dcrat | c1de15b5d043dd79dd267dd5f6d8f3ea9e15bc8a2ab63cb5fb4080cb4804c18e

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
Size

2.8MB
MD5

6258c0d7c31a5ba4b2b0cb9c97606acd
SHA1

123138131fc33eeeedc82e795f201981232a55b1
SHA256

8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4
SHA512

9e8248a258475bf8676b041073da7985a3b0a6e57cf7293415e3dd1e6e8fd6bd0056ba4d60b33f6d4c0cfec4b3f33c43e88881c6a0f6fc52f3654ff12022875e
SSDEEP

49152:rPloaBLYs0dLLXmgmQPDWSJNCQdi2GjyIlAd28nZbmsl+S2sJaOP:rPl7ZoLbFmsPNHi2GjLAdVlqO

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat 63 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1976	schtasks.exe
1996	schtasks.exe
2608	schtasks.exe
3036	schtasks.exe
1712	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\b75386f1303e64	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
1776	schtasks.exe
1280	schtasks.exe
1840	schtasks.exe
476	schtasks.exe
904	schtasks.exe
2932	schtasks.exe
2884	schtasks.exe
2000	schtasks.exe
1952	schtasks.exe
2920	schtasks.exe
2132	schtasks.exe
2092	schtasks.exe
1508	schtasks.exe
3024	schtasks.exe
1784	schtasks.exe
3060	schtasks.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\101b941d020240	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2972	schtasks.exe
1532	schtasks.exe
2988	schtasks.exe
2324	schtasks.exe
760	schtasks.exe
File created	C:\Program Files (x86)\Windows Sidebar\56085415360792	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2924	schtasks.exe
2188	schtasks.exe
3020	schtasks.exe
2420	schtasks.exe
2656	schtasks.exe
1140	schtasks.exe
1720	schtasks.exe
2856	schtasks.exe
2304	schtasks.exe
1672	schtasks.exe
2976	schtasks.exe
1500	schtasks.exe
1480	schtasks.exe
2632	schtasks.exe
2604	schtasks.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\1610b97d3ab4a7	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
File created	C:\Program Files\Windows Defender\fr-FR\c5b4cb5e9653cc	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
File created	C:\Program Files\Windows NT\TableTextService\de-DE\6ccacd8608530f	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
1648	schtasks.exe
1392	schtasks.exe
2964	schtasks.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.151\7a0fd90576e088	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
1312	schtasks.exe
1664	schtasks.exe
2664	schtasks.exe
948	schtasks.exe
2308	schtasks.exe
1768	schtasks.exe
2980	schtasks.exe
2208	schtasks.exe
3040	schtasks.exe
File created	C:\Program Files\Windows Mail\ja-JP\b75386f1303e64	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2104	schtasks.exe

Dcrat family
dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1480	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1280	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	476	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2308	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2420	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	904	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	948	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1392	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1720	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1500	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	2844	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2920	2844	schtasks.exe

UAC bypass 3 TTPs 9 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exesmss.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	smss.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral19/memory/2676-1-0x0000000000920000-0x0000000000BF2000-memory.dmp	dcrat
C:\Program Files\Windows Defender\fr-FR\services.exe	dcrat
behavioral19/memory/2052-71-0x0000000000380000-0x0000000000652000-memory.dmp	dcrat
behavioral19/memory/320-92-0x0000000000E20000-0x00000000010F2000-memory.dmp	dcrat

Executes dropped EXE 2 IoCs

Processes:

8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exesmss.exe

pid process

2052 8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
320 smss.exe

pid	process
2052	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
320	smss.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exesmss.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe

Drops file in Program Files directory 24 IoCs

Processes:

