dcrat | 2338d4f0154b4295202b61eafb9c5e457112de784325f6fc38a587be668024e3

Analysis

max time kernel
107s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c830d62f6f45993891816dee47dee340N.exe
Size 1.7MB
Sample240721-qa36csteqp
SHA256 2338d4f0154b4295202b61eafb9c5e457112de784325f6fc38a587be668024e3
MD5 c830d62f6f45993891816dee47dee340
SHA1 4284963ed30b687ccd47a2d69e6809e4290f0c78
SHA512 d7870eca65c6b6b25b3f7dd788414afd64c075db9bdd1d8b099e932ab571449fe20126d5bde0bd3aaebd2c10ac4160c6ffee1899d8b2b37874f0a996af886fdc
SSDEEP 24576:mwtlgjpoyMl1W9Rl/3XF9R95g9f53Lv+6gJUHGHhuf9QkGuW+4HcWb1JB4nS:BtyotW9RN+f53i1JUHG4xGuDkcY1JB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat execution infostealer persistence rat

Malware Config

Signatures

DcRat 21 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

pid	Process
3656	schtasks.exe
3572	schtasks.exe
2804	schtasks.exe
116	schtasks.exe
996	schtasks.exe
3340	schtasks.exe
2192	schtasks.exe
3128	schtasks.exe
2924	schtasks.exe
1880	schtasks.exe
2224	schtasks.exe
3536	schtasks.exe
2320	schtasks.exe
4988	schtasks.exe
4420	schtasks.exe
4764	schtasks.exe
3780	schtasks.exe
3760	schtasks.exe
2640	schtasks.exe
2576	schtasks.exe
456	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 7 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\RuntimeBroker.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\taskhostw.exe\", \"C:\\Windows\\addins\\winlogon.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\csrss.exe\""	c830d62f6f45993891816dee47dee340N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\RuntimeBroker.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\taskhostw.exe\", \"C:\\Windows\\addins\\winlogon.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\csrss.exe\", \"C:\\Windows\\Panther\\setup.exe\\SearchApp.exe\""	c830d62f6f45993891816dee47dee340N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\RuntimeBroker.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\taskhostw.exe\", \"C:\\Windows\\addins\\winlogon.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\csrss.exe\", \"C:\\Windows\\Panther\\setup.exe\\SearchApp.exe\", \"C:\\Users\\Admin\\OneDrive\\c830d62f6f45993891816dee47dee340N.exe\""	c830d62f6f45993891816dee47dee340N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	c830d62f6f45993891816dee47dee340N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\RuntimeBroker.exe\""	c830d62f6f45993891816dee47dee340N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\RuntimeBroker.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\taskhostw.exe\""	c830d62f6f45993891816dee47dee340N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\RuntimeBroker.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\taskhostw.exe\", \"C:\\Windows\\addins\\winlogon.exe\""	c830d62f6f45993891816dee47dee340N.exe

Process spawned unexpected child process 21 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1880	4012	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	456	4012	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3656	4012	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4988	4012	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	4012	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	4012	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3128	4012	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	4012	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3340	4012	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3536	4012	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	4012	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	4012	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	4012	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	4012	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4420	4012	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	116	4012	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	996	4012	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	4012	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3572	4012	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3780	4012	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3760	4012	schtasks.exe	85

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1428-1-0x0000000000930000-0x0000000000AE2000-memory.dmp	dcrat
behavioral2/files/0x000700000002346f-29.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2376	powershell.exe
4124	powershell.exe
3464	powershell.exe
4788	powershell.exe
1180	powershell.exe
1204	powershell.exe
4276	powershell.exe
2360	powershell.exe
1092	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	c830d62f6f45993891816dee47dee340N.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	c830d62f6f45993891816dee47dee340N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	c830d62f6f45993891816dee47dee340N.exe

