dcrat | 8ac5083f52da0ff312259331f65b326782803aa837a7b371a6d43a021b0c24c3

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 17:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8ac5083f52da0ff312259331f65b326782803aa837a7b371a6d43a021b0c24c3.exe
Size 18.0MB
Sample240709-wkq7faydld
SHA256 8ac5083f52da0ff312259331f65b326782803aa837a7b371a6d43a021b0c24c3
MD5 6bf34debe3788625e4fcf5305560dd29
SHA1 1b5f4d8c5855c5abd27ed4b535e184f9dad63c9f
SHA512 1c6d53de83abfa1bb9fafec99af004d81fd57987b717b467e44e0786a44de66c25d23112ec235adff429f7b115a60c94ec00f36d18e422ccd977f75178d7783f
SSDEEP 393216:GBTNgTDuYpZeQExe0VPa21r0pgTDuYxzQvcSj0dom+lC4:sNvpHPWQEzYdg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat redline sabad0n discovery infostealer rat spyware stealer

Malware Config

Extracted

Family

redline

Botnet

Sabad0n

77.73.129.75:1912

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4452	4084	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5048	4084	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1844	4084	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	816	4084	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4644	4084	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3972	4084	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	4084	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	4084	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	4084	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3792	4084	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3288	4084	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4208	4084	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4284	4084	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3968	4084	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	4084	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	4084	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	4084	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	60	4084	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	4084	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3540	4084	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3272	4084	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4504	4084	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	4084	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3476	4084	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	4084	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4088	4084	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4492	4084	schtasks.exe	91

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0009000000023435-21.dat	family_redline
behavioral2/memory/1816-30-0x0000000000450000-0x00000000004A2000-memory.dmp	family_redline

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0009000000023432-14.dat	dcrat
behavioral2/memory/4996-28-0x0000000000400000-0x00000000015FF000-memory.dmp	dcrat
behavioral2/files/0x0007000000023438-49.dat	dcrat
behavioral2/memory/2404-51-0x00000000004E0000-0x0000000000716000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\International\Geo\Nation	Perfdhcp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\International\Geo\Nation	8ac5083f52da0ff312259331f65b326782803aa837a7b371a6d43a021b0c24c3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\International\Geo\Nation	cheac.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 5 IoCs

