dcrat | 2c9593138be6c386946e31595ccdd5550922ef3fdd843fbb5f1e83634c223a2a

General

Target

LisectAVT_2403002A_442.exe
Size

2.2MB
MD5

519c9f6fedeb43a8d129230fed9a2108
SHA1

534ce363aa81cba33e01330d449c081f6b5e4f87
SHA256

2c9593138be6c386946e31595ccdd5550922ef3fdd843fbb5f1e83634c223a2a
SHA512

ac8c10418e8ed4c2338378af4c8233196a2982405c551e033e0375c5abf523a552312b7c5664d1aed246e3177ac71c0ade7ecca3204ddb2cf1406ea055445521
SSDEEP

49152:UbA30bEln+8YPyZc6wkQbPVqlC8m5saKHaFg3:UbUJ+lyZKjVJDWaA

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat 14 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeLisectAVT_2403002A_442.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2444	schtasks.exe
2024	schtasks.exe
2016	schtasks.exe
2948	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LisectAVT_2403002A_442.exe
1744	schtasks.exe
2272	schtasks.exe
2808	schtasks.exe
2640	schtasks.exe
3052	schtasks.exe
284	schtasks.exe
2712	schtasks.exe
892	schtasks.exe
1520	schtasks.exe

Process spawned unexpected child process 13 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	2928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	2928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	2928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	2928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	892	2928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	2928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	2928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	2928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	2928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	2928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	2928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	284	2928	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	2928	schtasks.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\perfCrtmonitorsvc\perfCrtmonitorsvcMonitorDll.exe	dcrat
behavioral1/memory/2940-13-0x00000000002F0000-0x00000000004DA000-memory.dmp	dcrat
behavioral1/memory/1904-34-0x0000000000B70000-0x0000000000D5A000-memory.dmp	dcrat
behavioral1/memory/2400-54-0x00000000000B0000-0x000000000029A000-memory.dmp	dcrat

Executes dropped EXE 3 IoCs

Processes:

perfCrtmonitorsvcMonitorDll.exeperfCrtmonitorsvcMonitorDll.exeOSPPSVC.exe

pid process

2940 perfCrtmonitorsvcMonitorDll.exe
1904 perfCrtmonitorsvcMonitorDll.exe
2400 OSPPSVC.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

2924 cmd.exe
2924 cmd.exe

pid	process
2940	perfCrtmonitorsvcMonitorDll.exe
1904	perfCrtmonitorsvcMonitorDll.exe
2400	OSPPSVC.exe

pid	process
2924	cmd.exe
2924	cmd.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

perfCrtmonitorsvcMonitorDll.exeperfCrtmonitorsvcMonitorDll.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\System32\\FXSRESM\\wininit.exe\""	perfCrtmonitorsvcMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\System32\\wbem\\repdrvfs\\WmiPrvSE.exe\""	perfCrtmonitorsvcMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files (x86)\\Windows Mail\\de-DE\\sppsvc.exe\""	perfCrtmonitorsvcMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\System32\\Robocopy\\smss.exe\""	perfCrtmonitorsvcMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\conhost.exe\""	perfCrtmonitorsvcMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\System32\\KBDPASH\\smss.exe\""	perfCrtmonitorsvcMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files (x86)\\Windows Sidebar\\lsm.exe\""	perfCrtmonitorsvcMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\wininit.exe\""	perfCrtmonitorsvcMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Documents and Settings\\winlogon.exe\""	perfCrtmonitorsvcMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\System32\\KBDTH3\\wininit.exe\""	perfCrtmonitorsvcMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\smss.exe\""	perfCrtmonitorsvcMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Program Files (x86)\\Google\\Update\\1.3.36.151\\OSPPSVC.exe\""	perfCrtmonitorsvcMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\System32\\iprtrmgr\\sppsvc.exe\""	perfCrtmonitorsvcMonitorDll.exe

