dcrat | 295688858c999f14377a10366d1b74037d6c7e92aa36554bf5b7ce478a6e6205

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SysWOW64\\msports\\cmd.exe\", \"C:\\Windows\\System32\\vpnike\\dllhost.exe\", \"C:\\Windows\\System32\\raschap\\csrss.exe\", \"C:\\Windows\\System32\\ucrtbase\\wininit.exe\", \"C:\\Documents and Settings\\conhost.exe\", \"C:\\Windows\\System32\\DeviceProperties\\dwm.exe\""	Perfmonitorfontinto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SysWOW64\\msports\\cmd.exe\""	Perfmonitorfontinto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SysWOW64\\msports\\cmd.exe\", \"C:\\Windows\\System32\\vpnike\\dllhost.exe\""	Perfmonitorfontinto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SysWOW64\\msports\\cmd.exe\", \"C:\\Windows\\System32\\vpnike\\dllhost.exe\", \"C:\\Windows\\System32\\raschap\\csrss.exe\""	Perfmonitorfontinto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SysWOW64\\msports\\cmd.exe\", \"C:\\Windows\\System32\\vpnike\\dllhost.exe\", \"C:\\Windows\\System32\\raschap\\csrss.exe\", \"C:\\Windows\\System32\\ucrtbase\\wininit.exe\""	Perfmonitorfontinto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SysWOW64\\msports\\cmd.exe\", \"C:\\Windows\\System32\\vpnike\\dllhost.exe\", \"C:\\Windows\\System32\\raschap\\csrss.exe\", \"C:\\Windows\\System32\\ucrtbase\\wininit.exe\", \"C:\\Documents and Settings\\conhost.exe\""	Perfmonitorfontinto.exe

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	2268	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	2268	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	2268	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	2268	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	2268	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	2268	schtasks.exe	35

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016c66-9.dat	dcrat
behavioral1/memory/2296-13-0x0000000000BF0000-0x0000000000DFE000-memory.dmp	dcrat
behavioral1/memory/2760-33-0x0000000000E20000-0x000000000102E000-memory.dmp	dcrat

