Overview

overview

10

Static

static

3

BBD6FFDB33...1F.exe

windows7-x64

10

BBD6FFDB33...1F.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30-10-2024 07:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    BBD6FFDB33259778F08704696A04891F.exe

  • Size

    12.7MB

  • MD5

    bbd6ffdb33259778f08704696a04891f

  • SHA1

    0fd836bb4bfc035ff35ebe0fb47e4693cec9e8ba

  • SHA256

    841eb644979b3c640761762645c9cd26f9bb46e558eaeb7bf0c2a79e761878f4

  • SHA512

    1b66f11b3a3dea1e6a8f4f7ee493437a41e30704d1c80048efd245184a447fde6abf06fe45af0663a72b30b657a7297554df8c3af7b36ae2e0df21a5031a34e0

  • SSDEEP

    393216:2JlQ1evI2bs6Yuno3rkJ3InoKasOnHDJaM8X:2bQpgssCKInwjJaMc

Score
10/10
dcratumbraldefense_evasiondiscoveryevasioninfostealerpersistenceratstealertrojanvmprotect

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1266665187293794356/BgUJDQi9QXAA0avjRcAiy-uTUWdbVUSk8SQjon--JNjDxPP5bEhE6DLfJFghJ_KLSRhA

Signatures

  • DcRat 28 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Detect Umbral payload 2 IoCs
  • Modifies WinLogon for persistence 2 TTPs 9 IoCs
    persistence
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
    evasiontrojan
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Process spawned unexpected child process 27 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral
  • Umbral family
    umbral
  • DCRat payload 4 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 8 IoCs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Adds Run key to start application 2 TTPs 18 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies Security services 2 TTPs 4 IoCs

    Modifies the startup behavior of a security service.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\BBD6FFDB33259778F08704696A04891F.exe
    "C:\Users\Admin\AppData\Local\Temp\BBD6FFDB33259778F08704696A04891F.exe"
    1⤵
    • DcRat
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2112
    • C:\Users\Admin\AppData\Local\Temp\Lunch LaCheatV2.exe
      "C:\Users\Admin\AppData\Local\Temp\Lunch LaCheatV2.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2900
      • C:\Users\Admin\AppData\Local\Temp\Lunch LaCheat.exe
        "C:\Users\Admin\AppData\Local\Temp\Lunch LaCheat.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1868
        • C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
          "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1704
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\blockweb\J6PsSzBYKK7mXTJyYh2Tgne.vbe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2604
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ""C:\blockweb\TOdra8QNG4wQEWkSimCHh9eVG.bat" "
              6⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:936
              • C:\blockweb\portrefNet.exe
                "C:\blockweb\portrefNet.exe"
                7⤵
                • Modifies WinLogon for persistence
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in Program Files directory
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:592
                • C:\Users\Public\Libraries\explorer.exe
                  "C:\Users\Public\Libraries\explorer.exe"
                  8⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1740
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\blockweb\file.vbs"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1424
        • C:\Users\Admin\AppData\Local\Temp\52cheatand52rat.exe
          "C:\Users\Admin\AppData\Local\Temp\52cheatand52rat.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2736
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic.exe" csproduct get uuid
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1176
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\windows defender.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2088
      • C:\Windows\SysWOW64\reg.exe
        reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2792
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2428
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3000
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2952
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • System Location Discovery: System Language Discovery
        PID:2600
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • System Location Discovery: System Language Discovery
        PID:3020
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • System Location Discovery: System Language Discovery
        PID:2996
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • System Location Discovery: System Language Discovery
        PID:2648
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • System Location Discovery: System Language Discovery
        PID:2636
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2704
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2720
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2708
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2764
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2864
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2660
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2656
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2616
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2756
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2760
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2516
      • C:\Windows\SysWOW64\reg.exe
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3024
      • C:\Windows\SysWOW64\reg.exe
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2784
      • C:\Windows\SysWOW64\reg.exe
        reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2668
      • C:\Windows\SysWOW64\reg.exe
        reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2544
      • C:\Windows\SysWOW64\reg.exe
        reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2924
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
        3⤵
        • Modifies Security services
        • System Location Discovery: System Language Discovery
        PID:2532
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
        3⤵
        • Modifies Security services
        • System Location Discovery: System Language Discovery
        PID:2752
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
        3⤵
        • Modifies Security services
        • System Location Discovery: System Language Discovery
        PID:1968
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
        3⤵
        • Modifies Security services
        • System Location Discovery: System Language Discovery
        PID:2680
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
        3⤵
        • Modifies security service
        • System Location Discovery: System Language Discovery
        PID:2956
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Libraries\explorer.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:484
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Public\Libraries\explorer.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1136
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Libraries\explorer.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:900
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\WmiPrvSE.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:764
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\WmiPrvSE.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1512
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\WmiPrvSE.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1492
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 7 /tr "'C:\blockweb\WMIADAP.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1548
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\blockweb\WMIADAP.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1948
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 11 /tr "'C:\blockweb\WMIADAP.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2124
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\dwm.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2428
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\dwm.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3020
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\dwm.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2648
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Windows\AppCompat\Programs\explorer.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2972
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\AppCompat\Programs\explorer.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2988
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Windows\AppCompat\Programs\explorer.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2660
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\System.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2740
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:984
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2204
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2752
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2680
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\dllhost.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3016
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\lsass.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2252
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\lsass.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2452
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\lsass.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2540
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Windows\LiveKernelReports\cmd.exe'" /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:276
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\cmd.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2168
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Windows\LiveKernelReports\cmd.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Impair Defenses

2
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

5
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Cab2741.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Lunch LaCheat.exe
    Filesize

    7.5MB

    MD5

    b76057df968a944446f950dd4ddc6aec

    SHA1

    bb64de1c677368764000d34c29528ead2f48405c

    SHA256

    afe91fea04d39de5710ad065252d13b9df7b7bd25788ddf5afb162a2f0a03296

    SHA512

    7f45198fe05013ceab477784bde2b1c4532607bd8ba8d9cfb09c5bb037dd2616086c8cb3afd669b24ec89eedbd270d00f1bd6bce2644b40ed36b8f32fc5fdb31

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar2763.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\windows defender.bat
    Filesize

    3KB

    MD5

    4c35b71d2d89c8e8eb773854085c56ea

    SHA1

    ede16731e61348432c85ef13df4beb2be8096d9b

    SHA256

    3efeeaaabfd33ff95934bee4d6d84e4ecb158d1e7777f6eecd26b2746991ed42

    SHA512

    a6ccbb2913738ca171686a2dd70e96330b0972dadb64f7294ac2b4c9bb430c872ed2bcd360f778962162b9e3be305836fa7f6762b46310c0ad4d6ef0c1cdac8d

    Download Submit

  • C:\blockweb\J6PsSzBYKK7mXTJyYh2Tgne.vbe
    Filesize

    221B

    MD5

    ca2cae3c10113fc32484a48196e2ffaa

    SHA1

    8eb74a53fe655c5b538246f42cc078d8900bf215

    SHA256

    98311058614dd00a0d0e9e9c38f9df5d1d951525741fc46901d1a396baddd8f2

    SHA512

    6cf05ca56f4c6320bc490401e742f81230e6c138651d958776f497d5e4889fe16c5853a1864791a3f10b4b3d103f5218894be4c7009d1eb7b32e243111b166af

    Download Submit

  • C:\blockweb\TOdra8QNG4wQEWkSimCHh9eVG.bat
    Filesize

    39B

    MD5

    19fe83feec263d4e4e68e3dd0e6b3615

    SHA1

    7ff948a654d54acfde0e798fe1d67160343f8dfd

    SHA256

    07dc5ed69f4847071b41d0086ef8a11032c2d85b1ec8a8b00a5d29480c3e6744

    SHA512

    ee6fef4211b60dff50b7cdb88f9ec0028a67bc428ab854c0932db7e5873f9a22e16760d59ff6b885fdb96ed7f6582d3735f629d6e825dcfd1e8c13c5d5adae78

    Download Submit

  • C:\blockweb\file.vbs
    Filesize

    34B

    MD5

    677cc4360477c72cb0ce00406a949c61

    SHA1

    b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

    SHA256

    f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

    SHA512

    7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

    Download Submit

  • \Users\Admin\AppData\Local\Temp\52cheatand52rat.exe
    Filesize

    229KB

    MD5

    06129ffc46e854930cfcaa754ca1d487

    SHA1

    e7c173c48aa107ec63bd6f9030c9ec6fe889d832

    SHA256

    10d28e18a7df4b2c30e05e5e361f1724e0b6ea8c021d8105ee30354be79b98d1

    SHA512

    b7121a2a65f317edbc1b4dd8dec427c277fad2b521a211d1408bc06b79431c418dad32ed61481c5ef49511cd167846e026a86147ae77bd9b0e607918feb66ab9

    Download Submit

  • \Users\Admin\AppData\Local\Temp\DCRatBuild.exe
    Filesize

    2.5MB

    MD5

    6e01d4882274684f48e04436103ad57f

    SHA1

    3b88df5fc9e6973bf3ecb1e2ed759b86774cb290

    SHA256

    424497764bc1e2cd57f454d173dceeb9dcd7f900aaf5060110da629d11fadf8d

    SHA512

    3e5ed6ee7458f4662dd9bbe572620fc591e69fbc6d8e98013ec0f39a95eb9da55561a232eea23192fbc59368b99f99ee6a00df23bcff253c327aa3eb607c7d7e

    Download Submit

  • \Users\Admin\AppData\Local\Temp\Lunch LaCheatV2.exe
    Filesize

    12.7MB

    MD5

    7db5128f7a81cc1af094d8898e79ff21

    SHA1

    d503984331d5999c14931c267d859fbd1510c282

    SHA256

    2952fa4ab9bc3e2b04b1f3ab6b648d0d23fa74856c50bf21fb13fddfe9a874bb

    SHA512

    caceec284b71df124d47267e5ca42bf84e558aa9606b0186f132fba8d2bead2ddbd9304cd82761270b6c42271e0937aeff605ef5d865c424cc29b39ca05b123a

    Download Submit

  • \blockweb\portrefNet.exe
    Filesize

    2.2MB

    MD5

    84c6cb042dc58a109dfa2db8381bec28

    SHA1

    4a86e72e9d2c3e0c17cd3a09df754169f4b7ce31

    SHA256

    2e09ed806f9a7c57186872ab3715909437e2729500bc194e0a2cf3405c4cd5f0

    SHA512

    c8ef31a3eaeac8ef0faa043d0bdd085063d54572d0a7eefade08a9db5f97c397bb3270baca71817da9d91c0d1227fcee9ce019065bb5a66f20fed9d7349ab0ef

    Download Submit

  • memory/592-147-0x0000000002280000-0x00000000022D6000-memory.dmp

    Filesize

    344KB

    Download

  • memory/592-144-0x0000000000820000-0x0000000000A5A000-memory.dmp

    Filesize

    2.2MB

    Download

  • memory/592-145-0x0000000000340000-0x000000000035C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/592-146-0x0000000000360000-0x0000000000376000-memory.dmp

    Filesize

    88KB

    Download

  • memory/592-148-0x0000000000380000-0x000000000038E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/592-149-0x00000000003A0000-0x00000000003A8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/592-150-0x00000000003B0000-0x00000000003B8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/1740-175-0x00000000013C0000-0x00000000015FA000-memory.dmp

    Filesize

    2.2MB

    Download

  • memory/1868-80-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1868-85-0x00000000001D0000-0x00000000001D1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1868-83-0x00000000001D0000-0x00000000001D1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1868-88-0x00000000001E0000-0x00000000001E1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1868-90-0x00000000001E0000-0x00000000001E1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1868-78-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1868-75-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1868-73-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2112-18-0x0000000000400000-0x00000000010BB000-memory.dmp

    Filesize

    12.7MB

    Download

  • memory/2736-133-0x00000000002D0000-0x0000000000310000-memory.dmp

    Filesize

    256KB

    Download

  • memory/2900-22-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2900-32-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2900-44-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2900-60-0x0000000000400000-0x0000000001B6B000-memory.dmp

    Filesize

    23.4MB

    Download

  • memory/2900-49-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2900-20-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2900-57-0x0000000000290000-0x0000000000291000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2900-24-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2900-25-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2900-27-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2900-29-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2900-47-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2900-34-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2900-50-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2900-52-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2900-54-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2900-55-0x0000000000290000-0x0000000000291000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2900-37-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2900-39-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2900-42-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2900-59-0x0000000000290000-0x0000000000291000-memory.dmp

    Filesize

    4KB

    Download