Malware Analysis Report

2024-11-13 13:46

Sample ID 240717-2glqfaseqn
Target 1e55e82940a34f0347e2ec84674cb6c0N.exe
SHA256 8695345472b86220ef4154c2c8f86e301569b082238c84aeff34dea0c5c204e3
Tags
rat dcrat evasion infostealer spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8695345472b86220ef4154c2c8f86e301569b082238c84aeff34dea0c5c204e3

Threat Level: Known bad

The file 1e55e82940a34f0347e2ec84674cb6c0N.exe was found to be: Known bad.

Malicious Activity Summary

rat dcrat evasion infostealer spyware stealer trojan

Process spawned unexpected child process

Dcrat family

DcRat

DCRat payload

UAC bypass

DCRat payload

Disables Task Manager via registry modification

Executes dropped EXE

Reads user/profile data of web browsers

Loads dropped DLL

Checks computer location settings

Legitimate hosting services abused for malware hosting/C2

Checks whether UAC is enabled

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Modifies registry class

Uses Task Scheduler COM API

Scheduled Task/Job: Scheduled Task

Modifies registry key

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

System policy modification

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-17 22:33

Signatures

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Dcrat family

dcrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-17 22:33

Reported

2024-07-17 22:35

Platform

win7-20240704-en

Max time kernel

120s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1e55e82940a34f0347e2ec84674cb6c0N.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\containerreviewCrtMonitordll\chainInto.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\containerreviewCrtMonitordll\chainInto.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\containerreviewCrtMonitordll\chainInto.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Disables Task Manager via registry modification

evasion

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\containerreviewCrtMonitordll\chainInto.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\containerreviewCrtMonitordll\chainInto.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\containerreviewCrtMonitordll\chainInto.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Windows Portable Devices\101b941d020240 C:\containerreviewCrtMonitordll\chainInto.exe N/A
File created C:\Program Files (x86)\Adobe\csrss.exe C:\containerreviewCrtMonitordll\chainInto.exe N/A
File created C:\Program Files (x86)\Adobe\886983d96e3d3e C:\containerreviewCrtMonitordll\chainInto.exe N/A
File created C:\Program Files (x86)\Microsoft Office\MEDIA\csrss.exe C:\containerreviewCrtMonitordll\chainInto.exe N/A
File created C:\Program Files (x86)\Microsoft Office\MEDIA\886983d96e3d3e C:\containerreviewCrtMonitordll\chainInto.exe N/A
File created C:\Program Files\Windows Portable Devices\lsm.exe C:\containerreviewCrtMonitordll\chainInto.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Performance\WinSAT\DataStore\csrss.exe C:\containerreviewCrtMonitordll\chainInto.exe N/A
File created C:\Windows\Performance\WinSAT\DataStore\886983d96e3d3e C:\containerreviewCrtMonitordll\chainInto.exe N/A
File created C:\Windows\Performance\WinSAT\DataStore\WmiPrvSE.exe C:\containerreviewCrtMonitordll\chainInto.exe N/A
File created C:\Windows\Performance\WinSAT\DataStore\24dbde2999530e C:\containerreviewCrtMonitordll\chainInto.exe N/A

