dcrat | d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf

Analysis

max time kernel
147s
max time network
153s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 03:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Size

2.4MB
MD5

16be4b35fbc59aa471fff4ab77f53c5e
SHA1

5d31d96f0562309fc24294ecfdb3d2a26b238764
SHA256

d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf
SHA512

29c902990c748f34c260a08811f1f24956bbc62b7135e58095753ef1f9ad5a094bc560a3dc7aaadb6295eb518b6ad4d645d4775cf11b9a87fd868dc138cf9b45
SSDEEP

49152:pCZ/7MmTJP/uNiZ4qBpWVPW6dKiXGRhuknLwFPy4Eiw7m:aDMmTJXui4qBpWLZgukLwkiA

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat 10 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		2724	schtasks.exe
		2920	schtasks.exe
		616	schtasks.exe
		2324	schtasks.exe
		2820	schtasks.exe
		1972	schtasks.exe
		1852	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
		2840	schtasks.exe
		2864	schtasks.exe

Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:/Users/Admin/AppData/Local/discord/Network\\services.exe\""	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:/Users/Admin/AppData/Local/discord/Network\\services.exe\", \"C:/Users/Admin/AppData/Local/discord/Network\\audiodg.exe\""	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:/Users/Admin/AppData/Local/discord/Network\\services.exe\", \"C:/Users/Admin/AppData/Local/discord/Network\\audiodg.exe\", \"C:/Users/Admin/AppData/Local/discord/Network\\csrss.exe\""	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	3040	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	3040	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	3040	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2920	3040	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	3040	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	616	3040	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	3040	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1972	3040	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	3040	schtasks.exe	30

UAC bypass 3 TTPs 39 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1372-1-0x0000000000A10000-0x0000000000C7E000-memory.dmp	dcrat
behavioral1/memory/2916-21-0x0000000000A70000-0x0000000000CDE000-memory.dmp	dcrat
behavioral1/files/0x0004000000004ed7-37.dat	dcrat
behavioral1/memory/1752-42-0x0000000000020000-0x000000000028E000-memory.dmp	dcrat
behavioral1/memory/1804-54-0x0000000000D10000-0x0000000000F7E000-memory.dmp	dcrat
behavioral1/memory/3008-90-0x0000000000360000-0x00000000005CE000-memory.dmp	dcrat
behavioral1/memory/3012-102-0x0000000000CE0000-0x0000000000F4E000-memory.dmp	dcrat
behavioral1/memory/2432-126-0x0000000000E00000-0x000000000106E000-memory.dmp	dcrat
behavioral1/memory/2652-139-0x0000000000F10000-0x000000000117E000-memory.dmp	dcrat

Executes dropped EXE 10 IoCs

pid	Process
1752	csrss.exe
1804	csrss.exe
328	csrss.exe
2084	csrss.exe
3008	csrss.exe
3012	csrss.exe
2300	csrss.exe
2432	csrss.exe
2652	csrss.exe
920	csrss.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:/Users/Admin/AppData/Local/discord/Network\\services.exe\""	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:/Users/Admin/AppData/Local/discord/Network\\services.exe\""	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:/Users/Admin/AppData/Local/discord/Network\\audiodg.exe\""	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:/Users/Admin/AppData/Local/discord/Network\\audiodg.exe\""	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:/Users/Admin/AppData/Local/discord/Network\\csrss.exe\""	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:/Users/Admin/AppData/Local/discord/Network\\csrss.exe\""	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe

Checks whether UAC is enabled 1 TTPs 26 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
30	pastebin.com
5	pastebin.com
12	pastebin.com
15	pastebin.com
24	pastebin.com
27	pastebin.com
4	pastebin.com
9	pastebin.com
18	pastebin.com
21	pastebin.com
33	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2840	schtasks.exe
2864	schtasks.exe
2920	schtasks.exe
1852	schtasks.exe
2724	schtasks.exe
616	schtasks.exe
2820	schtasks.exe
1972	schtasks.exe
2324	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1372	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
2916	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
748	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
1752	csrss.exe
1804	csrss.exe
328	csrss.exe
2084	csrss.exe
3008	csrss.exe
3012	csrss.exe
2300	csrss.exe
2432	csrss.exe
2652	csrss.exe
920	csrss.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	1372	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Token: SeDebugPrivilege	2916	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Token: SeDebugPrivilege	748	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Token: SeDebugPrivilege	1752	csrss.exe
Token: SeDebugPrivilege	1804	csrss.exe
Token: SeDebugPrivilege	328	csrss.exe
Token: SeDebugPrivilege	2084	csrss.exe
Token: SeDebugPrivilege	3008	csrss.exe
Token: SeDebugPrivilege	3012	csrss.exe
Token: SeDebugPrivilege	2300	csrss.exe
Token: SeDebugPrivilege	2432	csrss.exe
Token: SeDebugPrivilege	2652	csrss.exe
Token: SeDebugPrivilege	920	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 2932	1372	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe	34
PID 1372 wrote to memory of 2932	1372	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe	34
PID 1372 wrote to memory of 2932	1372	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe	34
PID 2932 wrote to memory of 2700	2932	cmd.exe	36
PID 2932 wrote to memory of 2700	2932	cmd.exe	36
PID 2932 wrote to memory of 2700	2932	cmd.exe	36
PID 2932 wrote to memory of 2916	2932	cmd.exe	38
PID 2932 wrote to memory of 2916	2932	cmd.exe	38
PID 2932 wrote to memory of 2916	2932	cmd.exe	38
PID 2916 wrote to memory of 2904	2916	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe	42
PID 2916 wrote to memory of 2904	2916	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe	42
PID 2916 wrote to memory of 2904	2916	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe	42
PID 2904 wrote to memory of 1064	2904	cmd.exe	44
PID 2904 wrote to memory of 1064	2904	cmd.exe	44
PID 2904 wrote to memory of 1064	2904	cmd.exe	44
PID 2904 wrote to memory of 748	2904	cmd.exe	45
PID 2904 wrote to memory of 748	2904	cmd.exe	45
PID 2904 wrote to memory of 748	2904	cmd.exe	45
PID 748 wrote to memory of 1752	748	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe	49
PID 748 wrote to memory of 1752	748	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe	49
PID 748 wrote to memory of 1752	748	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe	49
PID 1752 wrote to memory of 2384	1752	csrss.exe	50
PID 1752 wrote to memory of 2384	1752	csrss.exe	50
PID 1752 wrote to memory of 2384	1752	csrss.exe	50
PID 1752 wrote to memory of 1904	1752	csrss.exe	51
PID 1752 wrote to memory of 1904	1752	csrss.exe	51
PID 1752 wrote to memory of 1904	1752	csrss.exe	51
PID 2384 wrote to memory of 1804	2384	WScript.exe	52
PID 2384 wrote to memory of 1804	2384	WScript.exe	52
PID 2384 wrote to memory of 1804	2384	WScript.exe	52
PID 1804 wrote to memory of 1448	1804	csrss.exe	53
PID 1804 wrote to memory of 1448	1804	csrss.exe	53
PID 1804 wrote to memory of 1448	1804	csrss.exe	53
PID 1804 wrote to memory of 2816	1804	csrss.exe	54
PID 1804 wrote to memory of 2816	1804	csrss.exe	54
PID 1804 wrote to memory of 2816	1804	csrss.exe	54
PID 1448 wrote to memory of 328	1448	WScript.exe	55
PID 1448 wrote to memory of 328	1448	WScript.exe	55
PID 1448 wrote to memory of 328	1448	WScript.exe	55
PID 328 wrote to memory of 2528	328	csrss.exe	56
PID 328 wrote to memory of 2528	328	csrss.exe	56
PID 328 wrote to memory of 2528	328	csrss.exe	56
PID 328 wrote to memory of 2836	328	csrss.exe	57
PID 328 wrote to memory of 2836	328	csrss.exe	57
PID 328 wrote to memory of 2836	328	csrss.exe	57
PID 2528 wrote to memory of 2084	2528	WScript.exe	58
PID 2528 wrote to memory of 2084	2528	WScript.exe	58
PID 2528 wrote to memory of 2084	2528	WScript.exe	58
PID 2084 wrote to memory of 2648	2084	csrss.exe	59
PID 2084 wrote to memory of 2648	2084	csrss.exe	59
PID 2084 wrote to memory of 2648	2084	csrss.exe	59
PID 2084 wrote to memory of 2584	2084	csrss.exe	60
PID 2084 wrote to memory of 2584	2084	csrss.exe	60
PID 2084 wrote to memory of 2584	2084	csrss.exe	60
PID 2648 wrote to memory of 3008	2648	WScript.exe	61
PID 2648 wrote to memory of 3008	2648	WScript.exe	61
PID 2648 wrote to memory of 3008	2648	WScript.exe	61
PID 3008 wrote to memory of 3016	3008	csrss.exe	62
PID 3008 wrote to memory of 3016	3008	csrss.exe	62
PID 3008 wrote to memory of 3016	3008	csrss.exe	62
PID 3008 wrote to memory of 2100	3008	csrss.exe	63
PID 3008 wrote to memory of 2100	3008	csrss.exe	63
PID 3008 wrote to memory of 2100	3008	csrss.exe	63
PID 3016 wrote to memory of 3012	3016	WScript.exe	64