pid	Process
4740	systeminformer-3.0.7660-release-setup.exe
2960	cheac.exe
1816	Sabad0n.exe
2404	Perfdhcp.exe
4324	unsecapp.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\38384e6a620884	Perfdhcp.exe
File created	C:\Program Files\7-Zip\Lang\9e8d7a4ca61bd9	Perfdhcp.exe
File created	C:\Program Files\Internet Explorer\ja-JP\RuntimeBroker.exe	Perfdhcp.exe
File created	C:\Program Files\Internet Explorer\ja-JP\9e8d7a4ca61bd9	Perfdhcp.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\backgroundTaskHost.exe	Perfdhcp.exe
File created	C:\Program Files (x86)\Windows Media Player\Skins\SearchApp.exe	Perfdhcp.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\ebf1f9fa8afd6d	Perfdhcp.exe
File created	C:\Program Files (x86)\Windows Media Player\Skins\38384e6a620884	Perfdhcp.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\SearchApp.exe	Perfdhcp.exe
File created	C:\Program Files\7-Zip\Lang\RuntimeBroker.exe	Perfdhcp.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\eddb19405b7ce1	Perfdhcp.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\cmd.exe	Perfdhcp.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\AppReadiness\sppsvc.exe	Perfdhcp.exe
File created	C:\Windows\AppReadiness\0a1fd5f707cd16	Perfdhcp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings	cheac.exe
Key created	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings	Perfdhcp.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3288	schtasks.exe
2304	schtasks.exe
5048	schtasks.exe
4644	schtasks.exe
2148	schtasks.exe
4088	schtasks.exe
4492	schtasks.exe
4452	schtasks.exe
3272	schtasks.exe
816	schtasks.exe
1624	schtasks.exe
3540	schtasks.exe
1844	schtasks.exe
4496	schtasks.exe
60	schtasks.exe
4504	schtasks.exe
3476	schtasks.exe
2984	schtasks.exe
1948	schtasks.exe
1932	schtasks.exe
1504	schtasks.exe
3792	schtasks.exe
3968	schtasks.exe
3972	schtasks.exe
4208	schtasks.exe
4284	schtasks.exe
2808	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2404	Perfdhcp.exe
2404	Perfdhcp.exe
2404	Perfdhcp.exe
2404	Perfdhcp.exe
2404	Perfdhcp.exe
1816	Sabad0n.exe
1816	Sabad0n.exe
1816	Sabad0n.exe
1816	Sabad0n.exe
1816	Sabad0n.exe
4324	unsecapp.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2404	Perfdhcp.exe
Token: SeDebugPrivilege	1816	Sabad0n.exe
Token: SeDebugPrivilege	4324	unsecapp.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 4740	4996	8ac5083f52da0ff312259331f65b326782803aa837a7b371a6d43a021b0c24c3.exe	84
PID 4996 wrote to memory of 4740	4996	8ac5083f52da0ff312259331f65b326782803aa837a7b371a6d43a021b0c24c3.exe	84
PID 4996 wrote to memory of 4740	4996	8ac5083f52da0ff312259331f65b326782803aa837a7b371a6d43a021b0c24c3.exe	84
PID 4996 wrote to memory of 2960	4996	8ac5083f52da0ff312259331f65b326782803aa837a7b371a6d43a021b0c24c3.exe	85
PID 4996 wrote to memory of 2960	4996	8ac5083f52da0ff312259331f65b326782803aa837a7b371a6d43a021b0c24c3.exe	85
PID 4996 wrote to memory of 2960	4996	8ac5083f52da0ff312259331f65b326782803aa837a7b371a6d43a021b0c24c3.exe	85
PID 4996 wrote to memory of 1816	4996	8ac5083f52da0ff312259331f65b326782803aa837a7b371a6d43a021b0c24c3.exe	86
PID 4996 wrote to memory of 1816	4996	8ac5083f52da0ff312259331f65b326782803aa837a7b371a6d43a021b0c24c3.exe	86
PID 4996 wrote to memory of 1816	4996	8ac5083f52da0ff312259331f65b326782803aa837a7b371a6d43a021b0c24c3.exe	86
PID 2960 wrote to memory of 996	2960	cheac.exe	87
PID 2960 wrote to memory of 996	2960	cheac.exe	87
PID 2960 wrote to memory of 996	2960	cheac.exe	87
PID 996 wrote to memory of 1204	996	WScript.exe	88
PID 996 wrote to memory of 1204	996	WScript.exe	88
PID 996 wrote to memory of 1204	996	WScript.exe	88
PID 1204 wrote to memory of 2404	1204	cmd.exe	90
PID 1204 wrote to memory of 2404	1204	cmd.exe	90
PID 2404 wrote to memory of 3284	2404	Perfdhcp.exe	119
PID 2404 wrote to memory of 3284	2404	Perfdhcp.exe	119
PID 3284 wrote to memory of 2268	3284	cmd.exe	121
PID 3284 wrote to memory of 2268	3284	cmd.exe	121
PID 3284 wrote to memory of 4324	3284	cmd.exe	122
PID 3284 wrote to memory of 4324	3284	cmd.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8ac5083f52da0ff312259331f65b326782803aa837a7b371a6d43a021b0c24c3.exe
"C:\Users\Admin\AppData\Local\Temp\8ac5083f52da0ff312259331f65b326782803aa837a7b371a6d43a021b0c24c3.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Users\Admin\AppData\Local\Temp\systeminformer-3.0.7660-release-setup.exe
  "C:\Users\Admin\AppData\Local\Temp\systeminformer-3.0.7660-release-setup.exe"
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Users\Admin\AppData\Local\Temp\cheac.exe
  "C:\Users\Admin\AppData\Local\Temp\cheac.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\comagentWinintoBroker\yFjSoONubLQ.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:996
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\comagentWinintoBroker\qElDGILNhHvVBuGpMhQBMCDLwTPJIH.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1204
    - - C:\comagentWinintoBroker\Perfdhcp.exe
        
