dcrat | c1be767404a3d71717a54b01ebfa91ebff578dad8dd518a1a49012bcf012738e

Resubmissions

27/07/2024, 17:08

240727-vnrrpszapr 10

24/07/2024, 13:55

240724-q8e67aygrr 10

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 17:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e.exe
Size

2.0MB
MD5

40ac7d11ebb91612d8d5c16c05af0a13
SHA1

543a6c16f8f058fb6ba029ee3a9c5fde92aaa212
SHA256

4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e
SHA512

223ecc008fe3b9818597c3870ef605674eb96c52f8f140edb1d7c878691ce16c604440be77107c795a2bbb4e1b5c28ba94141e5703d9488c3a06580e38bf953c
SSDEEP

49152:PbA3HdwWe2aSe6pcUwxE0G+dK7RB7/wWnm1Xl:Pbt2M4cUwxEII7RB0d1Xl

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat 32 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		2432	schtasks.exe
		2088	schtasks.exe
		1676	schtasks.exe
		820	schtasks.exe
		1948	schtasks.exe
		2936	schtasks.exe
		2424	schtasks.exe
		2360	schtasks.exe
		788	schtasks.exe
		2900	schtasks.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\69ddcba757bf72		ComInto.exe
		1744	schtasks.exe
		320	schtasks.exe
		2120	schtasks.exe
		2232	schtasks.exe
		564	schtasks.exe
		1816	schtasks.exe
		2904	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e.exe
		484	schtasks.exe
		1464	schtasks.exe
		1012	schtasks.exe
		280	schtasks.exe
		1512	schtasks.exe
		660	schtasks.exe
		1532	schtasks.exe
		1368	schtasks.exe
		1468	schtasks.exe
		1868	schtasks.exe
		2860	schtasks.exe
		2508	schtasks.exe
		1416	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 10 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Common Files\\Adobe AIR\\Versions\\1.0\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\sppsvc.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Common Files\\Adobe AIR\\Versions\\1.0\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\sppsvc.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Common Files\\Adobe AIR\\Versions\\1.0\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\services.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Common Files\\Adobe AIR\\Versions\\1.0\\smss.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Common Files\\Adobe AIR\\Versions\\1.0\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Windows\\Setup\\State\\wininit.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Common Files\\Adobe AIR\\Versions\\1.0\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Windows\\Setup\\State\\wininit.exe\", \"C:\\Users\\Public\\ComInto.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Common Files\\Adobe AIR\\Versions\\1.0\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Windows\\Setup\\State\\wininit.exe\", \"C:\\Users\\Public\\ComInto.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\dllhost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Common Files\\Adobe AIR\\Versions\\1.0\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Windows\\Setup\\State\\wininit.exe\", \"C:\\Users\\Public\\ComInto.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\dllhost.exe\", \"C:\\Users\\All Users\\Start Menu\\csrss.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Common Files\\Adobe AIR\\Versions\\1.0\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Windows\\Setup\\State\\wininit.exe\", \"C:\\Users\\Public\\ComInto.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\dllhost.exe\", \"C:\\Users\\All Users\\Start Menu\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\taskhost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Common Files\\Adobe AIR\\Versions\\1.0\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Windows\\Setup\\State\\wininit.exe\", \"C:\\Users\\Public\\ComInto.exe\", \"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\dllhost.exe\", \"C:\\Users\\All Users\\Start Menu\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Program Files\\MSBuild\\services.exe\""	ComInto.exe

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	280	3044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	3044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	3044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	3044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	3044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	3044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1416	3044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	3044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1468	3044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	3044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	3044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1512	3044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	3044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	320	3044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	484	3044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1464	3044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	3044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	820	3044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	788	3044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	660	3044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	3044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	3044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	3044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	564	3044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	3044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1368	3044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	3044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	3044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	3044	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	3044	schtasks.exe	35

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral23/files/0x0006000000016ed2-9.dat	dcrat
behavioral23/memory/2884-13-0x0000000000A00000-0x0000000000BAC000-memory.dmp	dcrat
behavioral23/memory/1536-54-0x00000000003C0000-0x000000000056C000-memory.dmp	dcrat