Enumerates physical storage devices

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\containerreviewCrtMonitordll\chainInto.exe N/A
N/A N/A C:\containerreviewCrtMonitordll\chainInto.exe N/A
N/A N/A C:\containerreviewCrtMonitordll\chainInto.exe N/A
N/A N/A C:\containerreviewCrtMonitordll\chainInto.exe N/A
N/A N/A C:\containerreviewCrtMonitordll\chainInto.exe N/A
N/A N/A C:\containerreviewCrtMonitordll\chainInto.exe N/A
N/A N/A C:\containerreviewCrtMonitordll\chainInto.exe N/A
N/A N/A C:\containerreviewCrtMonitordll\chainInto.exe N/A
N/A N/A C:\containerreviewCrtMonitordll\chainInto.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
N/A N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\containerreviewCrtMonitordll\chainInto.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2924 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\1e55e82940a34f0347e2ec84674cb6c0N.exe C:\Windows\SysWOW64\WScript.exe
PID 2924 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\1e55e82940a34f0347e2ec84674cb6c0N.exe C:\Windows\SysWOW64\WScript.exe
PID 2924 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\1e55e82940a34f0347e2ec84674cb6c0N.exe C:\Windows\SysWOW64\WScript.exe
PID 2924 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\1e55e82940a34f0347e2ec84674cb6c0N.exe C:\Windows\SysWOW64\WScript.exe
PID 2684 wrote to memory of 2840 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2684 wrote to memory of 2840 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2684 wrote to memory of 2840 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2684 wrote to memory of 2840 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2840 wrote to memory of 1956 N/A C:\Windows\SysWOW64\cmd.exe C:\containerreviewCrtMonitordll\chainInto.exe
PID 2840 wrote to memory of 1956 N/A C:\Windows\SysWOW64\cmd.exe C:\containerreviewCrtMonitordll\chainInto.exe
PID 2840 wrote to memory of 1956 N/A C:\Windows\SysWOW64\cmd.exe C:\containerreviewCrtMonitordll\chainInto.exe
PID 2840 wrote to memory of 1956 N/A C:\Windows\SysWOW64\cmd.exe C:\containerreviewCrtMonitordll\chainInto.exe
PID 1956 wrote to memory of 2440 N/A C:\containerreviewCrtMonitordll\chainInto.exe C:\Windows\System32\cmd.exe
PID 1956 wrote to memory of 2440 N/A C:\containerreviewCrtMonitordll\chainInto.exe C:\Windows\System32\cmd.exe
PID 1956 wrote to memory of 2440 N/A C:\containerreviewCrtMonitordll\chainInto.exe C:\Windows\System32\cmd.exe
PID 2440 wrote to memory of 2268 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2440 wrote to memory of 2268 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2440 wrote to memory of 2268 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2840 wrote to memory of 2216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2840 wrote to memory of 2216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2840 wrote to memory of 2216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2840 wrote to memory of 2216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2440 wrote to memory of 1668 N/A C:\Windows\System32\cmd.exe C:\Windows\Performance\WinSAT\DataStore\csrss.exe
PID 2440 wrote to memory of 1668 N/A C:\Windows\System32\cmd.exe C:\Windows\Performance\WinSAT\DataStore\csrss.exe
PID 2440 wrote to memory of 1668 N/A C:\Windows\System32\cmd.exe C:\Windows\Performance\WinSAT\DataStore\csrss.exe
PID 1668 wrote to memory of 1004 N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe C:\Windows\System32\WScript.exe
PID 1668 wrote to memory of 1004 N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe C:\Windows\System32\WScript.exe
PID 1668 wrote to memory of 1004 N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe C:\Windows\System32\WScript.exe
PID 1668 wrote to memory of 1436 N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe C:\Windows\System32\WScript.exe
PID 1668 wrote to memory of 1436 N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe C:\Windows\System32\WScript.exe
PID 1668 wrote to memory of 1436 N/A C:\Windows\Performance\WinSAT\DataStore\csrss.exe C:\Windows\System32\WScript.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\containerreviewCrtMonitordll\chainInto.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\containerreviewCrtMonitordll\chainInto.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\containerreviewCrtMonitordll\chainInto.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Performance\WinSAT\DataStore\csrss.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\1e55e82940a34f0347e2ec84674cb6c0N.exe

"C:\Users\Admin\AppData\Local\Temp\1e55e82940a34f0347e2ec84674cb6c0N.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\containerreviewCrtMonitordll\QvTRwOydF6PvsPSbsHoz.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\containerreviewCrtMonitordll\1Tl2sJLOUZoaFKUtUGyztdW5bQFfO.bat" "