Drops file in System32 directory 13 IoCs

Processes:

perfCrtmonitorsvcMonitorDll.exeperfCrtmonitorsvcMonitorDll.exe

description	ioc	process
File created	C:\Windows\System32\wbem\repdrvfs\WmiPrvSE.exe	perfCrtmonitorsvcMonitorDll.exe
File created	C:\Windows\System32\wbem\repdrvfs\24dbde2999530ef5fd907494bc374d663924116c	perfCrtmonitorsvcMonitorDll.exe
File created	C:\Windows\System32\KBDPASH\smss.exe	perfCrtmonitorsvcMonitorDll.exe
File created	C:\Windows\System32\iprtrmgr\sppsvc.exe	perfCrtmonitorsvcMonitorDll.exe
File created	C:\Windows\System32\Robocopy\smss.exe	perfCrtmonitorsvcMonitorDll.exe
File created	C:\Windows\System32\KBDTH3\wininit.exe	perfCrtmonitorsvcMonitorDll.exe
File created	C:\Windows\System32\FXSRESM\wininit.exe	perfCrtmonitorsvcMonitorDll.exe
File created	C:\Windows\System32\iprtrmgr\0a1fd5f707cd16ea89afd3d6db52b2da58214a6c	perfCrtmonitorsvcMonitorDll.exe
File opened for modification	C:\Windows\System32\KBDPASH\smss.exe	perfCrtmonitorsvcMonitorDll.exe
File created	C:\Windows\System32\KBDPASH\69ddcba757bf72f7d36c464c71f42baab150b2b9	perfCrtmonitorsvcMonitorDll.exe
File created	C:\Windows\System32\FXSRESM\560854153607923c4c5f107085a7db67be01f252	perfCrtmonitorsvcMonitorDll.exe
File created	C:\Windows\System32\Robocopy\69ddcba757bf72f7d36c464c71f42baab150b2b9	perfCrtmonitorsvcMonitorDll.exe
File created	C:\Windows\System32\KBDTH3\560854153607923c4c5f107085a7db67be01f252	perfCrtmonitorsvcMonitorDll.exe

Drops file in Program Files directory 11 IoCs

Processes:

perfCrtmonitorsvcMonitorDll.exeperfCrtmonitorsvcMonitorDll.exe

description	ioc	process
File created	C:\Program Files (x86)\Windows Sidebar\101b941d020240259ca4912829b53995ad543df6	perfCrtmonitorsvcMonitorDll.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\OSPPSVC.exe	perfCrtmonitorsvcMonitorDll.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.151\1610b97d3ab4a74cd8ae104b51bea7bfcc5b9c6f	perfCrtmonitorsvcMonitorDll.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\560854153607923c4c5f107085a7db67be01f252	perfCrtmonitorsvcMonitorDll.exe
File created	C:\Program Files (x86)\Windows Mail\de-DE\sppsvc.exe	perfCrtmonitorsvcMonitorDll.exe
File created	C:\Program Files (x86)\Windows Sidebar\lsm.exe	perfCrtmonitorsvcMonitorDll.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\088424020bedd6b28ac7fd22ee35dcd7322895ce	perfCrtmonitorsvcMonitorDll.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.151\OSPPSVC.exe	perfCrtmonitorsvcMonitorDll.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\wininit.exe	perfCrtmonitorsvcMonitorDll.exe
File created	C:\Program Files (x86)\Windows Mail\de-DE\0a1fd5f707cd16ea89afd3d6db52b2da58214a6c	perfCrtmonitorsvcMonitorDll.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\conhost.exe	perfCrtmonitorsvcMonitorDll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

WScript.execmd.exeLisectAVT_2403002A_442.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LisectAVT_2403002A_442.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2024	schtasks.exe
892	schtasks.exe
2712	schtasks.exe
2272	schtasks.exe
2444	schtasks.exe
1520	schtasks.exe
284	schtasks.exe
2808	schtasks.exe
3052	schtasks.exe
2016	schtasks.exe
2948	schtasks.exe
1744	schtasks.exe
2640	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

perfCrtmonitorsvcMonitorDll.exeperfCrtmonitorsvcMonitorDll.exeOSPPSVC.exe

pid process

2940 perfCrtmonitorsvcMonitorDll.exe
1904 perfCrtmonitorsvcMonitorDll.exe
2400 OSPPSVC.exe

pid	process
2940	perfCrtmonitorsvcMonitorDll.exe
1904	perfCrtmonitorsvcMonitorDll.exe
2400	OSPPSVC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

perfCrtmonitorsvcMonitorDll.exeperfCrtmonitorsvcMonitorDll.exeOSPPSVC.exe

description	pid	process
Token: SeDebugPrivilege	2940	perfCrtmonitorsvcMonitorDll.exe
Token: SeDebugPrivilege	1904	perfCrtmonitorsvcMonitorDll.exe
Token: SeDebugPrivilege	2400	OSPPSVC.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

