dcrat | f4ab048f183a7269468b0cb8509668831e3d8f816e1be3162a0734c83c488c97

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f4ab048f183a7269468b0cb8509668831e3d8f816e1be3162a0734c83c488c97.exe
Size 1.1MB
Sample240705-cd89wsscke
SHA256 f4ab048f183a7269468b0cb8509668831e3d8f816e1be3162a0734c83c488c97
MD5 829cab70d17eaedeabe77c32154d11f2
SHA1 196c898abee483229f61342ac1f8248677f833da
SHA512 9d7ce634639d86cf020d1ce1a85e7c7d113feed2d0fc98f1f5ebb233ba77129e133b92636864bdbf105ec5599143f84835219203173bcf63ce047a7d40a7f4c3
SSDEEP 24576:Y2G/nvxW3W4kqExbb2uM2bowf751JKeqkTsRPns:YbA34qQUwf75bz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat 37 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		2480	schtasks.exe
		2056	schtasks.exe
		4860	schtasks.exe
		1924	schtasks.exe
		224	schtasks.exe
		2240	schtasks.exe
		3892	schtasks.exe
		2280	schtasks.exe
		2728	schtasks.exe
		3104	schtasks.exe
		4468	schtasks.exe
		2180	schtasks.exe
		876	schtasks.exe
		4548	schtasks.exe
		2304	schtasks.exe
		1052	schtasks.exe
		4524	schtasks.exe
		4668	schtasks.exe
		992	schtasks.exe
		2892	schtasks.exe
		1644	schtasks.exe
		2116	schtasks.exe
		2264	schtasks.exe
		1584	schtasks.exe
		3532	schtasks.exe
		1532	schtasks.exe
		1300	schtasks.exe
		3852	schtasks.exe
		1488	schtasks.exe
		1748	schtasks.exe
		3264	schtasks.exe
		2700	schtasks.exe
		4012	schtasks.exe
		1692	schtasks.exe
		1864	schtasks.exe
		2968	schtasks.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation		f4ab048f183a7269468b0cb8509668831e3d8f816e1be3162a0734c83c488c97.exe

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\fontdrvhost.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\fontdrvhost.exe\", \"C:\\intobroker\\cmd.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\fontdrvhost.exe\", \"C:\\intobroker\\cmd.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\csrss.exe\", \"C:\\Users\\Default User\\System.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\fontdrvhost.exe\", \"C:\\intobroker\\cmd.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\csrss.exe\", \"C:\\Users\\Default User\\System.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\fontdrvhost.exe\", \"C:\\intobroker\\cmd.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\csrss.exe\", \"C:\\Users\\Default User\\System.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\conhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\ja-JP\\cmd.exe\", \"C:\\Users\\Admin\\Pictures\\Saved Pictures\\taskhostw.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\fontdrvhost.exe\", \"C:\\intobroker\\cmd.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\csrss.exe\", \"C:\\Users\\Default User\\System.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\conhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\ja-JP\\cmd.exe\", \"C:\\Users\\Admin\\Pictures\\Saved Pictures\\taskhostw.exe\", \"C:\\intobroker\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Mail\\dwm.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\fontdrvhost.exe\", \"C:\\intobroker\\cmd.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\csrss.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\fontdrvhost.exe\", \"C:\\intobroker\\cmd.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\csrss.exe\", \"C:\\Users\\Default User\\System.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\conhost.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\fontdrvhost.exe\", \"C:\\intobroker\\cmd.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\csrss.exe\", \"C:\\Users\\Default User\\System.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\conhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\ja-JP\\cmd.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\fontdrvhost.exe\", \"C:\\intobroker\\cmd.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\csrss.exe\", \"C:\\Users\\Default User\\System.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\conhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\ja-JP\\cmd.exe\", \"C:\\Users\\Admin\\Pictures\\Saved Pictures\\taskhostw.exe\", \"C:\\intobroker\\OfficeClickToRun.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\fontdrvhost.exe\", \"C:\\intobroker\\cmd.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\csrss.exe\", \"C:\\Users\\Default User\\System.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\conhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\ja-JP\\cmd.exe\", \"C:\\Users\\Admin\\Pictures\\Saved Pictures\\taskhostw.exe\", \"C:\\intobroker\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Mail\\dwm.exe\", \"C:\\intobroker\\Idle.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\fontdrvhost.exe\", \"C:\\intobroker\\cmd.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\csrss.exe\", \"C:\\Users\\Default User\\System.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\conhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\ja-JP\\cmd.exe\", \"C:\\Users\\Admin\\Pictures\\Saved Pictures\\taskhostw.exe\", \"C:\\intobroker\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Mail\\dwm.exe\", \"C:\\intobroker\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\Idle.exe\""	componentfontnet.exe

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	992	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3892	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	876	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1052	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3104	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4012	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1692	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1300	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4524	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3852	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4468	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4548	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4860	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3264	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4668	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	224	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3532	932	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	932	schtasks.exe	85

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x00070000000233fc-10.dat	dcrat
behavioral2/memory/1112-13-0x0000000000050000-0x0000000000126000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	f4ab048f183a7269468b0cb8509668831e3d8f816e1be3162a0734c83c488c97.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	componentfontnet.exe

Executes dropped EXE 2 IoCs

pid	Process
1112	componentfontnet.exe
4556	System.exe

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\conhost.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files (x86)\\Internet Explorer\\ja-JP\\cmd.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Users\\Admin\\Pictures\\Saved Pictures\\taskhostw.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\csrss.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Default User\\System.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Default User\\System.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows Mail\\dwm.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows Mail\\dwm.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\intobroker\\Idle.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\intobroker\\Idle.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\Idle.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\Idle.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\fontdrvhost.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\csrss.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files (x86)\\Internet Explorer\\ja-JP\\cmd.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\intobroker\\cmd.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\conhost.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\intobroker\\OfficeClickToRun.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\intobroker\\OfficeClickToRun.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\fontdrvhost.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\intobroker\\cmd.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Users\\Admin\\Pictures\\Saved Pictures\\taskhostw.exe\""	componentfontnet.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\088424020bedd6	componentfontnet.exe
File created	C:\Program Files (x86)\Internet Explorer\ja-JP\ebf1f9fa8afd6d	componentfontnet.exe
File created	C:\Program Files (x86)\Windows Mail\dwm.exe	componentfontnet.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\Idle.exe	componentfontnet.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\886983d96e3d3e	componentfontnet.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe	componentfontnet.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\conhost.exe	componentfontnet.exe
File created	C:\Program Files (x86)\Windows Mail\6cb0b6c459d5d3	componentfontnet.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\6ccacd8608530f	componentfontnet.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\csrss.exe	componentfontnet.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\9e8d7a4ca61bd9	componentfontnet.exe
File created	C:\Program Files (x86)\Internet Explorer\ja-JP\cmd.exe	componentfontnet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	f4ab048f183a7269468b0cb8509668831e3d8f816e1be3162a0734c83c488c97.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2180	schtasks.exe
3104	schtasks.exe
2700	schtasks.exe
3852	schtasks.exe
4548	schtasks.exe
1584	schtasks.exe
1864	schtasks.exe
2892	schtasks.exe
2280	schtasks.exe
3892	schtasks.exe
1052	schtasks.exe
2056	schtasks.exe
4468	schtasks.exe
4668	schtasks.exe
1300	schtasks.exe
4860	schtasks.exe
3532	schtasks.exe
2240	schtasks.exe
2304	schtasks.exe
2116	schtasks.exe
4012	schtasks.exe
3264	schtasks.exe
1692	schtasks.exe
4524	schtasks.exe
1748	schtasks.exe
1644	schtasks.exe
992	schtasks.exe
2728	schtasks.exe
876	schtasks.exe
2968	schtasks.exe
1924	schtasks.exe
1488	schtasks.exe
2480	schtasks.exe
1532	schtasks.exe
2264	schtasks.exe
224	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
4556	System.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1112	componentfontnet.exe
Token: SeDebugPrivilege	4556	System.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 576	2340	f4ab048f183a7269468b0cb8509668831e3d8f816e1be3162a0734c83c488c97.exe	80
PID 2340 wrote to memory of 576	2340	f4ab048f183a7269468b0cb8509668831e3d8f816e1be3162a0734c83c488c97.exe	80
PID 2340 wrote to memory of 576	2340	f4ab048f183a7269468b0cb8509668831e3d8f816e1be3162a0734c83c488c97.exe	80
PID 576 wrote to memory of 4224	576	WScript.exe	82
PID 576 wrote to memory of 4224	576	WScript.exe	82
PID 576 wrote to memory of 4224	576	WScript.exe	82
PID 4224 wrote to memory of 1112	4224	cmd.exe	84
PID 4224 wrote to memory of 1112	4224	cmd.exe	84
PID 1112 wrote to memory of 4556	1112	componentfontnet.exe	122
PID 1112 wrote to memory of 4556	1112	componentfontnet.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\f4ab048f183a7269468b0cb8509668831e3d8f816e1be3162a0734c83c488c97.exe
"C:\Users\Admin\AppData\Local\Temp\f4ab048f183a7269468b0cb8509668831e3d8f816e1be3162a0734c83c488c97.exe"
1⤵
- DcRat
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\intobroker\osry78APVO.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\intobroker\tDTHMvsh0leL386.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\intobroker\componentfontnet.exe
      "C:\intobroker\componentfontnet.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1112
    - - C:\Users\Default User\System.exe
        