C:\containerreviewCrtMonitordll\chainInto.exe

"C:\containerreviewCrtMonitordll\chainInto.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Recent\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\Recent\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Recent\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Microsoft\Search\Data\Applications\OSPPSVC.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\Search\Data\Applications\OSPPSVC.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Microsoft\Search\Data\Applications\OSPPSVC.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\containerreviewCrtMonitordll\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\containerreviewCrtMonitordll\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\containerreviewCrtMonitordll\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Pictures\Sample Pictures\cmd.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Public\Pictures\Sample Pictures\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Pictures\Sample Pictures\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\Performance\WinSAT\DataStore\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\DataStore\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\Performance\WinSAT\DataStore\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Office\MEDIA\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\MEDIA\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Office\MEDIA\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Portable Devices\lsm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\lsm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Portable Devices\lsm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Windows\Performance\WinSAT\DataStore\WmiPrvSE.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\DataStore\WmiPrvSE.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Windows\Performance\WinSAT\DataStore\WmiPrvSE.exe'" /rl HIGHEST /f

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5NT8uJA6yK.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Windows\SysWOW64\reg.exe

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Windows\Performance\WinSAT\DataStore\csrss.exe

"C:\Windows\Performance\WinSAT\DataStore\csrss.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2841f8e0-f4ea-4e42-9733-b6c9f8206f15.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\16df5f87-6d2e-40bd-b991-aded0b5b7ff1.vbs"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 pastebin.com udp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 cf53564.tw1.ru udp
RU 185.114.247.170:80 cf53564.tw1.ru tcp
RU 185.114.247.170:80 cf53564.tw1.ru tcp
RU 185.114.247.170:80 cf53564.tw1.ru tcp
RU 185.114.247.170:80 cf53564.tw1.ru tcp
RU 185.114.247.170:80 cf53564.tw1.ru tcp

Files

C:\containerreviewCrtMonitordll\QvTRwOydF6PvsPSbsHoz.vbe

MD5 c9cb24932937faaa045133e6803ba799
SHA1 2b0a00bbb55b5f13a782b4881445a6acf1658d6c
SHA256 0d74b56311e7161e43106e63e697b61e5ea268a86d771d9758a181fbf9a071d4
SHA512 c0607bd0c567b392e74bbdef99c3f5dfdd7e7217ac8aa5d3a9559f94096ee75e01ff686264d5508e84e3dc9a9b4bd0a159e0f4c86dc175c349563c2af3f83838

C:\containerreviewCrtMonitordll\1Tl2sJLOUZoaFKUtUGyztdW5bQFfO.bat

MD5 7039783955d4e215e90cdb16e30d51a8
SHA1 a3ed136fd2a8e57e760d7f1f4412a4c6d96219d4
SHA256 df9a53758d5c34e9422b418b8c28e3f7441dcf2fb48fb81d620e684e50384e84
SHA512 7a7b75ea177c4a46a19ebbae5fb7f0fb18dcec0ea617bb377beace17bf3b34098527153ba58852cc4764083c5bfc86e6602340c81a61366d0da5dea3d3bcfb15

\containerreviewCrtMonitordll\chainInto.exe

MD5 53426df99660bf62cab83572cc516da2
SHA1 e638b51282a10a04d60803920f6ed95b9f9db670
SHA256 390711a4056290cd6dbdc327d81178f7c38ab1850aeb9bde35c1307dd8132481
SHA512 58a3a3a3da60cb8e7132f444136630a1f6f2f9072b65cc24482799b8e69a872ee2d8aedef879b7c1bb248878aee0ef42d2e454a794331318b08020e2457e78f9

