dcrat | cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0

Analysis

max time kernel
117s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2024 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe
Size

1.6MB
MD5

a9ccc8eefd0a09f70dc9e929fd7d3f20
SHA1

594a474233d4462cbaeabe4fca98e6869e9efff2
SHA256

cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0
SHA512

91781525d2c54f101d8ba898af7f4f95c3d412bc0fd3793675b2fac4c598219234b6d0acee3d4f27016a424884615c410be644b1e563db1d102b99a8f92b9f27
SSDEEP

24576:Wr3+VTI7YmAX6LGRwQHly8XIrDExXGLwiDZ1G/MdeZ75+mHxeipjsRn6Nil:WUS9ZDExWNtM/MdeZ77ej6c

Score

10^/10

dcrat discovery infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	csrss.exe

Executes dropped EXE 14 IoCs

pid	Process
4984	csrss.exe
3532	csrss.exe
2564	csrss.exe
1660	csrss.exe
4616	csrss.exe
3260	csrss.exe
1224	csrss.exe
2880	csrss.exe
2260	csrss.exe
3156	csrss.exe
2464	csrss.exe
4976	csrss.exe
3004	csrss.exe
2640	csrss.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\56085415360792	cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe
File created	C:\Program Files (x86)\Windows NT\Registry.exe	cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe
File created	C:\Program Files (x86)\Windows NT\ee2ad38f3d4382	cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe
File created	C:\Program Files\Mozilla Firefox\fonts\RuntimeBroker.exe	cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe
File created	C:\Program Files\Mozilla Firefox\fonts\9e8d7a4ca61bd9	cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\upfc.exe	cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\ea1d8f6d871115	cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\wininit.exe	cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 8 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4908	PING.EXE
4964	PING.EXE
4200	PING.EXE
4776	PING.EXE
4716	PING.EXE
4408	PING.EXE
220	PING.EXE
4588	PING.EXE

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	csrss.exe

Runs ping.exe 1 TTPs 8 IoCs

Remote System Discovery

T1018

pid	Process
4588	PING.EXE
4908	PING.EXE
4964	PING.EXE
4200	PING.EXE
4776	PING.EXE
4716	PING.EXE
4408	PING.EXE
220	PING.EXE

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
5064	cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe
5064	cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe
5064	cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe
5064	cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe
5064	cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe
5064	cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe
5064	cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	5064	cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe
Token: SeDebugPrivilege	4984	csrss.exe
Token: SeDebugPrivilege	3532	csrss.exe
Token: SeDebugPrivilege	2564	csrss.exe
Token: SeDebugPrivilege	1660	csrss.exe
Token: SeDebugPrivilege	4616	csrss.exe
Token: SeDebugPrivilege	3260	csrss.exe
Token: SeDebugPrivilege	1224	csrss.exe
Token: SeDebugPrivilege	2880	csrss.exe
Token: SeDebugPrivilege	2260	csrss.exe
Token: SeDebugPrivilege	3156	csrss.exe
Token: SeDebugPrivilege	2464	csrss.exe
Token: SeDebugPrivilege	4976	csrss.exe
Token: SeDebugPrivilege	3004	csrss.exe
Token: SeDebugPrivilege	2640	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 1196	5064	cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe	86
PID 5064 wrote to memory of 1196	5064	cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe	86
PID 1196 wrote to memory of 2976	1196	cmd.exe	88
PID 1196 wrote to memory of 2976	1196	cmd.exe	88
PID 1196 wrote to memory of 220	1196	cmd.exe	89
PID 1196 wrote to memory of 220	1196	cmd.exe	89
PID 1196 wrote to memory of 4984	1196	cmd.exe	95
PID 1196 wrote to memory of 4984	1196	cmd.exe	95
PID 4984 wrote to memory of 2596	4984	csrss.exe	98
PID 4984 wrote to memory of 2596	4984	csrss.exe	98
PID 2596 wrote to memory of 1992	2596	cmd.exe	100
PID 2596 wrote to memory of 1992	2596	cmd.exe	100
PID 2596 wrote to memory of 4588	2596	cmd.exe	101
PID 2596 wrote to memory of 4588	2596	cmd.exe	101
PID 2596 wrote to memory of 3532	2596	cmd.exe	102
PID 2596 wrote to memory of 3532	2596	cmd.exe	102
PID 3532 wrote to memory of 1176	3532	csrss.exe	103
PID 3532 wrote to memory of 1176	3532	csrss.exe	103
PID 1176 wrote to memory of 864	1176	cmd.exe	105
PID 1176 wrote to memory of 864	1176	cmd.exe	105
PID 1176 wrote to memory of 4908	1176	cmd.exe	106
PID 1176 wrote to memory of 4908	1176	cmd.exe	106
PID 1176 wrote to memory of 2564	1176	cmd.exe	108
PID 1176 wrote to memory of 2564	1176	cmd.exe	108
PID 2564 wrote to memory of 2828	2564	csrss.exe	109
PID 2564 wrote to memory of 2828	2564	csrss.exe	109
PID 2828 wrote to memory of 5084	2828	cmd.exe	111
PID 2828 wrote to memory of 5084	2828	cmd.exe	111
PID 2828 wrote to memory of 4964	2828	cmd.exe	112
PID 2828 wrote to memory of 4964	2828	cmd.exe	112
PID 2828 wrote to memory of 1660	2828	cmd.exe	114
PID 2828 wrote to memory of 1660	2828	cmd.exe	114
PID 1660 wrote to memory of 4104	1660	csrss.exe	115
PID 1660 wrote to memory of 4104	1660	csrss.exe	115
PID 4104 wrote to memory of 2232	4104	cmd.exe	117
PID 4104 wrote to memory of 2232	4104	cmd.exe	117
PID 4104 wrote to memory of 3204	4104	cmd.exe	118
PID 4104 wrote to memory of 3204	4104	cmd.exe	118
PID 4104 wrote to memory of 4616	4104	cmd.exe	119
PID 4104 wrote to memory of 4616	4104	cmd.exe	119
PID 4616 wrote to memory of 5076	4616	csrss.exe	120
PID 4616 wrote to memory of 5076	4616	csrss.exe	120
PID 5076 wrote to memory of 1524	5076	cmd.exe	122
PID 5076 wrote to memory of 1524	5076	cmd.exe	122
PID 5076 wrote to memory of 1532	5076	cmd.exe	123
PID 5076 wrote to memory of 1532	5076	cmd.exe	123
PID 5076 wrote to memory of 3260	5076	cmd.exe	124
PID 5076 wrote to memory of 3260	5076	cmd.exe	124
PID 3260 wrote to memory of 1796	3260	csrss.exe	125
PID 3260 wrote to memory of 1796	3260	csrss.exe	125
PID 1796 wrote to memory of 964	1796	cmd.exe	127
PID 1796 wrote to memory of 964	1796	cmd.exe	127
PID 1796 wrote to memory of 4200	1796	cmd.exe	128
PID 1796 wrote to memory of 4200	1796	cmd.exe	128
PID 1796 wrote to memory of 1224	1796	cmd.exe	129
PID 1796 wrote to memory of 1224	1796	cmd.exe	129
PID 1224 wrote to memory of 784	1224	csrss.exe	130
PID 1224 wrote to memory of 784	1224	csrss.exe	130
PID 784 wrote to memory of 3124	784	cmd.exe	132
PID 784 wrote to memory of 3124	784	cmd.exe	132
PID 784 wrote to memory of 4384	784	cmd.exe	133
PID 784 wrote to memory of 4384	784	cmd.exe	133
PID 784 wrote to memory of 2880	784	cmd.exe	134
PID 784 wrote to memory of 2880	784	cmd.exe	134

C:\Users\Admin\AppData\Local\Temp\cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe
"C:\Users\Admin\AppData\Local\Temp\cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0N.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Zn4IUa01sU.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2976
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:220
- - C:\Recovery\WindowsRE\csrss.exe
    "C:\Recovery\WindowsRE\csrss.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MJezb5uUW4.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2596
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1992
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4588
    - - C:\Recovery\WindowsRE\csrss.exe
        
        "C:\Recovery\WindowsRE\csrss.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3532
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4ZZGHVO0om.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1176
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:864
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4908
        
        C:\Recovery\WindowsRE\csrss.exe
        
        "C:\Recovery\WindowsRE\csrss.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2564
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XX22crJjk3.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2828
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:5084
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4964
        
