dcrat | 1d6628a6cd66f3dd7f3377ee1c30e8a92cedb1d40f5a121b84e5ab84a0e19909

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 05:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
552e401ed4740592eed1d413ae5a798c.exe
Size 2.7MB
Sample240925-fx413azepg
SHA256 1d6628a6cd66f3dd7f3377ee1c30e8a92cedb1d40f5a121b84e5ab84a0e19909
MD5 552e401ed4740592eed1d413ae5a798c
SHA1 e1f350c68108e3bdb0e2fad97647c6b99a22df5b
SHA512 eeae5d9008bc4951769e1be081af9d168fd7ab90d072a2b3be60114086d0baef68e5eb22a73df8c48f6059afb7fafe2529f2bf5ad8dd7129420943033cbc4b53
SSDEEP 49152:zbA30HsQ4Coflk1GpUkQcn6dZD5upurIPqtFmNHa3WKuh:zboHNk1gP6/YurIdN60h
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat discovery evasion infostealer persistence rat

Malware Config

Signatures

DcRat 43 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		316	schtasks.exe
		1512	schtasks.exe
		1728	schtasks.exe
		2552	schtasks.exe
		1624	schtasks.exe
		1216	schtasks.exe
		1628	schtasks.exe
		2516	schtasks.exe
		1636	schtasks.exe
		1072	schtasks.exe
		2876	schtasks.exe
		1536	schtasks.exe
		1084	schtasks.exe
		1692	schtasks.exe
		2904	schtasks.exe
		1732	schtasks.exe
		1436	schtasks.exe
		2476	schtasks.exe
		2008	schtasks.exe
		2488	schtasks.exe
		2424	schtasks.exe
		2312	schtasks.exe
		2196	schtasks.exe
		600	schtasks.exe
		1548	schtasks.exe
		1356	schtasks.exe
		1228	schtasks.exe
		972	schtasks.exe
		1752	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		552e401ed4740592eed1d413ae5a798c.exe
		1160	schtasks.exe
		1964	schtasks.exe
		1952	schtasks.exe
		2820	schtasks.exe
		660	schtasks.exe
		2448	schtasks.exe
		2088	schtasks.exe
		2052	schtasks.exe
		2632	schtasks.exe
		1908	schtasks.exe
		2444	schtasks.exe
		680	schtasks.exe
		1332	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 14 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Desktop\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\dwm.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Desktop\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Windows\\Microsoft.NET\\Framework64\\1040\\dwm.exe\", \"C:\\Windows\\SoftwareDistribution\\DataStore\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\csrss.exe\", \"C:\\Users\\Default User\\dllhost.exe\", \"C:\\Users\\Default\\Videos\\audiodg.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\OSPPSVC.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Desktop\\audiodg.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Desktop\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Windows\\Microsoft.NET\\Framework64\\1040\\dwm.exe\", \"C:\\Windows\\SoftwareDistribution\\DataStore\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\csrss.exe\", \"C:\\Users\\Default User\\dllhost.exe\", \"C:\\Users\\Default\\Videos\\audiodg.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\OSPPSVC.exe\", \"C:\\Program Files\\Windows Defender\\dwm.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\spoolsv.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\it\\smss.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\lsm.exe\", \"C:\\Program Files\\Internet Explorer\\SIGNUP\\dwm.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\audiodg.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Desktop\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Windows\\Microsoft.NET\\Framework64\\1040\\dwm.exe\", \"C:\\Windows\\SoftwareDistribution\\DataStore\\lsass.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Desktop\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Windows\\Microsoft.NET\\Framework64\\1040\\dwm.exe\", \"C:\\Windows\\SoftwareDistribution\\DataStore\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\csrss.exe\", \"C:\\Users\\Default User\\dllhost.exe\", \"C:\\Users\\Default\\Videos\\audiodg.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Desktop\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Windows\\Microsoft.NET\\Framework64\\1040\\dwm.exe\", \"C:\\Windows\\SoftwareDistribution\\DataStore\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\csrss.exe\", \"C:\\Users\\Default User\\dllhost.exe\", \"C:\\Users\\Default\\Videos\\audiodg.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\OSPPSVC.exe\", \"C:\\Program Files\\Windows Defender\\dwm.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\spoolsv.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\it\\smss.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Desktop\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Windows\\Microsoft.NET\\Framework64\\1040\\dwm.exe\", \"C:\\Windows\\SoftwareDistribution\\DataStore\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\csrss.exe\", \"C:\\Users\\Default User\\dllhost.exe\", \"C:\\Users\\Default\\Videos\\audiodg.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\OSPPSVC.exe\", \"C:\\Program Files\\Windows Defender\\dwm.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\spoolsv.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\it\\smss.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\lsm.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Desktop\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Windows\\Microsoft.NET\\Framework64\\1040\\dwm.exe\", \"C:\\Windows\\SoftwareDistribution\\DataStore\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\csrss.exe\", \"C:\\Users\\Default User\\dllhost.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Desktop\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Windows\\Microsoft.NET\\Framework64\\1040\\dwm.exe\", \"C:\\Windows\\SoftwareDistribution\\DataStore\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\csrss.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Desktop\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Windows\\Microsoft.NET\\Framework64\\1040\\dwm.exe\", \"C:\\Windows\\SoftwareDistribution\\DataStore\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\csrss.exe\", \"C:\\Users\\Default User\\dllhost.exe\", \"C:\\Users\\Default\\Videos\\audiodg.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\OSPPSVC.exe\", \"C:\\Program Files\\Windows Defender\\dwm.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Desktop\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Windows\\Microsoft.NET\\Framework64\\1040\\dwm.exe\", \"C:\\Windows\\SoftwareDistribution\\DataStore\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\csrss.exe\", \"C:\\Users\\Default User\\dllhost.exe\", \"C:\\Users\\Default\\Videos\\audiodg.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\OSPPSVC.exe\", \"C:\\Program Files\\Windows Defender\\dwm.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\spoolsv.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Desktop\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Windows\\Microsoft.NET\\Framework64\\1040\\dwm.exe\", \"C:\\Windows\\SoftwareDistribution\\DataStore\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\csrss.exe\", \"C:\\Users\\Default User\\dllhost.exe\", \"C:\\Users\\Default\\Videos\\audiodg.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\OSPPSVC.exe\", \"C:\\Program Files\\Windows Defender\\dwm.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\spoolsv.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\it\\smss.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\lsm.exe\", \"C:\\Program Files\\Internet Explorer\\SIGNUP\\dwm.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Desktop\\audiodg.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Windows\\Microsoft.NET\\Framework64\\1040\\dwm.exe\""	nvdriver.exe