memory/1956-13-0x0000000000290000-0x00000000004AA000-memory.dmp

memory/1956-14-0x0000000000750000-0x000000000076C000-memory.dmp

memory/1956-15-0x0000000000770000-0x0000000000778000-memory.dmp

memory/1956-16-0x0000000000780000-0x0000000000790000-memory.dmp

memory/1956-17-0x0000000000B50000-0x0000000000B66000-memory.dmp

memory/1956-18-0x0000000000790000-0x0000000000798000-memory.dmp

memory/1956-19-0x0000000000B90000-0x0000000000BA2000-memory.dmp

memory/1956-20-0x00000000021C0000-0x00000000021D0000-memory.dmp

memory/1956-21-0x0000000000B70000-0x0000000000B7A000-memory.dmp

memory/1956-22-0x0000000000B80000-0x0000000000B8C000-memory.dmp

memory/1956-23-0x00000000021D0000-0x00000000021D8000-memory.dmp

memory/1956-24-0x00000000023A0000-0x00000000023AC000-memory.dmp

memory/1956-25-0x00000000023B0000-0x00000000023C2000-memory.dmp

memory/1956-26-0x00000000023E0000-0x00000000023EC000-memory.dmp

memory/1956-27-0x00000000023F0000-0x00000000023F8000-memory.dmp

memory/1956-28-0x0000000002400000-0x000000000240C000-memory.dmp

memory/1956-29-0x0000000002410000-0x000000000241C000-memory.dmp

memory/1956-30-0x0000000002420000-0x0000000002428000-memory.dmp

memory/1956-31-0x0000000002430000-0x000000000243C000-memory.dmp

memory/1956-34-0x000000001A940000-0x000000001A94E000-memory.dmp

memory/1956-33-0x000000001A930000-0x000000001A93E000-memory.dmp

memory/1956-32-0x0000000002440000-0x000000000244A000-memory.dmp

memory/1956-35-0x000000001A950000-0x000000001A95A000-memory.dmp

memory/1956-36-0x000000001A960000-0x000000001A96C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5NT8uJA6yK.bat

MD5 7b458011a79649006674262299579150
SHA1 62e8e1a9555e570f3d3f5342ace96b7ef6a3f114
SHA256 aa44b3ae6636c2423eff620f1830e82102cc98a1e7f9a00f38ad7f195de4e095
SHA512 e90073cafc5b8a566b2a258f85258ef6046e7093120e048d7bfd7f68f3a12fbb9001182f51c7ae5bb3651e41190997cd1573ea6b389e74568152157835909f2f

memory/1668-62-0x0000000000CF0000-0x0000000000F0A000-memory.dmp

memory/1668-63-0x0000000000750000-0x0000000000762000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2841f8e0-f4ea-4e42-9733-b6c9f8206f15.vbs

MD5 2cf5c15983203b822390f53b99fc5d37
SHA1 f4b207ace7ed0abaf6134f1b1b493eadfeb76700
SHA256 f9c5d9b52326026143529a075b207c0c67c21e4cf14c7d36c00e5a2d1222e537
SHA512 b8807f92f50345697b761eff6c43d80171420b741627ef8d2c7c019089b3e611f77bf7d7fcecd9142bc52ce515916fa362ce3721617efcfcf629c11a01ddf65a

C:\Users\Admin\AppData\Local\Temp\16df5f87-6d2e-40bd-b991-aded0b5b7ff1.vbs

MD5 9aaaad7372c564ff352faff5b6da619f
SHA1 0c6d02130703e3ef7bd84c2d5877cea0ddd47f94
SHA256 dd6377131710bbafa5d8535e97d85983a9babb3875a7b49fc03813400e1b4d59
SHA512 b8eccbaf34b1eb316f6856866e581c513bb9da63c24a012989d556f581b3f21871aadc13067ebac594b63d5fc2294245acdcbf1b60ca930e00d2dd0333ccece2

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-17 22:33

Reported

2024-07-17 22:35

Platform

win10v2004-20240709-en

Max time kernel

120s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1e55e82940a34f0347e2ec84674cb6c0N.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\containerreviewCrtMonitordll\chainInto.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\containerreviewCrtMonitordll\chainInto.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\containerreviewCrtMonitordll\chainInto.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Disables Task Manager via registry modification

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation C:\containerreviewCrtMonitordll\chainInto.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1e55e82940a34f0347e2ec84674cb6c0N.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\containerreviewCrtMonitordll\chainInto.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\containerreviewCrtMonitordll\chainInto.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\containerreviewCrtMonitordll\chainInto.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\38384e6a620884 C:\containerreviewCrtMonitordll\chainInto.exe N/A
File created C:\Program Files\Windows Sidebar\RuntimeBroker.exe C:\containerreviewCrtMonitordll\chainInto.exe N/A
File created C:\Program Files\Windows Sidebar\9e8d7a4ca61bd9 C:\containerreviewCrtMonitordll\chainInto.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\SearchApp.exe C:\containerreviewCrtMonitordll\chainInto.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\1e55e82940a34f0347e2ec84674cb6c0N.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000_Classes\Local Settings C:\containerreviewCrtMonitordll\chainInto.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000_Classes\Local Settings C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\containerreviewCrtMonitordll\chainInto.exe N/A
N/A N/A C:\containerreviewCrtMonitordll\chainInto.exe N/A
N/A N/A C:\containerreviewCrtMonitordll\chainInto.exe N/A
N/A N/A C:\containerreviewCrtMonitordll\chainInto.exe N/A
N/A N/A C:\containerreviewCrtMonitordll\chainInto.exe N/A
N/A N/A C:\containerreviewCrtMonitordll\chainInto.exe N/A
N/A N/A C:\containerreviewCrtMonitordll\chainInto.exe N/A
N/A N/A C:\containerreviewCrtMonitordll\chainInto.exe N/A
N/A N/A C:\containerreviewCrtMonitordll\chainInto.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
N/A N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\containerreviewCrtMonitordll\chainInto.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1264 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\1e55e82940a34f0347e2ec84674cb6c0N.exe C:\Windows\SysWOW64\WScript.exe
PID 1264 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\1e55e82940a34f0347e2ec84674cb6c0N.exe C:\Windows\SysWOW64\WScript.exe
PID 1264 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\1e55e82940a34f0347e2ec84674cb6c0N.exe C:\Windows\SysWOW64\WScript.exe
PID 1696 wrote to memory of 4568 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1696 wrote to memory of 4568 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1696 wrote to memory of 4568 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4568 wrote to memory of 1756 N/A C:\Windows\SysWOW64\cmd.exe C:\containerreviewCrtMonitordll\chainInto.exe
PID 4568 wrote to memory of 1756 N/A C:\Windows\SysWOW64\cmd.exe C:\containerreviewCrtMonitordll\chainInto.exe
PID 1756 wrote to memory of 4728 N/A C:\containerreviewCrtMonitordll\chainInto.exe C:\Windows\System32\cmd.exe
PID 1756 wrote to memory of 4728 N/A C:\containerreviewCrtMonitordll\chainInto.exe C:\Windows\System32\cmd.exe
PID 4568 wrote to memory of 2164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4568 wrote to memory of 2164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4568 wrote to memory of 2164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4728 wrote to memory of 3192 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 4728 wrote to memory of 3192 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 4728 wrote to memory of 5084 N/A C:\Windows\System32\cmd.exe C:\Program Files\Windows Sidebar\RuntimeBroker.exe
PID 4728 wrote to memory of 5084 N/A C:\Windows\System32\cmd.exe C:\Program Files\Windows Sidebar\RuntimeBroker.exe
PID 5084 wrote to memory of 5020 N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe C:\Windows\System32\WScript.exe
PID 5084 wrote to memory of 5020 N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe C:\Windows\System32\WScript.exe
PID 5084 wrote to memory of 4752 N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe C:\Windows\System32\WScript.exe
PID 5084 wrote to memory of 4752 N/A C:\Program Files\Windows Sidebar\RuntimeBroker.exe C:\Windows\System32\WScript.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\containerreviewCrtMonitordll\chainInto.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\containerreviewCrtMonitordll\chainInto.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\containerreviewCrtMonitordll\chainInto.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Windows Sidebar\RuntimeBroker.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\1e55e82940a34f0347e2ec84674cb6c0N.exe

"C:\Users\Admin\AppData\Local\Temp\1e55e82940a34f0347e2ec84674cb6c0N.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\containerreviewCrtMonitordll\QvTRwOydF6PvsPSbsHoz.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\containerreviewCrtMonitordll\1Tl2sJLOUZoaFKUtUGyztdW5bQFfO.bat" "

C:\containerreviewCrtMonitordll\chainInto.exe

"C:\containerreviewCrtMonitordll\chainInto.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\containerreviewCrtMonitordll\sppsvc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\containerreviewCrtMonitordll\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\containerreviewCrtMonitordll\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\SearchApp.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\SearchApp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\SearchApp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Sidebar\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\containerreviewCrtMonitordll\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\containerreviewCrtMonitordll\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\containerreviewCrtMonitordll\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\containerreviewCrtMonitordll\WmiPrvSE.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\containerreviewCrtMonitordll\WmiPrvSE.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\containerreviewCrtMonitordll\WmiPrvSE.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\containerreviewCrtMonitordll\StartMenuExperienceHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\containerreviewCrtMonitordll\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\containerreviewCrtMonitordll\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KTdiCR95eO.bat"

C:\Windows\SysWOW64\reg.exe

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files\Windows Sidebar\RuntimeBroker.exe

"C:\Program Files\Windows Sidebar\RuntimeBroker.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\849733cd-f3bb-405d-b0cf-0783b4ff1a7a.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\737da2e8-1b26-4020-88b8-daa7507ea84c.vbs"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 172.67.19.24:443 pastebin.com tcp
US 8.8.8.8:53 cf53564.tw1.ru udp
RU 185.114.247.170:80 cf53564.tw1.ru tcp
US 8.8.8.8:53 24.19.67.172.in-addr.arpa udp
RU 185.114.247.170:80 cf53564.tw1.ru tcp
US 8.8.8.8:53 170.247.114.185.in-addr.arpa udp
RU 185.114.247.170:80 cf53564.tw1.ru tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
RU 185.114.247.170:80 cf53564.tw1.ru tcp
IE 52.111.236.21:443 tcp
RU 185.114.247.170:80 cf53564.tw1.ru tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

C:\containerreviewCrtMonitordll\QvTRwOydF6PvsPSbsHoz.vbe

MD5 c9cb24932937faaa045133e6803ba799
SHA1 2b0a00bbb55b5f13a782b4881445a6acf1658d6c
SHA256 0d74b56311e7161e43106e63e697b61e5ea268a86d771d9758a181fbf9a071d4
SHA512 c0607bd0c567b392e74bbdef99c3f5dfdd7e7217ac8aa5d3a9559f94096ee75e01ff686264d5508e84e3dc9a9b4bd0a159e0f4c86dc175c349563c2af3f83838

C:\containerreviewCrtMonitordll\1Tl2sJLOUZoaFKUtUGyztdW5bQFfO.bat

MD5 7039783955d4e215e90cdb16e30d51a8
SHA1 a3ed136fd2a8e57e760d7f1f4412a4c6d96219d4
SHA256 df9a53758d5c34e9422b418b8c28e3f7441dcf2fb48fb81d620e684e50384e84
SHA512 7a7b75ea177c4a46a19ebbae5fb7f0fb18dcec0ea617bb377beace17bf3b34098527153ba58852cc4764083c5bfc86e6602340c81a61366d0da5dea3d3bcfb15

C:\containerreviewCrtMonitordll\chainInto.exe

MD5 53426df99660bf62cab83572cc516da2
SHA1 e638b51282a10a04d60803920f6ed95b9f9db670
SHA256 390711a4056290cd6dbdc327d81178f7c38ab1850aeb9bde35c1307dd8132481
SHA512 58a3a3a3da60cb8e7132f444136630a1f6f2f9072b65cc24482799b8e69a872ee2d8aedef879b7c1bb248878aee0ef42d2e454a794331318b08020e2457e78f9