LisectAVT_2403002A_442.exeWScript.execmd.exeperfCrtmonitorsvcMonitorDll.execmd.exeperfCrtmonitorsvcMonitorDll.execmd.exe

description	pid	process	target process
PID 3040 wrote to memory of 2984	3040	LisectAVT_2403002A_442.exe	WScript.exe
PID 3040 wrote to memory of 2984	3040	LisectAVT_2403002A_442.exe	WScript.exe
PID 3040 wrote to memory of 2984	3040	LisectAVT_2403002A_442.exe	WScript.exe
PID 3040 wrote to memory of 2984	3040	LisectAVT_2403002A_442.exe	WScript.exe
PID 2984 wrote to memory of 2924	2984	WScript.exe	cmd.exe
PID 2984 wrote to memory of 2924	2984	WScript.exe	cmd.exe
PID 2984 wrote to memory of 2924	2984	WScript.exe	cmd.exe
PID 2984 wrote to memory of 2924	2984	WScript.exe	cmd.exe
PID 2924 wrote to memory of 2940	2924	cmd.exe	perfCrtmonitorsvcMonitorDll.exe
PID 2924 wrote to memory of 2940	2924	cmd.exe	perfCrtmonitorsvcMonitorDll.exe
PID 2924 wrote to memory of 2940	2924	cmd.exe	perfCrtmonitorsvcMonitorDll.exe
PID 2924 wrote to memory of 2940	2924	cmd.exe	perfCrtmonitorsvcMonitorDll.exe
PID 2940 wrote to memory of 2172	2940	perfCrtmonitorsvcMonitorDll.exe	cmd.exe
PID 2940 wrote to memory of 2172	2940	perfCrtmonitorsvcMonitorDll.exe	cmd.exe
PID 2940 wrote to memory of 2172	2940	perfCrtmonitorsvcMonitorDll.exe	cmd.exe
PID 2172 wrote to memory of 580	2172	cmd.exe	w32tm.exe
PID 2172 wrote to memory of 580	2172	cmd.exe	w32tm.exe
PID 2172 wrote to memory of 580	2172	cmd.exe	w32tm.exe
PID 2172 wrote to memory of 1904	2172	cmd.exe	perfCrtmonitorsvcMonitorDll.exe
PID 2172 wrote to memory of 1904	2172	cmd.exe	perfCrtmonitorsvcMonitorDll.exe
PID 2172 wrote to memory of 1904	2172	cmd.exe	perfCrtmonitorsvcMonitorDll.exe
PID 1904 wrote to memory of 2616	1904	perfCrtmonitorsvcMonitorDll.exe	cmd.exe
PID 1904 wrote to memory of 2616	1904	perfCrtmonitorsvcMonitorDll.exe	cmd.exe
PID 1904 wrote to memory of 2616	1904	perfCrtmonitorsvcMonitorDll.exe	cmd.exe
PID 2616 wrote to memory of 2280	2616	cmd.exe	w32tm.exe
PID 2616 wrote to memory of 2280	2616	cmd.exe	w32tm.exe
PID 2616 wrote to memory of 2280	2616	cmd.exe	w32tm.exe
PID 2616 wrote to memory of 2400	2616	cmd.exe	OSPPSVC.exe
PID 2616 wrote to memory of 2400	2616	cmd.exe	OSPPSVC.exe
PID 2616 wrote to memory of 2400	2616	cmd.exe	OSPPSVC.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002A_442.exe
"C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002A_442.exe"
1⤵
- DcRat
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3040

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\perfCrtmonitorsvc\Uj422BG5H91CLq69Aho3ql.vbe"
2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2984

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\perfCrtmonitorsvc\Jg3j8KEAq3O.bat" "
3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924

C:\Users\Admin\AppData\Local\Temp\perfCrtmonitorsvc\perfCrtmonitorsvcMonitorDll.exe
"C:\Users\Admin\AppData\Local\Temp\perfCrtmonitorsvc\perfCrtmonitorsvcMonitorDll.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2940

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tT7arhAqrI.bat"
5⤵
- Suspicious use of WriteProcessMemory
PID:2172