        C:\Recovery\WindowsRE\csrss.exe
        
        "C:\Recovery\WindowsRE\csrss.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1660
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\L4pr7KvdK9.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4104
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:2232
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:3204
        
        C:\Recovery\WindowsRE\csrss.exe
        
        "C:\Recovery\WindowsRE\csrss.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4616
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TAB96jcSpT.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:5076
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:1524
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:1532
        
        C:\Recovery\WindowsRE\csrss.exe
        
        "C:\Recovery\WindowsRE\csrss.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3260
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\72DWG1NhBc.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:1796
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:964
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        15⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4200
        
        C:\Recovery\WindowsRE\csrss.exe
        
        "C:\Recovery\WindowsRE\csrss.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1224
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bFWQ59IHKo.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:784
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:3124
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:4384
        
        C:\Recovery\WindowsRE\csrss.exe
        
        "C:\Recovery\WindowsRE\csrss.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2880
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zq8KtNWkLV.bat"
        18⤵
        
        PID:4468
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:4612
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:3532
        
        C:\Recovery\WindowsRE\csrss.exe
        
        "C:\Recovery\WindowsRE\csrss.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2260
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9VsmEYMPZS.bat"
        20⤵
        
        PID:3972
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:5012
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2656
        
        C:\Recovery\WindowsRE\csrss.exe
        
        "C:\Recovery\WindowsRE\csrss.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3156
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VdpP4GbADJ.bat"
        22⤵
        
        PID:1588
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:4232
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        23⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4776
        
        C:\Recovery\WindowsRE\csrss.exe
        
        "C:\Recovery\WindowsRE\csrss.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2464
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5nOOmGNqzh.bat"
        24⤵
        
        PID:2052
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:4296
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        25⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4716
        
        C:\Recovery\WindowsRE\csrss.exe
        
        "C:\Recovery\WindowsRE\csrss.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4976
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BP5Pm95y6C.bat"
        26⤵
        
        PID:4592
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:1684
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:5064
        
        C:\Recovery\WindowsRE\csrss.exe
        
        "C:\Recovery\WindowsRE\csrss.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3004
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CeuXGu4pI7.bat"
        28⤵
        
        PID:4348
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:4732
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        29⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4408
        
        C:\Recovery\WindowsRE\csrss.exe
        
        "C:\Recovery\WindowsRE\csrss.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2640
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BP5Pm95y6C.bat"
        30⤵
        
        PID:4336
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        31⤵
        
        PID:1688
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        31⤵
        
        PID:3480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows NT\Registry.exe

Filesize
1.6MB

MD5
a9ccc8eefd0a09f70dc9e929fd7d3f20

SHA1
594a474233d4462cbaeabe4fca98e6869e9efff2

SHA256
cb9d8ee783ab69f0ddb033187681264686982a82d82a09794fea1b6de7fea3a0

SHA512
91781525d2c54f101d8ba898af7f4f95c3d412bc0fd3793675b2fac4c598219234b6d0acee3d4f27016a424884615c410be644b1e563db1d102b99a8f92b9f27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log

Filesize
1KB

MD5
11aa02596ceccef38b448c52a899f470

SHA1
6da94dc9579e969d39d5e65c066af3a5251e39b4

SHA256
e778ec777a79a1a9c9a3b605ab9681558395d2f3ef46f6c34dca1e00dcd771fd

SHA512
5de4fd51ae76cce8de25c5257ee873a71668acdf407bc3351410f9f840a9b074099d4c018657d2cc8f33273e6fd03e4365165e4834ba12c052d735212bf5d0d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\4ZZGHVO0om.bat

Filesize
159B

MD5
61c843738edf04534e6ab3fb4a13e9ca

SHA1
cf9d84cf74db5b729ded210937a722d3e34da638

SHA256
c23c436dd6a6cce54c158bffe769215824b745135cdd90d6a02c56308e022f63

SHA512
725808a5129bf27e996bfe94f6f6af08f5d2bd658ada249d1e1ad7014a3e6c800006fa1659ed4f7f01248a412ec6874000cb80e0a62ab868383753e4c9d5f365

Download Submit
C:\Users\Admin\AppData\Local\Temp\5nOOmGNqzh.bat

Filesize
159B

MD5
5488ddbc83e39d43ff0b59c6ccd05d23

SHA1
20d5a8a02dc157dae98fd3bcc8be4989667fbb44

SHA256
5b85efefa2f11b8e084b57e6b5908d64e872139e60c1b9a98c2be2fb7e3ebcac

SHA512
2864bfe1bae4bffc2c1a711f8fbc3b4b3baa11952d80ae6c9ef3bb6be53e7ad97cbdb055d5df04d5e1c259b1725a463c8eb5ed2433565b7670a4bca3762ce5a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\72DWG1NhBc.bat

Filesize
159B

MD5
a25d3225245f5511db2e12d379cd3e38

SHA1
5f528d32a4025d6e5ea7264c7b1447c2cde69ab1

SHA256
ab120112ac50a9f6d854c41d678f745fc23966759b9a6b97fc0fe9d78c17e19d

SHA512
7f0f848202d79c75cbb2ced4770a7091f0631202f654ec2b7cdf73f37b183d7f56a3b4faca7a7327722ff6a1e52f48d1e19e0a453694539a1352b0bc5eece7b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\9VsmEYMPZS.bat

Filesize
207B

MD5
cc319feca8e4ce4491c66639be6a103f

SHA1
f9388f80322b0c289eb04a55f2cb73edf818cdf5

SHA256
8b9912d08db3e1e42be41253fdd358f82595393d9f4c4485c03079c8c1278347

SHA512
cad934bab35369ca39ab3d6574aa42ede13e32aee893b4a13649ce2299259293a0d432c17f44544211e805517b6d23f991265d659218c369e9c9c7db547b8ebf

Download Submit
C:\Users\Admin\AppData\Local\Temp\BP5Pm95y6C.bat

Filesize
207B

MD5
96005507ffcfc1d8e8d2500378e619a6

SHA1
5e4a89061fd93aa13511423356e846374dc9b44b

SHA256
c7e718f678c89ab0ba96de5eae50a0c5b1282bf3b52f119d73a5da5d1c4abb3a

SHA512
15b3b34f2c9ef87dd238b022636dde58f81cd779d1ec65f8ca37504bf320ddb158c093db98418f71ea37a1854678c7e379ed409ed1664fd10af2ae5565ef3462

Download Submit
C:\Users\Admin\AppData\Local\Temp\CeuXGu4pI7.bat

Filesize
159B

MD5
efcab39e995c88ef7fb33cdb08df644c

SHA1
ee966ec8ef619c77a435dac8b9d45b152f161d96

SHA256
9ef4c9a0781dfa99727d1508c62abea19d2fbff138581a7e9a3cb20c3e6599f5

SHA512
fbb1730d479223d53110f924c9aeb34d2106954ca69ba3e323ab848a012a7e774d5ad8e69819fd691102f3bef7fe4c025dd04e508416ad63bbfa8d75cb13469e

Download Submit
C:\Users\Admin\AppData\Local\Temp\L4pr7KvdK9.bat

Filesize
207B

MD5
90612bc0856f86f495274ed9ae3891df

SHA1
b82162fce132c453cedb12ad0ad19014812ffabf

SHA256
a9ee426b4b8198709d2bb324ddcf235695139de27e22572dfbf9eb3083763afa

SHA512
8e78c4ef2424d1bbfc033e278671acc1ea58d3ea8793a6a7cc573a3960d8b6b2462b44380eae73c231d752da3a8c70230fcdf9389af16101877fa2785217323c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MJezb5uUW4.bat

Filesize
159B

MD5
86bce5f8b687b70e8efbb5ee9a56b9bc

SHA1
4257b8250163a08591ecc0a3e0f227f221b8f374

SHA256
a8087c2d1c78cd027d22cdf6289221645de9df563fbe356bb4eb94960d3d8ea0

SHA512
996147148a625f2d2f201ce71062b423f2d67c10f40ab31cf923acf797c4e8933edc193b71ea6804e3c082f4f76c4172c8cbf230e4e9f06ff5839e723c7b4422

Download Submit
C:\Users\Admin\AppData\Local\Temp\TAB96jcSpT.bat

Filesize
207B

MD5
1c9b0d9e95639aeeb2542b80985b594b

SHA1
de92cef39eb22f3af32291112f68b85848821587

SHA256
7fb14e3cff1933d1922b251860785dd4610839760a52a2d7d29fad4730cc015b

SHA512
671ae9ca8bee388badba7a005e1abf943e9031b833ed7488d287b73f7a953f12a2d20f1adfac399499e68df8a928fa894bc6c429b3c7f5446e94293c9a8cd3fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\VdpP4GbADJ.bat

Filesize
159B

MD5
4740e7b40068cb01a9570e08b71fc850

SHA1
2f50ab7c0a19b2d4dab07106f9e9b4ece0fd49c4

SHA256
dd54c77f807d38cc496c4aa5146866852c6a6e0ea9b0612ba45c632d18fd7ad1

SHA512
5901351b6ee12b818ff061d70c9b00a06d5fad47a9f502cbdabd4802ce75a712c4093c51d37f02aa221b11c04d655b6788c4e8f6a6bef7a7b6ec5f89a93b231e

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX22crJjk3.bat

Filesize
159B

MD5
667cf2a40fcd74ebd1d7100c730c34be

SHA1
ed054d785c2eb772ffaf2e4daa866c6cd5d74ab0

SHA256
f2ab88bab2e13a003a09c66923daeea1200dfd8bc4345dd4f29b2e9d8ba04ef0

SHA512
8179e7b37961757b45a260e0a9c79869a1a21c08b4ee6731487d49213cc8bf5804b0621adcef22f523f0eb44413e55220baea2298ebef773c7146d45266a216d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zn4IUa01sU.bat

Filesize
159B

MD5
078ede23f8c6dd4504925ec6d8f53c3f

SHA1
b6c797893fe94a8843db30830c93c2f9c2750d70

SHA256
236b226b3f11605219b038e400872611ff729f6ae4c6b26a5713ec6f73d24e90

SHA512
68172bc17bba881f2794ca04c31c9fbaf503f6a1d14a29521fc82d43ff7b493347ae939faea8199f9ce00a1ec4d2b5003582db57c0f3f5b741da737387815e4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\bFWQ59IHKo.bat

Filesize
207B

MD5
6d53f56c15652ce46a2aa7213820478e

SHA1
807d4b08f82d1dd8ebe1e8636324f397a23b556e

SHA256
f2acf4831ae0afe23e6b98dcb1e9fb45302787635f8f080e2a655867d50c47dd

SHA512
0862b4224c61ec903b2e35a51b66c5f23ab130a4bcfa9b79bf9a0bb7d963539b4166aa320bc35f6d52a188c79c695f053258b416ab0fa10b5d97e9aeb34633e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\zq8KtNWkLV.bat

Filesize
207B

MD5
fcce54b0aded4b9f66f2088361570bdd

SHA1
e8282adddaeb562d5dbf9e1300a020514adecf7a

SHA256
ccf8fb795a442832ea027d7e8644e235c729c7151bec3ccc022f9aba7c7b6751

SHA512
8707613cc8e4c831549c9807d61da243f4cfb2f733d6c2b414d52c6d77cb73dbd95a7041d0a15f6612fbbfa50bf5ad99472ff419f961a33d6d02bf07922b74df

Download Submit
memory/4984-32-0x00007FF81A2B0000-0x00007FF81A315000-memory.dmp

Filesize
404KB

Download
memory/4984-26-0x00007FF81A2B0000-0x00007FF81A315000-memory.dmp

Filesize
404KB

Download
memory/4984-25-0x00007FF81A2B0000-0x00007FF81A315000-memory.dmp

Filesize
404KB

Download
memory/5064-0-0x00007FF81A2E3000-0x00007FF81A2E5000-memory.dmp

Filesize
8KB

Download
memory/5064-21-0x00007FF81A2E0000-0x00007FF81ADA1000-memory.dmp

Filesize
10.8MB

Download
memory/5064-3-0x00007FF81A2E0000-0x00007FF81ADA1000-memory.dmp

Filesize
10.8MB

Download
memory/5064-2-0x00007FF81A2E0000-0x00007FF81ADA1000-memory.dmp

Filesize
10.8MB

Download
memory/5064-1-0x00000000009E0000-0x0000000000B78000-memory.dmp

Filesize
1.6MB

Download