Executes dropped EXE 2 IoCs

pid	Process
2884	ComInto.exe
1536	csrss.exe

Loads dropped DLL 2 IoCs

pid	Process
1812	cmd.exe
1812	cmd.exe

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\dllhost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\All Users\\Start Menu\\csrss.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\taskhost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files\\MSBuild\\services.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files\\MSBuild\\services.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\sppsvc.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\sppsvc.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\Setup\\State\\wininit.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\Setup\\State\\wininit.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\taskhost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Common Files\\Adobe AIR\\Versions\\1.0\\smss.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\sppsvc.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\ComInto = "\"C:\\Users\\Public\\ComInto.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Common Files\\Adobe AIR\\Versions\\1.0\\smss.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\services.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\services.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ComInto = "\"C:\\Users\\Public\\ComInto.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\b2a802a2-3b12-11ef-8991-d2f1755c8afd\\dllhost.exe\""	ComInto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\All Users\\Start Menu\\csrss.exe\""	ComInto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\sppsvc.exe\""	ComInto.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\MSBuild\c5b4cb5e9653cc	ComInto.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\smss.exe	ComInto.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\smss.exe	ComInto.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\69ddcba757bf72	ComInto.exe
File created	C:\Program Files\MSBuild\services.exe	ComInto.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Setup\State\wininit.exe	ComInto.exe
File created	C:\Windows\Setup\State\56085415360792	ComInto.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1012	schtasks.exe
2424	schtasks.exe
1416	schtasks.exe
2860	schtasks.exe
1368	schtasks.exe
2936	schtasks.exe
484	schtasks.exe
2120	schtasks.exe
1816	schtasks.exe
1868	schtasks.exe
320	schtasks.exe
564	schtasks.exe
1532	schtasks.exe
280	schtasks.exe
2900	schtasks.exe
820	schtasks.exe
2360	schtasks.exe
2904	schtasks.exe
2088	schtasks.exe
2508	schtasks.exe
660	schtasks.exe
1744	schtasks.exe
1676	schtasks.exe
1464	schtasks.exe
1468	schtasks.exe
1948	schtasks.exe
2432	schtasks.exe
1512	schtasks.exe
788	schtasks.exe
2232	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2884	ComInto.exe
2884	ComInto.exe
2884	ComInto.exe
2884	ComInto.exe
2884	ComInto.exe
1536	csrss.exe
1536	csrss.exe
1536	csrss.exe
1536	csrss.exe
1536	csrss.exe
1536	csrss.exe
1536	csrss.exe
1536	csrss.exe
1536	csrss.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1536	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2884	ComInto.exe
Token: SeDebugPrivilege	1536	csrss.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2800	2660	4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e.exe	31
PID 2660 wrote to memory of 2800	2660	4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e.exe	31
PID 2660 wrote to memory of 2800	2660	4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e.exe	31
PID 2660 wrote to memory of 2800	2660	4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e.exe	31
PID 2800 wrote to memory of 1812	2800	WScript.exe	32
PID 2800 wrote to memory of 1812	2800	WScript.exe	32
PID 2800 wrote to memory of 1812	2800	WScript.exe	32
PID 2800 wrote to memory of 1812	2800	WScript.exe	32
PID 1812 wrote to memory of 2884	1812	cmd.exe	34
PID 1812 wrote to memory of 2884	1812	cmd.exe	34
PID 1812 wrote to memory of 2884	1812	cmd.exe	34
PID 1812 wrote to memory of 2884	1812	cmd.exe	34
PID 2884 wrote to memory of 1536	2884	ComInto.exe	66
PID 2884 wrote to memory of 1536	2884	ComInto.exe	66
PID 2884 wrote to memory of 1536	2884	ComInto.exe	66
PID 1536 wrote to memory of 1500	1536	csrss.exe	67
PID 1536 wrote to memory of 1500	1536	csrss.exe	67
PID 1536 wrote to memory of 1500	1536	csrss.exe	67
PID 1536 wrote to memory of 2240	1536	csrss.exe	68
PID 1536 wrote to memory of 2240	1536	csrss.exe	68
PID 1536 wrote to memory of 2240	1536	csrss.exe	68

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e.exe
"C:\Users\Admin\AppData\Local\Temp\4963827ab4881382f900255fa034f5c5f369cdc11d30863c69a04ed7f6abca5e.exe"
1⤵
- DcRat
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\componentCommon\TsZJDcKjHujznUYiyXhQefVwV2.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\componentCommon\j1nvYpGjbyEFrc.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\componentCommon\ComInto.exe
      "C:\componentCommon\ComInto.exe"
      4⤵
      DcRat
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2884
    - - C:\Users\All Users\Start Menu\csrss.exe
        
        "C:\Users\All Users\Start Menu\csrss.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1536
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1988c534-4e2c-4030-8c87-00ab95ac4b85.vbs"
        6⤵
        
        PID:1500
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dc320380-bd18-4f95-a452-690df48c280b.vbs"
        6⤵
        
        PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Recovery\b2a802a2-3b12-11ef-8991-d2f1755c8afd\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\b2a802a2-3b12-11ef-8991-d2f1755c8afd\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Recovery\b2a802a2-3b12-11ef-8991-d2f1755c8afd\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Windows\Setup\State\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Setup\State\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Windows\Setup\State\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ComIntoC" /sc MINUTE /mo 11 /tr "'C:\Users\Public\ComInto.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ComInto" /sc ONLOGON /tr "'C:\Users\Public\ComInto.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ComIntoC" /sc MINUTE /mo 13 /tr "'C:\Users\Public\ComInto.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Recovery\b2a802a2-3b12-11ef-8991-d2f1755c8afd\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\b2a802a2-3b12-11ef-8991-d2f1755c8afd\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Recovery\b2a802a2-3b12-11ef-8991-d2f1755c8afd\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Start Menu\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Start Menu\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\taskhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files\MSBuild\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\MSBuild\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files\MSBuild\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1988c534-4e2c-4030-8c87-00ab95ac4b85.vbs