        "C:\comagentWinintoBroker\Perfdhcp.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2404
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KSncTPSdKm.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3284
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2268
        
        C:\Recovery\WindowsRE\unsecapp.exe
        
        "C:\Recovery\WindowsRE\unsecapp.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4324
- C:\Users\Admin\AppData\Local\Temp\Sabad0n.exe
  "C:\Users\Admin\AppData\Local\Temp\Sabad0n.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Start Menu\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Default\Start Menu\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Start Menu\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\Skins\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Skins\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Media Player\Skins\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:60

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files\7-Zip\Lang\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\Lang\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Windows\AppReadiness\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\AppReadiness\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Windows\AppReadiness\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Internet Explorer\ja-JP\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\ja-JP\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Internet Explorer\ja-JP\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

KSncTPSdKm.bat

Path C:\Users\Admin\AppData\Local\Temp\KSncTPSdKm.bat
Size 199B
SHA256 c3786fe8d1e20e77a9a5737c55da50e9a1ee85e22b2ce566eab2cd0b851c3cc7
MD5 7e535dd0406cc2579ebb59a7ab4af6c1
SHA1 b4813296ec43d02accb99b0acefbeab6e51b1581
SHA512 ad065bcc027ad931afbc12894ced4d24717cef8bf7397bdcdf012eec0168f2668231c6d1f97b513c9f9c7c554135cc4eddf6bf81e26f5c6d88c695dc4bcac92e
MD5 SHA1 SHA512

Submit Download

Sabad0n.exe

Path C:\Users\Admin\AppData\Local\Temp\Sabad0n.exe
Size 300KB
SHA256 d1db41fb98b67cfa0580f3545fa25ebf5a1f694ae9b3950dd78ff04f21670f18
MD5 709905ea492efcd69d9f449c872892a3
SHA1 32d18a64e869879422370120096df2222e34f904
SHA512 751f7c08bdb47e53db055938984202db1d1219d655b25fe169f5eff2ce0d9d81b6d09e4c239a1aaf4f00e0cf1766438e0087a220187db103dad6db3bdedec6e8
SSDEEP 3072:GcZqf7D34xp/0+mAYkygYdQ0ghnB1fA0PuTVAtkxzj3R4eqiOL2bBOA:GcZqf7DIjnGapB1fA0GTV8kJYL
MD5 SHA1 SHA512 SSDEEP

Submit Download

cheac.exe

Path C:\Users\Admin\AppData\Local\Temp\cheac.exe
Size 2.5MB
SHA256 2db9c223644943e13b6d58a160b20ef615861d2ec987a3d669c72dbc7bbdcaa6
MD5 b0a6e75b85e3df3b87b9aea143c6957a
SHA1 133b993cca75e9e89baacf26d891c8e5ee6074e4
SHA512 1c25fdec9cce562d20d686b9016b3bc40a6e62046d8d70419b6aa1a34aef4bbc2d681937d2c9010275a587d0215f92e5d242f66150133af1b42335c9b5b54025
SSDEEP 49152:UbA307PTppZHzYNnd1stxI0QC7Qw8HtWHPU+FJlk50T:Ub/PTrZHzYN2QK8NWHPlJlVT
MD5 SHA1 SHA512 SSDEEP

Submit Download

systeminformer-3.0.7660-release-setup.exe

Path C:\Users\Admin\AppData\Local\Temp\systeminformer-3.0.7660-release-setup.exe
Size 15.1MB
SHA256 a82821a4c18ef940354b84cd625ce0fd8ed5cfba5418014063f054071bd5fccd
MD5 0d909a4a638465a17bc9f37c5024e574
SHA1 eab2bc1ca6ebfa17b95b8cacebcb04043238164e
SHA512 5ca49bb16ef39f1cd7914a083f50f71099934b29baec7a813db16bd89ca1407912e135be7fae9260bc1513d722dbcddd5e841e50cab08f04eea0364f1ccbd324
SSDEEP 393216:kBTNgTDuYpZeQExe0VPa21r0pgTDuYxzQvcSj0/:eNvpHPWQEzY/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Perfdhcp.exe