Executes dropped EXE 2 IoCs

pid	Process
1548	c830d62f6f45993891816dee47dee340N.exe
2376	SearchApp.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\RuntimeBroker.exe\""	c830d62f6f45993891816dee47dee340N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\csrss.exe\""	c830d62f6f45993891816dee47dee340N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Windows\\Panther\\setup.exe\\SearchApp.exe\""	c830d62f6f45993891816dee47dee340N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\RuntimeBroker.exe\""	c830d62f6f45993891816dee47dee340N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\taskhostw.exe\""	c830d62f6f45993891816dee47dee340N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c830d62f6f45993891816dee47dee340N = "\"C:\\Users\\Admin\\OneDrive\\c830d62f6f45993891816dee47dee340N.exe\""	c830d62f6f45993891816dee47dee340N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\addins\\winlogon.exe\""	c830d62f6f45993891816dee47dee340N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\csrss.exe\""	c830d62f6f45993891816dee47dee340N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\addins\\winlogon.exe\""	c830d62f6f45993891816dee47dee340N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Windows\\Panther\\setup.exe\\SearchApp.exe\""	c830d62f6f45993891816dee47dee340N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c830d62f6f45993891816dee47dee340N = "\"C:\\Users\\Admin\\OneDrive\\c830d62f6f45993891816dee47dee340N.exe\""	c830d62f6f45993891816dee47dee340N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	c830d62f6f45993891816dee47dee340N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	c830d62f6f45993891816dee47dee340N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\taskhostw.exe\""	c830d62f6f45993891816dee47dee340N.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RuntimeBroker.exe	c830d62f6f45993891816dee47dee340N.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\taskhostw.exe	c830d62f6f45993891816dee47dee340N.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\886983d96e3d3e	c830d62f6f45993891816dee47dee340N.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RCX9DF7.tmp	c830d62f6f45993891816dee47dee340N.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RuntimeBroker.exe	c830d62f6f45993891816dee47dee340N.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCX9FFC.tmp	c830d62f6f45993891816dee47dee340N.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\taskhostw.exe	c830d62f6f45993891816dee47dee340N.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCXA405.tmp	c830d62f6f45993891816dee47dee340N.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe	c830d62f6f45993891816dee47dee340N.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\9e8d7a4ca61bd9	c830d62f6f45993891816dee47dee340N.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\ea9f0e6c9e2dcd	c830d62f6f45993891816dee47dee340N.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe	c830d62f6f45993891816dee47dee340N.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\Panther\setup.exe\SearchApp.exe	c830d62f6f45993891816dee47dee340N.exe
File opened for modification	C:\Windows\Panther\setup.exe\SearchApp.exe	c830d62f6f45993891816dee47dee340N.exe
File created	C:\Windows\Panther\setup.exe\38384e6a620884	c830d62f6f45993891816dee47dee340N.exe
File created	C:\Windows\addins\winlogon.exe	c830d62f6f45993891816dee47dee340N.exe
File created	C:\Windows\addins\cc11b995f2a76d	c830d62f6f45993891816dee47dee340N.exe
File opened for modification	C:\Windows\addins\RCXA201.tmp	c830d62f6f45993891816dee47dee340N.exe
File opened for modification	C:\Windows\addins\winlogon.exe	c830d62f6f45993891816dee47dee340N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	c830d62f6f45993891816dee47dee340N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	c830d62f6f45993891816dee47dee340N.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2576	schtasks.exe
3128	schtasks.exe
3536	schtasks.exe
996	schtasks.exe
2320	schtasks.exe
456	schtasks.exe
3656	schtasks.exe
2804	schtasks.exe
3340	schtasks.exe
2640	schtasks.exe
4764	schtasks.exe
3780	schtasks.exe
1880	schtasks.exe
2192	schtasks.exe
4420	schtasks.exe
3572	schtasks.exe
3760	schtasks.exe
4988	schtasks.exe
2224	schtasks.exe
2924	schtasks.exe
116	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
2360	powershell.exe
2360	powershell.exe
3464	powershell.exe
3464	powershell.exe
2376	powershell.exe
2376	powershell.exe
4124	powershell.exe
4124	powershell.exe
1092	powershell.exe
1092	powershell.exe
4276	powershell.exe
4276	powershell.exe
2360	powershell.exe
1428	c830d62f6f45993891816dee47dee340N.exe
3464	powershell.exe
4124	powershell.exe
2376	powershell.exe
1092	powershell.exe
4276	powershell.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1428	c830d62f6f45993891816dee47dee340N.exe
1548	c830d62f6f45993891816dee47dee340N.exe
1548	c830d62f6f45993891816dee47dee340N.exe
1548	c830d62f6f45993891816dee47dee340N.exe
1548	c830d62f6f45993891816dee47dee340N.exe
1548	c830d62f6f45993891816dee47dee340N.exe
1548	c830d62f6f45993891816dee47dee340N.exe
1548	c830d62f6f45993891816dee47dee340N.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	1428	c830d62f6f45993891816dee47dee340N.exe
Token: SeDebugPrivilege	3464	powershell.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeDebugPrivilege	4124	powershell.exe
Token: SeDebugPrivilege	1092	powershell.exe
Token: SeDebugPrivilege	4276	powershell.exe
Token: SeDebugPrivilege	1548	c830d62f6f45993891816dee47dee340N.exe
Token: SeDebugPrivilege	4788	powershell.exe
Token: SeDebugPrivilege	1180	powershell.exe
Token: SeDebugPrivilege	1204	powershell.exe
Token: SeDebugPrivilege	2376	SearchApp.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 4276	1428	c830d62f6f45993891816dee47dee340N.exe	105
PID 1428 wrote to memory of 4276	1428	c830d62f6f45993891816dee47dee340N.exe	105
PID 1428 wrote to memory of 2360	1428	c830d62f6f45993891816dee47dee340N.exe	106
PID 1428 wrote to memory of 2360	1428	c830d62f6f45993891816dee47dee340N.exe	106
PID 1428 wrote to memory of 2376	1428	c830d62f6f45993891816dee47dee340N.exe	107
PID 1428 wrote to memory of 2376	1428	c830d62f6f45993891816dee47dee340N.exe	107
PID 1428 wrote to memory of 4124	1428	c830d62f6f45993891816dee47dee340N.exe	108
PID 1428 wrote to memory of 4124	1428	c830d62f6f45993891816dee47dee340N.exe	108
PID 1428 wrote to memory of 3464	1428	c830d62f6f45993891816dee47dee340N.exe	111
PID 1428 wrote to memory of 3464	1428	c830d62f6f45993891816dee47dee340N.exe	111
PID 1428 wrote to memory of 1092	1428	c830d62f6f45993891816dee47dee340N.exe	113
PID 1428 wrote to memory of 1092	1428	c830d62f6f45993891816dee47dee340N.exe	113
PID 1428 wrote to memory of 1548	1428	c830d62f6f45993891816dee47dee340N.exe	117
PID 1428 wrote to memory of 1548	1428	c830d62f6f45993891816dee47dee340N.exe	117
PID 1548 wrote to memory of 4788	1548	c830d62f6f45993891816dee47dee340N.exe	125
PID 1548 wrote to memory of 4788	1548	c830d62f6f45993891816dee47dee340N.exe	125
PID 1548 wrote to memory of 1180	1548	c830d62f6f45993891816dee47dee340N.exe	126
PID 1548 wrote to memory of 1180	1548	c830d62f6f45993891816dee47dee340N.exe	126
PID 1548 wrote to memory of 1204	1548	c830d62f6f45993891816dee47dee340N.exe	127
PID 1548 wrote to memory of 1204	1548	c830d62f6f45993891816dee47dee340N.exe	127
PID 1548 wrote to memory of 2376	1548	c830d62f6f45993891816dee47dee340N.exe	131
PID 1548 wrote to memory of 2376	1548	c830d62f6f45993891816dee47dee340N.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c830d62f6f45993891816dee47dee340N.exe
"C:\Users\Admin\AppData\Local\Temp\c830d62f6f45993891816dee47dee340N.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\c830d62f6f45993891816dee47dee340N.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\ClientX64\taskhostw.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\addins\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1092
- C:\Users\Admin\AppData\Local\Temp\c830d62f6f45993891816dee47dee340N.exe
  "C:\Users\Admin\AppData\Local\Temp\c830d62f6f45993891816dee47dee340N.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\c830d62f6f45993891816dee47dee340N.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4788
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Panther\setup.exe\SearchApp.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1180
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\OneDrive\c830d62f6f45993891816dee47dee340N.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1204
- - C:\Windows\Panther\setup.exe\SearchApp.exe
    "C:\Windows\Panther\setup.exe\SearchApp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\taskhostw.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Windows\addins\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\addins\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Windows\addins\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Windows\Panther\setup.exe\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\Panther\setup.exe\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Windows\Panther\setup.exe\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "c830d62f6f45993891816dee47dee340Nc" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\OneDrive\c830d62f6f45993891816dee47dee340N.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "c830d62f6f45993891816dee47dee340N" /sc ONLOGON /tr "'C:\Users\Admin\OneDrive\c830d62f6f45993891816dee47dee340N.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "c830d62f6f45993891816dee47dee340Nc" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\OneDrive\c830d62f6f45993891816dee47dee340N.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

csrss.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe
Size 1.7MB
SHA256 2338d4f0154b4295202b61eafb9c5e457112de784325f6fc38a587be668024e3
MD5 c830d62f6f45993891816dee47dee340
SHA1 4284963ed30b687ccd47a2d69e6809e4290f0c78
SHA512 d7870eca65c6b6b25b3f7dd788414afd64c075db9bdd1d8b099e932ab571449fe20126d5bde0bd3aaebd2c10ac4160c6ffee1899d8b2b37874f0a996af886fdc
SSDEEP 24576:mwtlgjpoyMl1W9Rl/3XF9R95g9f53Lv+6gJUHGHhuf9QkGuW+4HcWb1JB4nS:BtyotW9RN+f53i1JUHG4xGuDkcY1JB
MD5 SHA1 SHA512 SSDEEP

Submit Download

c830d62f6f45993891816dee47dee340N.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\c830d62f6f45993891816dee47dee340N.exe.log
Size 1KB
SHA256 29f5645ac14353ac460858f52c856548f3aeb144b09eef672a6b4849bafe742e
MD5 7800fca2323a4130444c572374a030f4
SHA1 40c9b8e0e5e7d72a5293f4010f2ccf21e637b4aa
SHA512 c8a7ad930b8c07007c7a67d8c32a2a4a401dcc34ab966e0e80901655fcbe1f5c95b72a195e6381b1de56c2c987eeab093d8e89891bec9e9684785c5d824b3554
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download