        "C:\Users\Default User\System.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\intobroker\cmd.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\intobroker\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\intobroker\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\cmd.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Pictures\Saved Pictures\taskhostw.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\Admin\Pictures\Saved Pictures\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Pictures\Saved Pictures\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\intobroker\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\intobroker\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\intobroker\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\intobroker\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\intobroker\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\intobroker\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

componentfontnet.exe

Path C:\intobroker\componentfontnet.exe
Size 829KB
SHA256 32e448e205263af7253fdb66af9e2349e18a6054c9a1d27e8c5264840ba1559e
MD5 0496185a6219652c72da3dc493b35853
SHA1 9060775977b6a917f8d513521ad1a327342d0eab
SHA512 8a36acae4bf2e966ef2913d24b2be6ed8c4d167868e98b94fdebc4892895a61f0c43a682a829a9f615a03aec953bca3f2cf1915b1368fa2cf1fd9be91f2da84f
SSDEEP 12288:v2bQgWxbTbr2uM2IknowNbmWlMA14g1J5tOeqkTsR3fWm:CExbb2uM2bowf751JKeqkTsRPn
MD5 SHA1 SHA512 SSDEEP

Submit Download

osry78APVO.vbe

Path C:\intobroker\osry78APVO.vbe
Size 203B
SHA256 7620872ff0baa9a5acccdf52eda7568ac9e26968922835abab01703e25c6f8b5
MD5 d9575ef3d39fa2d3f7cddfa06e37aed9
SHA1 96f3d4b152dd2b5367a6c6199c7c0cb8a7e55e48
SHA512 5f0bae0a68887a17b0d5cbac991a0657b83dc3e9bdfa0bfd62805d0cbaf4bad1d2354d63549743e46e11d6449f2a6d6bf7a1892ba5efa744abe7e1027234e742
MD5 SHA1 SHA512

Submit Download

tDTHMvsh0leL386.bat

Path C:\intobroker\tDTHMvsh0leL386.bat
Size 36B
SHA256 8a5e709a08538e22d8491eaaf5aaf53b1468229a5721c072ea08c9467e0c3ef5
MD5 eebb77f627130b420bf208f1efe0b460
SHA1 60fc9a9abee4f092453513424d3ad026d047b5fd
SHA512 030ddab47f04ddcfb8f1ec412621d0e31821f82fd38dde3fae07e63234613d14276bc2d378f20d9499fd1b9098cb042f5fefe7b49cb2aad5ef44635736e8b7ed
MD5 SHA1 SHA512

Submit Download

memory/1112-12-0x00007FFECB503000-0x00007FFECB505000-memory.dmp

Download

memory/1112-13-0x0000000000050000-0x0000000000126000-memory.dmp

Download