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	316	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1512	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1692	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1072	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1216	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	660	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1228	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	972	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	600	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	680	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1548	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1436	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1332	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2516	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2052	2624	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	2624	schtasks.exe	38

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000012117-2.dat	dcrat
behavioral1/memory/2916-5-0x0000000000400000-0x00000000006BB000-memory.dmp	dcrat
behavioral1/files/0x0007000000016cd1-33.dat	dcrat
behavioral1/memory/2700-37-0x00000000012F0000-0x000000000152A000-memory.dmp	dcrat
behavioral1/memory/2736-79-0x0000000000EE0000-0x000000000111A000-memory.dmp	dcrat

Disables Task Manager via registry modification
evasion

Executes dropped EXE 3 IoCs

pid	Process
2292	gf.exe
2700	nvdriver.exe
2736	lsass.exe

Loads dropped DLL 3 IoCs

pid	Process
2916	552e401ed4740592eed1d413ae5a798c.exe
2816	cmd.exe
2816	cmd.exe

Adds Run key to start application 2 TTPs 28 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Users\\Public\\Desktop\\audiodg.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\lsm.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\SoftwareDistribution\\DataStore\\lsass.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Default User\\dllhost.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\spoolsv.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\it\\smss.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Users\\Default\\Videos\\audiodg.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\lsm.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\Internet Explorer\\SIGNUP\\dwm.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\Microsoft.NET\\Framework64\\1040\\dwm.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Default User\\dllhost.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Users\\Default\\Videos\\audiodg.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\Windows Defender\\dwm.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\audiodg.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\Microsoft.NET\\Framework64\\1040\\dwm.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\csrss.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Users\\Public\\Desktop\\audiodg.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\dwm.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\csrss.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\OSPPSVC.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\spoolsv.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\Internet Explorer\\SIGNUP\\dwm.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\dwm.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\SoftwareDistribution\\DataStore\\lsass.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\OSPPSVC.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\Windows Defender\\dwm.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\it\\smss.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\audiodg.exe\""	nvdriver.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\886983d96e3d3e	nvdriver.exe
File created	C:\Program Files\Windows Defender\dwm.exe	nvdriver.exe
File created	C:\Program Files\Windows Defender\6cb0b6c459d5d3	nvdriver.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\smss.exe	nvdriver.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\69ddcba757bf72	nvdriver.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\dwm.exe	nvdriver.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\6cb0b6c459d5d3	nvdriver.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\csrss.exe	nvdriver.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework64\1040\dwm.exe	nvdriver.exe
File created	C:\Windows\Microsoft.NET\Framework64\1040\6cb0b6c459d5d3	nvdriver.exe
File created	C:\Windows\SoftwareDistribution\DataStore\lsass.exe	nvdriver.exe
File created	C:\Windows\SoftwareDistribution\DataStore\6203df4a6bafc7	nvdriver.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	552e401ed4740592eed1d413ae5a798c.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2732	reg.exe
2976	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1628	schtasks.exe
2312	schtasks.exe
1964	schtasks.exe
2876	schtasks.exe
2820	schtasks.exe
1160	schtasks.exe
1436	schtasks.exe
2516	schtasks.exe
1692	schtasks.exe
660	schtasks.exe
1732	schtasks.exe
1332	schtasks.exe
2196	schtasks.exe
2008	schtasks.exe
1908	schtasks.exe
1752	schtasks.exe
972	schtasks.exe
2476	schtasks.exe
1636	schtasks.exe
2444	schtasks.exe
1216	schtasks.exe
1624	schtasks.exe
1228	schtasks.exe
1084	schtasks.exe
2088	schtasks.exe
1512	schtasks.exe
2552	schtasks.exe
1072	schtasks.exe
1728	schtasks.exe
2904	schtasks.exe
1536	schtasks.exe
600	schtasks.exe
2632	schtasks.exe
1356	schtasks.exe
316	schtasks.exe
680	schtasks.exe
1548	schtasks.exe
2448	schtasks.exe
2052	schtasks.exe
2488	schtasks.exe
1952	schtasks.exe
2424	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2700	nvdriver.exe
2700	nvdriver.exe
2700	nvdriver.exe
2736	lsass.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2700	nvdriver.exe
Token: SeDebugPrivilege	2736	lsass.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2292	2916	552e401ed4740592eed1d413ae5a798c.exe	30
PID 2916 wrote to memory of 2292	2916	552e401ed4740592eed1d413ae5a798c.exe	30
PID 2916 wrote to memory of 2292	2916	552e401ed4740592eed1d413ae5a798c.exe	30
PID 2916 wrote to memory of 2292	2916	552e401ed4740592eed1d413ae5a798c.exe	30
PID 2292 wrote to memory of 2168	2292	gf.exe	31
PID 2292 wrote to memory of 2168	2292	gf.exe	31
PID 2292 wrote to memory of 2168	2292	gf.exe	31
PID 2292 wrote to memory of 2168	2292	gf.exe	31
PID 2292 wrote to memory of 1272	2292	gf.exe	32
PID 2292 wrote to memory of 1272	2292	gf.exe	32
PID 2292 wrote to memory of 1272	2292	gf.exe	32
PID 2292 wrote to memory of 1272	2292	gf.exe	32
PID 1272 wrote to memory of 2732	1272	cmd.exe	34
PID 1272 wrote to memory of 2732	1272	cmd.exe	34
PID 1272 wrote to memory of 2732	1272	cmd.exe	34
PID 1272 wrote to memory of 2732	1272	cmd.exe	34
PID 2168 wrote to memory of 2816	2168	WScript.exe	35
PID 2168 wrote to memory of 2816	2168	WScript.exe	35
PID 2168 wrote to memory of 2816	2168	WScript.exe	35
PID 2168 wrote to memory of 2816	2168	WScript.exe	35
PID 2816 wrote to memory of 2700	2816	cmd.exe	37
PID 2816 wrote to memory of 2700	2816	cmd.exe	37
PID 2816 wrote to memory of 2700	2816	cmd.exe	37
PID 2816 wrote to memory of 2700	2816	cmd.exe	37
PID 2700 wrote to memory of 1700	2700	nvdriver.exe	81
PID 2700 wrote to memory of 1700	2700	nvdriver.exe	81
PID 2700 wrote to memory of 1700	2700	nvdriver.exe	81
PID 2816 wrote to memory of 2976	2816	cmd.exe	83
PID 2816 wrote to memory of 2976	2816	cmd.exe	83
PID 2816 wrote to memory of 2976	2816	cmd.exe	83
PID 2816 wrote to memory of 2976	2816	cmd.exe	83
PID 1700 wrote to memory of 3016	1700	cmd.exe	84
PID 1700 wrote to memory of 3016	1700	cmd.exe	84
PID 1700 wrote to memory of 3016	1700	cmd.exe	84
PID 1700 wrote to memory of 2736	1700	cmd.exe	87
PID 1700 wrote to memory of 2736	1700	cmd.exe	87
PID 1700 wrote to memory of 2736	1700	cmd.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\552e401ed4740592eed1d413ae5a798c.exe
"C:\Users\Admin\AppData\Local\Temp\552e401ed4740592eed1d413ae5a798c.exe"
1⤵
- DcRat
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\gf.exe
  "C:\Users\Admin\AppData\Local\Temp\gf.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\nvidiadrivers\u3p5x83dINqg4J2NZ.vbe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Roaming\nvidiadrivers\B2wJE9LGiwl91msFdoVPyW.bat" "
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2816
    - - C:\Users\Admin\AppData\Roaming\nvidiadrivers\nvdriver.exe
        