Disables Task Manager via registry modification
evasion

Executes dropped EXE 2 IoCs

pid	Process
2296	Perfmonitorfontinto.exe
2760	conhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2496	cmd.exe
2496	cmd.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Documents and Settings\\conhost.exe\""	Perfmonitorfontinto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Windows\\SysWOW64\\msports\\cmd.exe\""	Perfmonitorfontinto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\vpnike\\dllhost.exe\""	Perfmonitorfontinto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\vpnike\\dllhost.exe\""	Perfmonitorfontinto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\raschap\\csrss.exe\""	Perfmonitorfontinto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\raschap\\csrss.exe\""	Perfmonitorfontinto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\System32\\ucrtbase\\wininit.exe\""	Perfmonitorfontinto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Documents and Settings\\conhost.exe\""	Perfmonitorfontinto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Windows\\SysWOW64\\msports\\cmd.exe\""	Perfmonitorfontinto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\System32\\ucrtbase\\wininit.exe\""	Perfmonitorfontinto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\DeviceProperties\\dwm.exe\""	Perfmonitorfontinto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\DeviceProperties\\dwm.exe\""	Perfmonitorfontinto.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\System32\vpnike\dllhost.exe	Perfmonitorfontinto.exe
File created	C:\Windows\System32\raschap\886983d96e3d3e31032c679b2d4ea91b6c05afef	Perfmonitorfontinto.exe
File created	C:\Windows\System32\ucrtbase\wininit.exe	Perfmonitorfontinto.exe
File created	C:\Windows\System32\ucrtbase\560854153607923c4c5f107085a7db67be01f252	Perfmonitorfontinto.exe
File created	C:\Windows\System32\DeviceProperties\dwm.exe	Perfmonitorfontinto.exe
File created	C:\Windows\System32\DeviceProperties\6cb0b6c459d5d3455a3da700e713f2e2529862ff	Perfmonitorfontinto.exe
File created	C:\Windows\SysWOW64\msports\cmd.exe	Perfmonitorfontinto.exe
File opened for modification	C:\Windows\SysWOW64\msports\cmd.exe	Perfmonitorfontinto.exe
File created	C:\Windows\SysWOW64\msports\ebf1f9fa8afd6d1932bd65bc4cc3af89a4c8e228	Perfmonitorfontinto.exe
File created	C:\Windows\System32\vpnike\5940a34987c99120d96dace90a3f93f329dcad63	Perfmonitorfontinto.exe
File created	C:\Windows\System32\raschap\csrss.exe	Perfmonitorfontinto.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	295688858c999f14377a10366d1b74037d6c7e92aa36554bf5b7ce478a6e6205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
3048	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2860	schtasks.exe
2500	schtasks.exe
2924	schtasks.exe
3020	schtasks.exe
2968	schtasks.exe
2712	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2296	Perfmonitorfontinto.exe
2760	conhost.exe
2760	conhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2296	Perfmonitorfontinto.exe
Token: SeDebugPrivilege	2760	conhost.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 1736	2408	295688858c999f14377a10366d1b74037d6c7e92aa36554bf5b7ce478a6e6205.exe	30
PID 2408 wrote to memory of 1736	2408	295688858c999f14377a10366d1b74037d6c7e92aa36554bf5b7ce478a6e6205.exe	30
PID 2408 wrote to memory of 1736	2408	295688858c999f14377a10366d1b74037d6c7e92aa36554bf5b7ce478a6e6205.exe	30
PID 2408 wrote to memory of 1736	2408	295688858c999f14377a10366d1b74037d6c7e92aa36554bf5b7ce478a6e6205.exe	30
PID 1736 wrote to memory of 2496	1736	WScript.exe	32
PID 1736 wrote to memory of 2496	1736	WScript.exe	32
PID 1736 wrote to memory of 2496	1736	WScript.exe	32
PID 1736 wrote to memory of 2496	1736	WScript.exe	32
PID 2496 wrote to memory of 2296	2496	cmd.exe	34
PID 2496 wrote to memory of 2296	2496	cmd.exe	34
PID 2496 wrote to memory of 2296	2496	cmd.exe	34
PID 2496 wrote to memory of 2296	2496	cmd.exe	34
PID 2296 wrote to memory of 844	2296	Perfmonitorfontinto.exe	42
PID 2296 wrote to memory of 844	2296	Perfmonitorfontinto.exe	42
PID 2296 wrote to memory of 844	2296	Perfmonitorfontinto.exe	42
PID 2496 wrote to memory of 3048	2496	cmd.exe	44
PID 2496 wrote to memory of 3048	2496	cmd.exe	44
PID 2496 wrote to memory of 3048	2496	cmd.exe	44
PID 2496 wrote to memory of 3048	2496	cmd.exe	44
PID 844 wrote to memory of 1384	844	cmd.exe	45
PID 844 wrote to memory of 1384	844	cmd.exe	45
PID 844 wrote to memory of 1384	844	cmd.exe	45
PID 844 wrote to memory of 2760	844	cmd.exe	46
PID 844 wrote to memory of 2760	844	cmd.exe	46
PID 844 wrote to memory of 2760	844	cmd.exe	46

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\295688858c999f14377a10366d1b74037d6c7e92aa36554bf5b7ce478a6e6205.exe
"C:\Users\Admin\AppData\Local\Temp\295688858c999f14377a10366d1b74037d6c7e92aa36554bf5b7ce478a6e6205.exe"
1⤵
- DcRat
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Perfmonitor\lNQQOstPqxiFMmsYvmB.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Perfmonitor\O0mpFdbBjdm7srZfGtzhIPYG.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2496
  - - C:\Perfmonitor\Perfmonitorfontinto.exe
      "C:\Perfmonitor\Perfmonitorfontinto.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2296
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2xDdx8lwTl.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:844
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1384
      - C:\Documents and Settings\conhost.exe
        
        "C:\Documents and Settings\conhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2760
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\SysWOW64\msports\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\vpnike\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\raschap\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\ucrtbase\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Documents and Settings\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\DeviceProperties\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

3

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery