ac052773ec258124b4756b7ffe6b0b4a5fc59515016e4be9213b26
MD5 696278ac098352eaa02f7564c017b9af
SHA1 63c9fdd1c3350dc6fdf05af38dfc9db8b682de3b
SHA512 fba8089d32690b97742890d4f829132f7d1dcbe31c46402e56ca288588d955521ee7acc156c975fa7b1470adb38fa5aa938b98c9f313baa0948fc6c60ca615b5
MD5 SHA1 SHA512

Submit Download

CX4tCkhBTViD49uibXL2.vbe

Path C:\Users\Admin\AppData\Roaming\chainblockProviderwebwin\CX4tCkhBTViD49uibXL2.vbe
Size 236B
SHA256 2a33e8e83712ba5e030669f5e71a14936587de570408125c14c893a14e72540c
MD5 5f4a6740708bc1f7105c4bb9da60c9e5
SHA1 a0d76a5dcf8d7c5854dfda72b9fa83072868986b
SHA512 91ab7bdb22ae55a531b549cd50ad83c4e9c69cff55e26fcaf14d7b4003a3c71a2650cbb230e3863c889b3170787df6c70d91471b4911d274d539365af614bd3b
MD5 SHA1 SHA512

Submit Download

Dej3gat7UeNGrS7mYrbtyhamb8bY.bat

Path C:\Users\Admin\AppData\Roaming\chainblockProviderwebwin\Dej3gat7UeNGrS7mYrbtyhamb8bY.bat
Size 169B
SHA256 661eba0cbbbdc4c789d47600e632d51e96d81b423187dd18df9951f1a975a46f
MD5 9c964c72c44574d22ee23c43a48838d8
SHA1 e96d82b8b9fe36667e4f7cb350f8a5e2c6251fd0
SHA512 2d504716368cea24f791291b930ac2e6c3684da9a986f39d0bed253e0921e853dc760aaaf51799e6bb14ff1e138836db9588dee24bff9ac99ba2da65c04cff95
MD5 SHA1 SHA512

Submit Download

fontDriverCommon.exe

Path C:\Users\Admin\AppData\Roaming\chainblockProviderwebwin\fontDriverCommon.exe
Size 1.3MB
SHA256 c3e8710fb6a29bee780866ccfe257206159a0a85fa220a8cb1ba6bf992aa5464
MD5 d843c2126fb86c9ed3080ba8b7d82a50
SHA1 06ac74dfb1be5ee90cb9e4cbd9a5792ca0632f95
SHA512 83d2bc07c82703a914eaa724012d858671c80e7692f46f1e7ba40ad8269b0b647aecba2089bbeaf50262db3b90b2e76f78a839e03de8d1ae634a3445da831749
SSDEEP 24576:UQ35U7yQNdKbdvyPcMVNO4l3IzZzSm0l8/xJjdwPK:UQ3UNfPcMH3uZ0OxJ5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/716-0-0x0000000000400000-0x00000000006E2000-memory.dmp

Download

memory/1352-41-0x0000000000400000-0x00000000004D3000-memory.dmp

Download

memory/1352-42-0x00000000005B0000-0x00000000005B1000-memory.dmp

Download

memory/1352-93-0x00000000005B0000-0x00000000005B1000-memory.dmp

Download

memory/1352-87-0x0000000000400000-0x00000000004D3000-memory.dmp

Download

memory/3360-57-0x0000000000700000-0x0000000000858000-memory.dmp

Download

memory/3360-61-0x000000001B9B0000-0x000000001B9C2000-memory.dmp

Download

memory/3360-62-0x000000001C0A0000-0x000000001C5C8000-memory.dmp

Download

memory/3360-63-0x000000001B9E0000-0x000000001B9EC000-memory.dmp

Download

memory/3360-64-0x000000001B9F0000-0x000000001B9FC000-memory.dmp

Download

memory/3360-60-0x000000001B990000-0x000000001B9A6000-memory.dmp

Download

memory/3360-59-0x000000001BB20000-0x000000001BB70000-memory.dmp

Download

memory/3360-58-0x000000001B970000-0x000000001B98C000-memory.dmp

Download