Path C:\comagentWinintoBroker\Perfdhcp.exe
Size 2.2MB
SHA256 5c6255cdf1e831099e8b4e7c7efe1afa875e1295736e9a64f000ca8c61f65d6e
MD5 1a742aad27d12710d42f36274e85b59e
SHA1 0d6c84c7a9096675c1d210d00ceb90ba5232c5d5
SHA512 22357d21f44c05c5122864c2e7a59a8af37e33519fd777961936a3103c6ebf0eb462e43030876c86060148bbede03462a59969d5cf3f3fe4003c9389ff83bb34
SSDEEP 49152:IPTppZHzYNnd1stxI0QC7Qw8HtWHPU+FJlk50:IPTrZHzYN2QK8NWHPlJlV
MD5 SHA1 SHA512 SSDEEP

Submit Download

qElDGILNhHvVBuGpMhQBMCDLwTPJIH.bat

Path C:\comagentWinintoBroker\qElDGILNhHvVBuGpMhQBMCDLwTPJIH.bat
Size 39B
SHA256 c25305f8cf658c3e10a4d9b375876b207eb667bf2f978f73f66363d635e51626
MD5 e3c8af4a7c9befeccf26c5d665fe90a0
SHA1 092e0953bcff8112a6c6acbd8cedd12998696a75
SHA512 a5fe416e7409357cbbc1336495344ff1753ea96d140dc7da8608fd5b3b32f241dcd541a5d50efa0363b405cdea6aa5a60e18cbea8259302beb4f4375ea4e89be
MD5 SHA1 SHA512

Submit Download

yFjSoONubLQ.vbe

Path C:\comagentWinintoBroker\yFjSoONubLQ.vbe
Size 228B
SHA256 3ed59a88a1b673de3b3f60dd04246efdc55204c129f617f934ebb10fa35ad7b2
MD5 77a46676f244154f11521f33845f801d
SHA1 469ab9d30baa96591d010c300065b97cc7ff47b5
SHA512 dda0a5bd348377c2dafa5070a436c1f48b5081ec1cf3d36caf005ac90ae4d42d46cc4f9db6cdecac3aa1ce6364bbf1fbad20085e1331753863184dbaa3de4cc5
MD5 SHA1 SHA512

Submit Download

memory/1816-40-0x0000000002A20000-0x0000000002A2A000-memory.dmp

Download

memory/1816-82-0x0000000005940000-0x00000000059A6000-memory.dmp

Download

memory/1816-42-0x0000000005F60000-0x0000000006578000-memory.dmp

Download

memory/1816-43-0x00000000051E0000-0x00000000052EA000-memory.dmp

Download

memory/1816-44-0x0000000004EF0000-0x0000000004F02000-memory.dmp

Download

memory/1816-45-0x0000000004F60000-0x0000000004F9C000-memory.dmp

Download

memory/1816-46-0x00000000050D0000-0x000000000511C000-memory.dmp

Download

memory/1816-37-0x0000000005390000-0x0000000005934000-memory.dmp

Download

memory/1816-30-0x0000000000450000-0x00000000004A2000-memory.dmp

Download

memory/1816-85-0x0000000006D60000-0x0000000006DB0000-memory.dmp

Download

memory/1816-84-0x0000000006F90000-0x00000000074BC000-memory.dmp

Download

memory/1816-39-0x0000000004DE0000-0x0000000004E72000-memory.dmp

Download

memory/1816-83-0x0000000006890000-0x0000000006A52000-memory.dmp

Download

memory/2404-53-0x00000000028D0000-0x0000000002920000-memory.dmp

Download

memory/2404-56-0x0000000002920000-0x000000000292E000-memory.dmp

Download

memory/2404-57-0x0000000002930000-0x0000000002938000-memory.dmp

Download

memory/2404-55-0x0000000002880000-0x00000000028D6000-memory.dmp

Download

memory/2404-54-0x0000000002850000-0x0000000002866000-memory.dmp

Download

memory/2404-52-0x0000000002830000-0x000000000284C000-memory.dmp

Download

memory/2404-51-0x00000000004E0000-0x0000000000716000-memory.dmp

Download

memory/4996-28-0x0000000000400000-0x00000000015FF000-memory.dmp

Download