Filesize
715B

MD5
50a569f93eaa08190bced34ae81caca2

SHA1
6914cad1d631d4507c4541e24a1c8a5a05c528f4

SHA256
b01ebfc19036da6d52685ce4cce63c6af97babfe5b0702709abc19afbe05216c

SHA512
28de8dca3ccccb36ef27ad9c382b042161493b149ddf2f1bb03081eb28b6a9d12c513f2dc28d4583e879c9761ba9b70b04e2ba9459bed7662cb97f643971f4ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\dc320380-bd18-4f95-a452-690df48c280b.vbs

Filesize
491B

MD5
39807d93cc36f9aed30df110eebfc08d

SHA1
c472061ff3ec5e260d2534290a2ddf41b9ecb8af

SHA256
13f6bf6b737e81d77dc7091e5ede246f23aee8d9d6d80931ae50627c42bc0cbf

SHA512
db69dd2af6539bb1bf7706b912d3a6ed1f882acda2d01ddb9ab1af4e65c332e076d8282217b35df2dd3d1ffb7723bf7c32ca960c084585e20439488f75454a7f

Download Submit
C:\componentCommon\TsZJDcKjHujznUYiyXhQefVwV2.vbe

Filesize
206B

MD5
e986ea5d4cac976a6de65d3f1ef8b332

SHA1
6465da0abcfac05b8ed1f32b9cca57e2e2f54aea

SHA256
3ad8783bacfea22158df341d1bbedf8f6f0dcc4d9504555b36a756d2fcd83831

SHA512
896934c1a2941a8edfd38b03a858fc589cfb6622ae75019a542638be0c9c4e436aacd0916196dd71442d1a90404afa29d2864c92401222ff5ec2a712d873fa11

Download Submit
C:\componentCommon\j1nvYpGjbyEFrc.bat

Filesize
32B

MD5
a0b9b0891c2cae67cd1beae705d09d4f

SHA1
997953188d6226de19faa0ab4e8fdbddf1fb5617

SHA256
13593fab7a2113730fdbe4cbf436dde9a26116cda0bd4a33dff27d5678e9f9fc

SHA512
bdcd0c6a765c3927180706f7b30f2ea0f7cab6f27e512433839ebe3f6cb148923a6733ae954c24fa6eedeca97b8dc01cae945eea07e1121ff74885a69b34f2bb

Download Submit
\componentCommon\ComInto.exe

Filesize
1.6MB

MD5
9a0cee5a5ce317b7a70f88bb6aaa49e1

SHA1
95a779063656075a8ddc2f2164393fa59e3c93d9

SHA256
701924dd5d93b99a1e90fcd92f399c4453455e78375125f7a06aca20b84956bc

SHA512
d9c6240b6809c3decbdf4d97aca246f308670097b704b47449c53d8dc121f391d3ec6596f7947c36a01a388eeefe6f9ac9785698cf743f8a89c7cbf7b9da41a4

Download Submit
memory/1536-54-0x00000000003C0000-0x000000000056C000-memory.dmp

Filesize
1.7MB

Download
memory/2884-20-0x0000000000960000-0x0000000000968000-memory.dmp

Filesize
32KB

Download
memory/2884-23-0x00000000009C0000-0x00000000009C8000-memory.dmp

Filesize
32KB

Download
memory/2884-17-0x0000000000940000-0x0000000000956000-memory.dmp

Filesize
88KB

Download
memory/2884-19-0x0000000000970000-0x0000000000980000-memory.dmp

Filesize
64KB

Download
memory/2884-16-0x0000000000470000-0x0000000000478000-memory.dmp

Filesize
32KB

Download
memory/2884-21-0x0000000000980000-0x0000000000992000-memory.dmp

Filesize
72KB

Download
memory/2884-22-0x00000000009B0000-0x00000000009BC000-memory.dmp

Filesize
48KB

Download
memory/2884-18-0x0000000000480000-0x0000000000488000-memory.dmp

Filesize
32KB

Download
memory/2884-24-0x00000000009D0000-0x00000000009DA000-memory.dmp

Filesize
40KB

Download
memory/2884-25-0x00000000009E0000-0x00000000009EE000-memory.dmp

Filesize
56KB

Download
memory/2884-26-0x00000000009F0000-0x00000000009FC000-memory.dmp

Filesize
48KB

Download
memory/2884-27-0x00000000021C0000-0x00000000021CC000-memory.dmp

Filesize
48KB

Download
memory/2884-15-0x0000000000450000-0x000000000046C000-memory.dmp

Filesize
112KB

Download
memory/2884-14-0x0000000000440000-0x000000000044E000-memory.dmp

Filesize
56KB

Download
memory/2884-13-0x0000000000A00000-0x0000000000BAC000-memory.dmp

Filesize
1.7MB

Download