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
6⤵
PID:580

C:\Users\Admin\AppData\Local\Temp\perfCrtmonitorsvc\perfCrtmonitorsvcMonitorDll.exe
"C:\Users\Admin\AppData\Local\Temp\perfCrtmonitorsvc\perfCrtmonitorsvcMonitorDll.exe"
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AfFockJbhQ.bat"
7⤵
- Suspicious use of WriteProcessMemory
PID:2616

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
8⤵
PID:2280

C:\Program Files (x86)\Google\Update\1.3.36.151\OSPPSVC.exe
"C:\Program Files (x86)\Google\Update\1.3.36.151\OSPPSVC.exe"
8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\System32\KBDPASH\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\de-DE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\System32\Robocopy\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Documents and Settings\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\KBDTH3\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\1.3.36.151\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\FXSRESM\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\System32\iprtrmgr\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\repdrvfs\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AfFockJbhQ.bat

Filesize
223B

MD5
6ce907b9a810fb05476e7b2893bd631a

SHA1
cc853a36df6bef911cdf01762e71d357f42cf191

SHA256
34ad5c8be19c04bb016a2e758e5022e020c4869d047e0fd478bcf97becf07f38

SHA512
81845e9ba5986763d9bc9149a17a83832498a3dbdb574f3841f62d47af120c5cec6d4352110ce527369d67bf0324553faec9f48dd0417e2ba5b354e6dfe9ba1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\perfCrtmonitorsvc\Jg3j8KEAq3O.bat

Filesize
58B

MD5
7c719c66000b0a22a451c0e4d3cdebf7

SHA1
6ed1082ffd2f07f82b0bac5753cd8e1bf3e12096

SHA256
711c9f3ea1cef74cf02fe1c4d98063a5d436f47db265491ddc4acfb48953fdd1

SHA512
97cb02f8def90e31bb094c14882f818033dc98e9297a0d5f8ad158ee1fede3608c13ae5b9e18d6a1f72f24450371593aa3d53f4a8e47dd555a1cf36d65997808

Download Submit
C:\Users\Admin\AppData\Local\Temp\perfCrtmonitorsvc\Uj422BG5H91CLq69Aho3ql.vbe

Filesize
209B

MD5
b5ed2f061cf45ffd03bf99d750ace127

SHA1
23c74c327a8f47715534af018463eaaf82f4ba2a

SHA256
73755d7f9485eba68d61877c9d61950324c6d38eb0ed5005ed06dd0efdaa6a35

SHA512
a5c4577f60be3cf693f9c8904b632e2b25adf9696ba38caa68dc7f4fd47fa9c89dee3afe5656b6ecf9148a1ec4ff3bb09ce054b4eafacb4fe709ea61efc78419

Download Submit
C:\Users\Admin\AppData\Local\Temp\tT7arhAqrI.bat

Filesize
247B

MD5
ea8fe15b5abd4b82c7009930a19bf61c

SHA1
6ab9cc87d86ad3ddef9ee6cc45c58695b29c5bdf

SHA256
6a66847e8d7f984bc2603b1d3a0323c5ca2006a469f5f97f25909ab4190a8bad

SHA512
44ffe851cc327854ba4d87e16e674cb5a1b5bc86e2dbb9d88bab38347218f580d6ffdb7dab9f3ea904e80f97031cb813daa1e09246c7b60c21c27653adbac3cb

Download Submit
\Users\Admin\AppData\Local\Temp\perfCrtmonitorsvc\perfCrtmonitorsvcMonitorDll.exe

Filesize
1.9MB

MD5
64b3ca21d783cfb2dde3ffbafbf1797f

SHA1
822549c0b397feeb5105c1ebfe570ddf685c926b

SHA256
91167e5876c370f49654a0749590b162b9432108940f84cf77690e26e367955c

SHA512
d6be88ce1ea5d6a54c07b56a8cb682fae729cfaae9758ed3cada42988c89a8a9b7dc038e754b06f8cb737602fe1d3b941c067e7e166c10a30e6541bee57efde3

Download Submit
memory/1904-34-0x0000000000B70000-0x0000000000D5A000-memory.dmp

Filesize
1.9MB

Download
memory/2400-54-0x00000000000B0000-0x000000000029A000-memory.dmp

Filesize
1.9MB

Download
memory/2400-55-0x0000000000340000-0x0000000000396000-memory.dmp

Filesize
344KB

Download
memory/2940-13-0x00000000002F0000-0x00000000004DA000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads