dcrat | c1be767404a3d71717a54b01ebfa91ebff578dad8dd518a1a49012bcf012738e

Resubmissions

27/07/2024, 17:08

240727-vnrrpszapr 10

24/07/2024, 13:55

240724-q8e67aygrr 10

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 13:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e.exe
Size

2.0MB
MD5

40ac7d11ebb91612d8d5c16c05af0a13
SHA1

543a6c16f8f058fb6ba029ee3a9c5fde92aaa212
SHA256

4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e
SHA512

223ecc008fe3b9818597c3870ef605674eb96c52f8f140edb1d7c878691ce16c604440be77107c795a2bbb4e1b5c28ba94141e5703d9488c3a06580e38bf953c
SSDEEP

49152:PbA3HdwWe2aSe6pcUwxE0G+dK7RB7/wWnm1Xl:Pbt2M4cUwxEII7RB0d1Xl

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat 49 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		4948	schtasks.exe
		3532	schtasks.exe
		2024	schtasks.exe
		4416	schtasks.exe
		4424	schtasks.exe
		4124	schtasks.exe
		5020	schtasks.exe
		4436	schtasks.exe
		2952	schtasks.exe
		1064	schtasks.exe
		3132	schtasks.exe
		3984	schtasks.exe
		2208	schtasks.exe
		976	schtasks.exe
		4964	schtasks.exe
		4288	schtasks.exe
		4860	schtasks.exe
		3608	schtasks.exe
		1240	schtasks.exe
		1164	schtasks.exe
		2348	schtasks.exe
		3100	schtasks.exe
		4812	schtasks.exe
		4592	schtasks.exe
		1104	schtasks.exe
		1724	schtasks.exe
		3772	schtasks.exe
		4504	schtasks.exe
		4340	schtasks.exe
		4388	schtasks.exe
		812	schtasks.exe
		4588	schtasks.exe
		4876	schtasks.exe
		1640	schtasks.exe
		3564	schtasks.exe
		5104	schtasks.exe
		2908	schtasks.exe
		1096	schtasks.exe
		1828	schtasks.exe
		368	schtasks.exe
		4308	schtasks.exe
		5056	schtasks.exe
		3680	schtasks.exe
		1552	schtasks.exe
		4596	schtasks.exe
		5008	schtasks.exe
		5036	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e.exe
		1452	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 16 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\WindowsHolographicDevices\\sihost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\dllhost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\WindowsHolographicDevices\\sihost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\WindowsHolographicDevices\\sihost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\dllhost.exe\", \"C:\\Users\\Admin\\csrss.exe\", \"C:\\Users\\Default\\Music\\TextInputHost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\WindowsHolographicDevices\\sihost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\dllhost.exe\", \"C:\\Users\\Admin\\csrss.exe\", \"C:\\Users\\Default\\Music\\TextInputHost.exe\", \"C:\\Windows\\AppReadiness\\TextInputHost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\WindowsHolographicDevices\\sihost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\dllhost.exe\", \"C:\\Users\\Admin\\csrss.exe\", \"C:\\Users\\Default\\Music\\TextInputHost.exe\", \"C:\\Windows\\AppReadiness\\TextInputHost.exe\", \"C:\\Program Files\\Mozilla Firefox\\WaaSMedicAgent.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\WindowsHolographicDevices\\sihost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\dllhost.exe\", \"C:\\Users\\Admin\\csrss.exe\", \"C:\\Users\\Default\\Music\\TextInputHost.exe\", \"C:\\Windows\\AppReadiness\\TextInputHost.exe\", \"C:\\Program Files\\Mozilla Firefox\\WaaSMedicAgent.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files\\Uninstall Information\\SearchApp.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics\\RuntimeBroker.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\WindowsHolographicDevices\\sihost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\dllhost.exe\", \"C:\\Users\\Admin\\csrss.exe\", \"C:\\Users\\Default\\Music\\TextInputHost.exe\", \"C:\\Windows\\AppReadiness\\TextInputHost.exe\", \"C:\\Program Files\\Mozilla Firefox\\WaaSMedicAgent.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\WindowsHolographicDevices\\sihost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\dllhost.exe\", \"C:\\Users\\Admin\\csrss.exe\", \"C:\\Users\\Default\\Music\\TextInputHost.exe\", \"C:\\Windows\\AppReadiness\\TextInputHost.exe\", \"C:\\Program Files\\Mozilla Firefox\\WaaSMedicAgent.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files\\Uninstall Information\\SearchApp.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\componentCommon\\conhost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\WindowsHolographicDevices\\sihost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\dllhost.exe\", \"C:\\Users\\Admin\\csrss.exe\", \"C:\\Users\\Default\\Music\\TextInputHost.exe\", \"C:\\Windows\\AppReadiness\\TextInputHost.exe\", \"C:\\Program Files\\Mozilla Firefox\\WaaSMedicAgent.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files\\Uninstall Information\\SearchApp.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\componentCommon\\conhost.exe\", \"C:\\Users\\Public\\Pictures\\dllhost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\WindowsHolographicDevices\\sihost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\dllhost.exe\", \"C:\\Users\\Admin\\csrss.exe\", \"C:\\Users\\Default\\Music\\TextInputHost.exe\", \"C:\\Windows\\AppReadiness\\TextInputHost.exe\", \"C:\\Program Files\\Mozilla Firefox\\WaaSMedicAgent.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files\\Uninstall Information\\SearchApp.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\componentCommon\\conhost.exe\", \"C:\\Users\\Public\\Pictures\\dllhost.exe\", \"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\WindowsHolographicDevices\\sihost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\dllhost.exe\", \"C:\\Users\\Admin\\csrss.exe\", \"C:\\Users\\Default\\Music\\TextInputHost.exe\", \"C:\\Windows\\AppReadiness\\TextInputHost.exe\", \"C:\\Program Files\\Mozilla Firefox\\WaaSMedicAgent.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files\\Uninstall Information\\SearchApp.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\componentCommon\\conhost.exe\", \"C:\\Users\\Public\\Pictures\\dllhost.exe\", \"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\Windows\\Temp\\MsEdgeCrashpad\\reports\\services.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\WindowsHolographicDevices\\sihost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\dllhost.exe\", \"C:\\Users\\Admin\\csrss.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\WindowsHolographicDevices\\sihost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\dllhost.exe\", \"C:\\Users\\Admin\\csrss.exe\", \"C:\\Users\\Default\\Music\\TextInputHost.exe\", \"C:\\Windows\\AppReadiness\\TextInputHost.exe\", \"C:\\Program Files\\Mozilla Firefox\\WaaSMedicAgent.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files\\Uninstall Information\\SearchApp.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\WindowsHolographicDevices\\sihost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\dllhost.exe\", \"C:\\Users\\Admin\\csrss.exe\", \"C:\\Users\\Default\\Music\\TextInputHost.exe\", \"C:\\Windows\\AppReadiness\\TextInputHost.exe\", \"C:\\Program Files\\Mozilla Firefox\\WaaSMedicAgent.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files\\Uninstall Information\\SearchApp.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\WindowsHolographicDevices\\sihost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\dllhost.exe\", \"C:\\Users\\Admin\\csrss.exe\", \"C:\\Users\\Default\\Music\\TextInputHost.exe\", \"C:\\Windows\\AppReadiness\\TextInputHost.exe\", \"C:\\Program Files\\Mozilla Firefox\\WaaSMedicAgent.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files\\Uninstall Information\\SearchApp.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\componentCommon\\conhost.exe\", \"C:\\Users\\Public\\Pictures\\dllhost.exe\", \"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\RuntimeBroker.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\WindowsHolographicDevices\\sihost.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\dllhost.exe\", \"C:\\Users\\Admin\\csrss.exe\", \"C:\\Users\\Default\\Music\\TextInputHost.exe\", \"C:\\Windows\\AppReadiness\\TextInputHost.exe\", \"C:\\Program Files\\Mozilla Firefox\\WaaSMedicAgent.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files\\Uninstall Information\\SearchApp.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\componentCommon\\conhost.exe\", \"C:\\Users\\Public\\Pictures\\dllhost.exe\", \"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\""	ComInto.exe

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1164	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3680	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4592	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1240	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	812	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4876	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3564	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4436	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3608	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4388	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3984	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4860	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4948	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4812	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4288	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3132	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5036	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4124	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4588	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1828	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3532	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	976	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3100	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4416	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3772	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4340	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4504	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	368	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1452	3720	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5104	3720	schtasks.exe	93