8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe

description	ioc	process
File opened for modification	C:\Program Files\Windows Mail\ja-JP\taskhost.exe	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\lsm.exe	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\1610b97d3ab4a7	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\explorer.exe	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
File created	C:\Program Files\Windows NT\TableTextService\de-DE\Idle.exe	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\wininit.exe	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\services.exe	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\de-DE\Idle.exe	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\lsm.exe	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
File created	C:\Program Files\Windows Defender\fr-FR\c5b4cb5e9653cc	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\taskhost.exe	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
File created	C:\Program Files\Windows Defender\fr-FR\services.exe	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.151\explorer.exe	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\101b941d020240	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
File created	C:\Program Files (x86)\Windows Sidebar\wininit.exe	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
File created	C:\Program Files (x86)\Windows Sidebar\56085415360792	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
File created	C:\Program Files\Windows NT\TableTextService\de-DE\6ccacd8608530f	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
File created	C:\Program Files\Windows Mail\ja-JP\taskhost.exe	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
File created	C:\Program Files\Windows Mail\ja-JP\b75386f1303e64	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\OSPPSVC.exe	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\taskhost.exe	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\OSPPSVC.exe	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\b75386f1303e64	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.151\7a0fd90576e088	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	process
2884	schtasks.exe
2604	schtasks.exe
3060	schtasks.exe
1140	schtasks.exe
1952	schtasks.exe
3040	schtasks.exe
2000	schtasks.exe
2308	schtasks.exe
1508	schtasks.exe
2608	schtasks.exe
2092	schtasks.exe
1312	schtasks.exe
1776	schtasks.exe
1664	schtasks.exe
1840	schtasks.exe
1480	schtasks.exe
2420	schtasks.exe
2980	schtasks.exe
2208	schtasks.exe
2988	schtasks.exe
476	schtasks.exe
2964	schtasks.exe
1532	schtasks.exe
1768	schtasks.exe
760	schtasks.exe
1672	schtasks.exe
2972	schtasks.exe
3020	schtasks.exe
2132	schtasks.exe
1500	schtasks.exe
3036	schtasks.exe
2656	schtasks.exe
2104	schtasks.exe
904	schtasks.exe
1648	schtasks.exe
3024	schtasks.exe
2188	schtasks.exe
1392	schtasks.exe
2632	schtasks.exe
948	schtasks.exe
1784	schtasks.exe
1976	schtasks.exe
1720	schtasks.exe
2920	schtasks.exe
2324	schtasks.exe
1712	schtasks.exe
2856	schtasks.exe
2924	schtasks.exe
1280	schtasks.exe
1996	schtasks.exe
2976	schtasks.exe
2932	schtasks.exe
2304	schtasks.exe
2664	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exesmss.exe

pid	process
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2052	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2052	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2052	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2052	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2052	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2052	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2052	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2052	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2052	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2052	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2052	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2052	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
2052	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
320	smss.exe
320	smss.exe
320	smss.exe
320	smss.exe
320	smss.exe
320	smss.exe
320	smss.exe
320	smss.exe
320	smss.exe
320	smss.exe
320	smss.exe
320	smss.exe
320	smss.exe
320	smss.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exesmss.exe

description	pid	process
Token: SeDebugPrivilege	2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
Token: SeDebugPrivilege	2052	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
Token: SeDebugPrivilege	320	smss.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.execmd.exe8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe

description	pid	process	target process
PID 2676 wrote to memory of 992	2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe	cmd.exe
PID 2676 wrote to memory of 992	2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe	cmd.exe
PID 2676 wrote to memory of 992	2676	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe	cmd.exe
PID 992 wrote to memory of 2548	992	cmd.exe	w32tm.exe
PID 992 wrote to memory of 2548	992	cmd.exe	w32tm.exe
PID 992 wrote to memory of 2548	992	cmd.exe	w32tm.exe
PID 992 wrote to memory of 2052	992	cmd.exe	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
PID 992 wrote to memory of 2052	992	cmd.exe	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
PID 992 wrote to memory of 2052	992	cmd.exe	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
PID 2052 wrote to memory of 320	2052	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe	smss.exe
PID 2052 wrote to memory of 320	2052	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe	smss.exe
PID 2052 wrote to memory of 320	2052	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe	smss.exe

System policy modification 1 TTPs 9 IoCs

evasion

Modify Registry

T1112

Processes:

8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exesmss.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
"C:\Users\Admin\AppData\Local\Temp\8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe"
1⤵
- DcRat
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2676
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ebbrynYr4Y.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2548
- - C:\Users\Admin\AppData\Local\Temp\8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe
    "C:\Users\Admin\AppData\Local\Temp\8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2052
  - - C:\Users\Default User\smss.exe
      "C:\Users\Default User\smss.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      System policy modification
      PID:320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\Accessories\lsm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\Accessories\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Sidebar\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\OSPPSVC.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender\fr-FR\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\fr-FR\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Defender\fr-FR\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\taskhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\Update\1.3.36.151\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\1.3.36.151\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Google\Update\1.3.36.151\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\TableTextService\de-DE\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\de-DE\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows NT\TableTextService\de-DE\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\ja-JP\taskhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\ja-JP\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Mail\ja-JP\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Saved Games\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Admin\Saved Games\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Saved Games\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\audiodg.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed48" /sc MINUTE /mo 13 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4" /sc ONLOGON /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed48" /sc MINUTE /mo 8 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Defender\fr-FR\services.exe

Filesize
2.8MB

MD5
6258c0d7c31a5ba4b2b0cb9c97606acd

SHA1
123138131fc33eeeedc82e795f201981232a55b1

SHA256
8d5514730f330a6f4ae9b1807f0c77ed15975d469c7c92c10c690ed681210ed4

SHA512
9e8248a258475bf8676b041073da7985a3b0a6e57cf7293415e3dd1e6e8fd6bd0056ba4d60b33f6d4c0cfec4b3f33c43e88881c6a0f6fc52f3654ff12022875e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5811.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5814.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebbrynYr4Y.bat

Filesize
267B

MD5
41ab16dcdd48bb72a1ed725d84f16b7b

SHA1
e79d5e1f2dba016001aec4bdcc398c1483218817

SHA256
cd9524e595a00f7c3e104fd504b380eafbb2f3b52013996aec6523d81c760748

SHA512
745246dfe03c0d5a7f8aa09a637a5217b4fca358428894a55bb7942f01ddc96c0904aad9ef9ebc5c2e5d565e96772ce540cf88711a6e4cdf757f7fd2ada55ace

Download Submit
memory/320-93-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/320-92-0x0000000000E20000-0x00000000010F2000-memory.dmp

Filesize
2.8MB

Download
memory/2052-72-0x00000000008C0000-0x00000000008D2000-memory.dmp

Filesize
72KB

Download
memory/2052-71-0x0000000000380000-0x0000000000652000-memory.dmp

Filesize
2.8MB

Download
memory/2676-7-0x0000000000420000-0x0000000000436000-memory.dmp

Filesize
88KB

Download
memory/2676-19-0x000000001AE90000-0x000000001AE9A000-memory.dmp

Filesize
40KB

Download
memory/2676-10-0x0000000000560000-0x000000000056A000-memory.dmp

Filesize
40KB

Download
memory/2676-11-0x000000001AA60000-0x000000001AAB6000-memory.dmp

Filesize
344KB

Download
memory/2676-12-0x0000000000910000-0x0000000000918000-memory.dmp

Filesize
32KB

Download
memory/2676-13-0x0000000002470000-0x0000000002482000-memory.dmp

Filesize
72KB

Download
memory/2676-14-0x00000000024A0000-0x00000000024A8000-memory.dmp

Filesize
32KB

Download
memory/2676-15-0x000000001A930000-0x000000001A93C000-memory.dmp

Filesize
48KB

Download
memory/2676-16-0x000000001A940000-0x000000001A94C000-memory.dmp

Filesize
48KB

Download
memory/2676-17-0x000000001A950000-0x000000001A95E000-memory.dmp

Filesize
56KB

Download
memory/2676-18-0x000000001AE80000-0x000000001AE8C000-memory.dmp

Filesize
48KB

Download
memory/2676-9-0x0000000002170000-0x0000000002182000-memory.dmp

Filesize
72KB

Download
memory/2676-20-0x000000001AFE0000-0x000000001AFEC000-memory.dmp

Filesize
48KB

Download
memory/2676-8-0x0000000000550000-0x0000000000558000-memory.dmp

Filesize
32KB

Download
memory/2676-62-0x000007FEF51C3000-0x000007FEF51C4000-memory.dmp

Filesize
4KB

Download
memory/2676-0-0x000007FEF51C3000-0x000007FEF51C4000-memory.dmp

Filesize
4KB

Download
memory/2676-69-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

Filesize
9.9MB

Download
memory/2676-6-0x0000000000410000-0x0000000000420000-memory.dmp

Filesize
64KB

Download
memory/2676-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2676-4-0x00000000003E0000-0x00000000003FC000-memory.dmp

Filesize
112KB

Download
memory/2676-3-0x0000000000250000-0x000000000025E000-memory.dmp

Filesize
56KB

Download
memory/2676-2-0x000007FEF51C0000-0x000007FEF5BAC000-memory.dmp

Filesize
9.9MB

Download
memory/2676-1-0x0000000000920000-0x0000000000BF2000-memory.dmp

Filesize
2.8MB

Download