        "C:\Users\Admin\AppData\Roaming\nvidiadrivers\nvdriver.exe"
        5⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2700
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qPDcjSgeGO.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1700
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:3016
        
        C:\Windows\SoftwareDistribution\DataStore\lsass.exe
        
        "C:\Windows\SoftwareDistribution\DataStore\lsass.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2736
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2976
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Roaming\nvidiadrivers\cqJqQeasQQmFWMBrC3t.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1272
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Desktop\audiodg.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Public\Desktop\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Desktop\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Windows\Microsoft.NET\Framework64\1040\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\Framework64\1040\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Windows\Microsoft.NET\Framework64\1040\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Windows\SoftwareDistribution\DataStore\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\DataStore\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Windows\SoftwareDistribution\DataStore\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Videos\audiodg.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Default\Videos\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Videos\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\OSPPSVC.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\lsm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Internet Explorer\SIGNUP\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\SIGNUP\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Internet Explorer\SIGNUP\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\audiodg.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qPDcjSgeGO.bat

Path C:\Users\Admin\AppData\Local\Temp\qPDcjSgeGO.bat
Size 216B
SHA256 58eeda1909595d72248403660b8cf34ab0423ce3d3343a8c2dae6624f3c1384e
MD5 c96e1eb3071dcfeb61c95ec0b44b8db9
SHA1 0f0eb54634fd396a583bd3c5181dca5831f05e12
SHA512 257b340fe64bdaffdece6bef29b1693c4ef90dacfe125c294df0f665a93d7d6c56974af61d5f9d34e002511b3aeef17d1c85f3ba563ee6dbedb3ff3f017d4802
MD5 SHA1 SHA512

Submit Download

B2wJE9LGiwl91msFdoVPyW.bat

Path C:\Users\Admin\AppData\Roaming\nvidiadrivers\B2wJE9LGiwl91msFdoVPyW.bat
Size 150B
SHA256 92556b6d69fdb1d965f7aaca28d576422ee19f6bc1115d625415c06dba4663cd
MD5 2f13af336ec7cf35b11324a9884fc6a9
SHA1 4fa9d0a577f1ec5008df4ab1cb57449f56f91d6c
SHA512 6866f3bf1daedb313dc8c7442710f951e304ace9cf36a0a0b1e5c7a0468de1dbc38b0dcaf88c9a1ccf193bce1831fb85cfdaceeedbba559c8a0a478d658e1d4f
MD5 SHA1 SHA512

Submit Download

cqJqQeasQQmFWMBrC3t.bat

Path C:\Users\Admin\AppData\Roaming\nvidiadrivers\cqJqQeasQQmFWMBrC3t.bat
Size 109B
SHA256 8fc70a4625c0d4dabac7ec8eecc7175eb5b8f661293f478119c11f389d13318c
MD5 031d0c353460a3323ed03ad8d920dbbc
SHA1 75dd8d5ccaddabb53d825f0a5dfe4b9bb1c43441
SHA512 0d5538a28106da3512d7de220cc598f4a9077b8aa8b9fdd338ad2e76df7ed29be42bbd8f36ec9a7cb2ac12aeafd7b70ccfb7b31f6ae2e70aa08553ebc2f037d3
MD5 SHA1 SHA512

Submit Download

u3p5x83dINqg4J2NZ.vbe

Path C:\Users\Admin\AppData\Roaming\nvidiadrivers\u3p5x83dINqg4J2NZ.vbe
Size 219B
SHA256 44590c0a478095e187c3dae37e9b49f6b0f561d01d41de65f319d5019728d19e
MD5 f103de7a5a6b36ab176147d293fb34e6
SHA1 e91487f1a9e2dee405ac57e76661760f652b532a
SHA512 f2f9aa10c7b25f7692aaf6afddb23fafeb37b3256343d5b48b87944c6314ee68ed0beb4ddf10c2ba0abe40ebddb5c1fabf6b5d30c715b02480eda3db4af01877
MD5 SHA1 SHA512

Submit Download

gf.exe

Path \Users\Admin\AppData\Local\Temp\gf.exe
Size 2.5MB
SHA256 983cc8d48a66b58f5fed9d82a7733cc3b4f06b534eb9ea98163a7694fa4fe2d9
MD5 e6fbc2b450302ae039181e4fac91aa3d
SHA1 640d28797f473a13fbaebd330ce47d4c91537225
SHA512 57eea73569d483f0f35f77a283e50d63399ed00ff32a6a8d2a7ec8451b9fcb214f0a3f33fdee730fbb86274f6eaaed5fed852eab9eaeea6b09445bce882f98e6
SSDEEP 49152:UbA30HsQ4Coflk1GpUkQcn6dZD5upurIPqtFmNHa3WKuX:UboHNk1gP6/YurIdN60X
MD5 SHA1 SHA512 SSDEEP

Submit Download

nvdriver.exe

Path \Users\Admin\AppData\Roaming\nvidiadrivers\nvdriver.exe
Size 2.2MB
SHA256 60519e5af340c24acefe2ae89365ab197128a63adc3ff7045904d1a44696afcd
MD5 9319cedbd6bb07d2821e81bbb0a51c18
SHA1 d2130ff26ec69cf901e2a3b99e9e07c4a9059cc3
SHA512 9e037bd09bdbd29d668ca4d7823ea84d08be8b3e7f5bb903b715f9c7ccd79e9cfeb936ba204311c951ce65c7473434a8a3db928f89da306ec919d1a939c21d2f
SSDEEP 49152:KsQ4Coflk1GpUkQcn6dZD5upurIPqtFmNHa3WKu:FHNk1gP6/YurIdN60
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2700-37-0x00000000012F0000-0x000000000152A000-memory.dmp

Download

memory/2700-38-0x0000000000160000-0x000000000017C000-memory.dmp

Download

memory/2700-39-0x0000000000390000-0x00000000003A6000-memory.dmp

Download

memory/2700-40-0x0000000001220000-0x0000000001276000-memory.dmp

Download

memory/2700-41-0x0000000000180000-0x000000000018E000-memory.dmp

Download

memory/2700-42-0x00000000003B0000-0x00000000003B8000-memory.dmp

Download

memory/2700-43-0x00000000009E0000-0x00000000009E8000-memory.dmp

Download

memory/2736-79-0x0000000000EE0000-0x000000000111A000-memory.dmp

Download

memory/2916-5-0x0000000000400000-0x00000000006BB000-memory.dmp

Download