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral22/files/0x00070000000234c3-11.dat	dcrat
behavioral22/memory/4488-13-0x0000000000300000-0x00000000004AC000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	ComInto.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 2 IoCs

pid	Process
4488	ComInto.exe
2264	RuntimeBroker.exe

Adds Run key to start application 2 TTPs 32 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\dllhost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\WindowsRE\\services.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\RuntimeBroker.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Recovery\\WindowsRE\\SearchApp.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\Temp\\MsEdgeCrashpad\\reports\\services.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\dllhost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\WindowsRE\\services.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\RuntimeBroker.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Recovery\\WindowsRE\\SearchApp.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\Temp\\MsEdgeCrashpad\\reports\\services.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Users\\Default\\Music\\TextInputHost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Users\\Default\\Music\\TextInputHost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Program Files\\Uninstall Information\\SearchApp.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics\\RuntimeBroker.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\componentCommon\\conhost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Public\\Pictures\\dllhost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\All Users\\WindowsHolographicDevices\\sihost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Admin\\csrss.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\componentCommon\\conhost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\Program Files\\Mozilla Firefox\\WaaSMedicAgent.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\Program Files\\Mozilla Firefox\\WaaSMedicAgent.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Public\\Pictures\\dllhost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\All Users\\WindowsHolographicDevices\\sihost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Windows\\AppReadiness\\TextInputHost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics\\RuntimeBroker.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Admin\\csrss.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Windows\\AppReadiness\\TextInputHost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Program Files\\Uninstall Information\\SearchApp.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	ComInto.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\dllhost.exe	ComInto.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\5940a34987c991	ComInto.exe
File created	C:\Program Files\Mozilla Firefox\WaaSMedicAgent.exe	ComInto.exe
File created	C:\Program Files\Mozilla Firefox\c82b8037eab33d	ComInto.exe
File created	C:\Program Files\Uninstall Information\SearchApp.exe	ComInto.exe
File created	C:\Program Files\Uninstall Information\38384e6a620884	ComInto.exe
File created	C:\Program Files\ModifiableWindowsApps\OfficeClickToRun.exe	ComInto.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\AppReadiness\TextInputHost.exe	ComInto.exe
File created	C:\Windows\AppReadiness\22eafd247d37c3	ComInto.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings	4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e.exe
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings	ComInto.exe
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5008	schtasks.exe
4592	schtasks.exe
3564	schtasks.exe
2348	schtasks.exe
5036	schtasks.exe
4124	schtasks.exe
4504	schtasks.exe
1552	schtasks.exe
4596	schtasks.exe
4340	schtasks.exe
1064	schtasks.exe
4964	schtasks.exe
3100	schtasks.exe
5104	schtasks.exe
3680	schtasks.exe
3132	schtasks.exe
2908	schtasks.exe
976	schtasks.exe
3772	schtasks.exe
1640	schtasks.exe
812	schtasks.exe
4876	schtasks.exe
4436	schtasks.exe
3608	schtasks.exe
4388	schtasks.exe
3984	schtasks.exe
1096	schtasks.exe
4588	schtasks.exe
4416	schtasks.exe
4424	schtasks.exe
2208	schtasks.exe
368	schtasks.exe
1452	schtasks.exe
2952	schtasks.exe
1240	schtasks.exe
5056	schtasks.exe
4948	schtasks.exe
3532	schtasks.exe
5020	schtasks.exe
1724	schtasks.exe
2024	schtasks.exe
1104	schtasks.exe
1164	schtasks.exe
4860	schtasks.exe
4812	schtasks.exe
4288	schtasks.exe
1828	schtasks.exe
4308	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4488	ComInto.exe
4488	ComInto.exe
4488	ComInto.exe
2264	RuntimeBroker.exe
2264	RuntimeBroker.exe
2264	RuntimeBroker.exe
2264	RuntimeBroker.exe
2264	RuntimeBroker.exe
2264	RuntimeBroker.exe
2264	RuntimeBroker.exe
2264	RuntimeBroker.exe
2264	RuntimeBroker.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2264	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4488	ComInto.exe
Token: SeDebugPrivilege	2264	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 2264	4144	4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e.exe	87
PID 4144 wrote to memory of 2264	4144	4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e.exe	87
PID 4144 wrote to memory of 2264	4144	4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e.exe	87
PID 2264 wrote to memory of 716	2264	WScript.exe	88
PID 2264 wrote to memory of 716	2264	WScript.exe	88
PID 2264 wrote to memory of 716	2264	WScript.exe	88
PID 716 wrote to memory of 4488	716	cmd.exe	90
PID 716 wrote to memory of 4488	716	cmd.exe	90
PID 4488 wrote to memory of 2496	4488	ComInto.exe	143
PID 4488 wrote to memory of 2496	4488	ComInto.exe	143
PID 2496 wrote to memory of 4144	2496	cmd.exe	145
PID 2496 wrote to memory of 4144	2496	cmd.exe	145
PID 2496 wrote to memory of 2264	2496	cmd.exe	147
PID 2496 wrote to memory of 2264	2496	cmd.exe	147
PID 2264 wrote to memory of 4232	2264	RuntimeBroker.exe	150
PID 2264 wrote to memory of 4232	2264	RuntimeBroker.exe	150
PID 2264 wrote to memory of 60	2264	RuntimeBroker.exe	151
PID 2264 wrote to memory of 60	2264	RuntimeBroker.exe	151

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e.exe
"C:\Users\Admin\AppData\Local\Temp\4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e.exe"
1⤵
- DcRat
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\componentCommon\TsZJDcKjHujznUYiyXhQefVwV2.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\componentCommon\j1nvYpGjbyEFrc.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:716
  - - C:\componentCommon\ComInto.exe
      "C:\componentCommon\ComInto.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4488
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CwibFhtnAB.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2496
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4144
      - C:\Program Files\Google\Chrome\Application\SetupMetrics\RuntimeBroker.exe
        
        "C:\Program Files\Google\Chrome\Application\SetupMetrics\RuntimeBroker.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2264
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\18332b48-a768-4125-b262-f6e9b76bfb91.vbs"
        7⤵
        
        PID:4232
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dfd61ddd-4991-4d17-86d6-eaea7f182045.vbs"
        7⤵
        
        PID:60

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\WindowsHolographicDevices\sihost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\All Users\WindowsHolographicDevices\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\WindowsHolographicDevices\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Music\TextInputHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Default\Music\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Music\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Windows\AppReadiness\TextInputHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\AppReadiness\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Windows\AppReadiness\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 14 /tr "'C:\Program Files\Mozilla Firefox\WaaSMedicAgent.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 11 /tr "'C:\Program Files\Mozilla Firefox\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Program Files\Uninstall Information\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Uninstall Information\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\componentCommon\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\componentCommon\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\componentCommon\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Pictures\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\Pictures\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Pictures\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\18332b48-a768-4125-b262-f6e9b76bfb91.vbs

Filesize
749B

MD5
b468399f76a52f4592b91d5db02baec4

SHA1
a4e729f96dffa6c6d7a58a7a095c2766ab70cbaa

SHA256
85e7706a53e924357870cb74d109dc8ba494a05da5c743caec46e7f3e6ca4c3a

SHA512
564e02163589028a7ad0c91b9335c7d72d35cc33804497c49565dfcb0546a99e958d00a37849165a1f831d35d882084d389b32bc44d3944f5eb44ffd000c8ad4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CwibFhtnAB.bat

Filesize
238B

MD5
9e7377c4224c610439a924cb8d137aaf

SHA1
2a6365d64882b993b3bf337ef7bc711a31bf3361

SHA256
8bbada4265ab37d3126237e153764c6fd333d4b44b6dbc04382eba3a0f51f5df

SHA512
066e4c6ba7cc7aecdb4b6018fdcc9f52e2759733b3d2d0063ea3b72497eb55ec6b6947b80bb3702c398bfda47628f34e9aab32be52c633d3786ea540a4ecaa18

Download Submit
C:\Users\Admin\AppData\Local\Temp\dfd61ddd-4991-4d17-86d6-eaea7f182045.vbs