memory/1756-12-0x00007FF8B4943000-0x00007FF8B4945000-memory.dmp

memory/1756-13-0x0000000000510000-0x000000000072A000-memory.dmp

memory/1756-14-0x00000000010A0000-0x00000000010BC000-memory.dmp

memory/1756-15-0x000000001B3D0000-0x000000001B420000-memory.dmp

memory/1756-16-0x00000000010C0000-0x00000000010C8000-memory.dmp

memory/1756-17-0x0000000002980000-0x0000000002990000-memory.dmp

memory/1756-18-0x0000000002990000-0x00000000029A6000-memory.dmp

memory/1756-20-0x00000000029E0000-0x00000000029F2000-memory.dmp

memory/1756-19-0x00000000029B0000-0x00000000029B8000-memory.dmp

memory/1756-21-0x000000001B420000-0x000000001B430000-memory.dmp

memory/1756-22-0x00000000029C0000-0x00000000029CA000-memory.dmp

memory/1756-23-0x00000000029D0000-0x00000000029DC000-memory.dmp

memory/1756-24-0x000000001B430000-0x000000001B438000-memory.dmp

memory/1756-25-0x000000001B440000-0x000000001B44C000-memory.dmp

memory/1756-26-0x000000001BB60000-0x000000001BB72000-memory.dmp

memory/1756-27-0x000000001C0C0000-0x000000001C5E8000-memory.dmp

memory/1756-28-0x000000001BB90000-0x000000001BB9C000-memory.dmp

memory/1756-30-0x000000001BBB0000-0x000000001BBBC000-memory.dmp

memory/1756-31-0x000000001BBC0000-0x000000001BBCC000-memory.dmp

memory/1756-29-0x000000001BBA0000-0x000000001BBA8000-memory.dmp

memory/1756-33-0x000000001BCD0000-0x000000001BCDC000-memory.dmp

memory/1756-32-0x000000001BE40000-0x000000001BE48000-memory.dmp

memory/1756-36-0x000000001BE00000-0x000000001BE0E000-memory.dmp

memory/1756-35-0x000000001BCF0000-0x000000001BCFE000-memory.dmp

memory/1756-34-0x000000001BCE0000-0x000000001BCEA000-memory.dmp

memory/1756-37-0x000000001BE10000-0x000000001BE1A000-memory.dmp

memory/1756-38-0x000000001BE20000-0x000000001BE2C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\KTdiCR95eO.bat

MD5 caa1cf3c296a2726a4234c250d9499a2
SHA1 a3b4f75e1da358e1e315f51361318e7461a0f55a
SHA256 b9ea3b0d26667e189b4c1582da66f293e94cba1af7e992fc4c687b8939c20f62
SHA512 96239272a3cb4693de3a79c594a94fca327bafd2a53a911bbbc6964f5db5c42a54c05b8588390f9447c12c1a36f61b9f9a1bde6483a3bf73e7a234bc1f55f097

memory/5084-62-0x000000001CC40000-0x000000001CC52000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\849733cd-f3bb-405d-b0cf-0783b4ff1a7a.vbs

MD5 8564f6464a4db984e793f582c2a09494
SHA1 4da13edcccbd7b5ca085033c204cf0fa0aa65e7c
SHA256 c28fe11185242c7570bbc75355ece32f7be1a815764e8a1fbfc2cd24952a4250
SHA512 395756d6e09d2ecd1190158317e5f46379ab4827f298f25b723d59f0862b1452ab30d49ffaadd98af025ba75a03d92fee842530435dbbf93c03ed10d4138b43d

C:\Users\Admin\AppData\Local\Temp\737da2e8-1b26-4020-88b8-daa7507ea84c.vbs

MD5 7aa1a991f29a40b8a10e02291f66ac62
SHA1 e978fbe62a82392cd3e1902ed19230fd7a727f9d
SHA256 93500c3e952422665868d08ad9ac99596f8e65f8a1ea78bd6d9adc4b5ac17827
SHA512 1047f0e8eadbd42616c9d4c701bd63573085f0c09418726a0b90dd67a71a468ba35b938588a3afa655fa4fe266d2edbe2e32d4985858fe689547e690d817b4c2

memory/5084-72-0x000000001EB40000-0x000000001ED02000-memory.dmp

memory/5084-123-0x000000001F4C0000-0x000000001F669000-memory.dmp