Filesize
525B

MD5
dbd7181633b9e4ad4eb64c71d6285951

SHA1
4595fa913f50b93987583ef9f93bed9528b1739f

SHA256
f268943018ddfc332d3c2d8c30055cdf40466563a9a0d1d69087c5a116ca40af

SHA512
39ac59a7343831a0702cc20a8077a34d84fa074a2756cba228ccf97ed982ec5d3b56db123e9dd2b1a02d8071f45504364d5710ef19b2a9def2f4b1ba21133aec

Download Submit
C:\componentCommon\ComInto.exe

Filesize
1.6MB

MD5
9a0cee5a5ce317b7a70f88bb6aaa49e1

SHA1
95a779063656075a8ddc2f2164393fa59e3c93d9

SHA256
701924dd5d93b99a1e90fcd92f399c4453455e78375125f7a06aca20b84956bc

SHA512
d9c6240b6809c3decbdf4d97aca246f308670097b704b47449c53d8dc121f391d3ec6596f7947c36a01a388eeefe6f9ac9785698cf743f8a89c7cbf7b9da41a4

Download Submit
C:\componentCommon\TsZJDcKjHujznUYiyXhQefVwV2.vbe

Filesize
206B

MD5
e986ea5d4cac976a6de65d3f1ef8b332

SHA1
6465da0abcfac05b8ed1f32b9cca57e2e2f54aea

SHA256
3ad8783bacfea22158df341d1bbedf8f6f0dcc4d9504555b36a756d2fcd83831

SHA512
896934c1a2941a8edfd38b03a858fc589cfb6622ae75019a542638be0c9c4e436aacd0916196dd71442d1a90404afa29d2864c92401222ff5ec2a712d873fa11

Download Submit
C:\componentCommon\j1nvYpGjbyEFrc.bat

Filesize
32B

MD5
a0b9b0891c2cae67cd1beae705d09d4f

SHA1
997953188d6226de19faa0ab4e8fdbddf1fb5617

SHA256
13593fab7a2113730fdbe4cbf436dde9a26116cda0bd4a33dff27d5678e9f9fc

SHA512
bdcd0c6a765c3927180706f7b30f2ea0f7cab6f27e512433839ebe3f6cb148923a6733ae954c24fa6eedeca97b8dc01cae945eea07e1121ff74885a69b34f2bb

Download Submit
memory/4488-21-0x000000001B230000-0x000000001B238000-memory.dmp

Filesize
32KB

Download
memory/4488-24-0x000000001B270000-0x000000001B27C000-memory.dmp

Filesize
48KB

Download
memory/4488-20-0x000000001B110000-0x000000001B120000-memory.dmp

Filesize
64KB

Download
memory/4488-18-0x000000001B0E0000-0x000000001B0F6000-memory.dmp

Filesize
88KB

Download
memory/4488-17-0x00000000024C0000-0x00000000024C8000-memory.dmp

Filesize
32KB

Download
memory/4488-16-0x000000001B280000-0x000000001B2D0000-memory.dmp

Filesize
320KB

Download
memory/4488-15-0x00000000025E0000-0x00000000025FC000-memory.dmp

Filesize
112KB

Download
memory/4488-22-0x000000001B240000-0x000000001B252000-memory.dmp

Filesize
72KB

Download
memory/4488-23-0x000000001BD40000-0x000000001C268000-memory.dmp

Filesize
5.2MB

Download
memory/4488-19-0x000000001B100000-0x000000001B108000-memory.dmp

Filesize
32KB

Download
memory/4488-27-0x000000001B2F0000-0x000000001B2FE000-memory.dmp

Filesize
56KB

Download
memory/4488-28-0x000000001B810000-0x000000001B81C000-memory.dmp

Filesize
48KB

Download
memory/4488-26-0x000000001B2E0000-0x000000001B2EA000-memory.dmp

Filesize
40KB

Download
memory/4488-25-0x000000001B2D0000-0x000000001B2D8000-memory.dmp

Filesize
32KB

Download
memory/4488-29-0x000000001B820000-0x000000001B82C000-memory.dmp

Filesize
48KB

Download
memory/4488-14-0x00000000024B0000-0x00000000024BE000-memory.dmp

Filesize
56KB

Download
memory/4488-13-0x0000000000300000-0x00000000004AC000-memory.dmp

Filesize
1.7MB

Download
memory/4488-12-0x00007FFF96AD3000-0x00007FFF96AD5000-memory.dmp

Filesize
8KB

Download