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
"C:\Users\Admin\AppData\Local\Temp\d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1372
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MUePSOvW3u.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2700
- - C:\Users\Admin\AppData\Local\Temp\d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
    "C:\Users\Admin\AppData\Local\Temp\d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2916
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FtCbY7IXL1.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2904
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:1064
    - - C:\Users\Admin\AppData\Local\Temp\d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf.exe"
        5⤵
        Modifies WinLogon for persistence
        UAC bypass
        Adds Run key to start application
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:748
      - C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
        
        "C:\Users\Admin\AppData\Local\discord\Network\csrss.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1752
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a02d69e9-2dd2-46ab-990b-32c0ccbdea39.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
        
        C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1804
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7f4b2f16-fad8-440a-bf31-90b1956ef673.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
        
        C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:328
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a3618c72-efe7-4b55-bc9b-d339898ba49a.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
        
        C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2084
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b8bed08e-1986-4bed-8c75-457e5c288d60.vbs"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
        
        C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3008
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\36cf938f-41ee-42ec-8ccb-a40c13177be6.vbs"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
        
        C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3012
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6ad98b06-8d99-40cf-a9df-5964d3097e7b.vbs"
        17⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
        
        C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2300
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ec63a8d5-6876-43c4-979a-e52c6b1f9532.vbs"
        19⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
        
        C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
        20⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2432
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\29732dc3-4a79-4823-8127-d7853699bc0d.vbs"
        21⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
        
        C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
        22⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2652
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f3f7a9e1-a9c7-4319-84a1-094cc51c8f68.vbs"
        23⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
        
        C:\Users\Admin\AppData\Local\discord\Network\csrss.exe
        24⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:920
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\36445498-4322-4f68-886b-a9b82700bec0.vbs"
        25⤵
        
        PID:2068
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\443a80dc-d5f9-4010-af17-31b062f5e06a.vbs"
        25⤵
        
        PID:2108
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\120e973e-a335-4e89-9bb5-354a631a1a7a.vbs"
        23⤵
        
        PID:2972
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\697cef0b-30be-41b1-8821-312bcdc0bd36.vbs"
        21⤵
        
        PID:2744
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c7c56039-d6d0-46fe-a823-6f063a8bdb93.vbs"
        19⤵
        
        PID:2052
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\de035586-7472-40b1-ac11-b6c4e16b7d02.vbs"
        17⤵
        
        PID:1532
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c88e5ce3-e7b0-4f74-81bb-47a0baa7be5c.vbs"
        15⤵
        
        PID:2100
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5a194306-6875-4aa9-b912-8eda803d7d38.vbs"
        13⤵
        
        PID:2584
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2f82a70c-4499-4d17-ab10-6c5fdccc24db.vbs"
        11⤵
        
        PID:2836
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8b9fd3cb-b3e3-4855-8328-8d5ad17dad7d.vbs"
        9⤵
        
        PID:2816
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\419b3ff6-f226-40a3-8bd1-f04b6b15953d.vbs"
        7⤵
        
        PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:/Users/Admin/AppData/Local/discord/Network\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:/Users/Admin/AppData/Local/discord/Network\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:/Users/Admin/AppData/Local/discord/Network\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:/Users/Admin/AppData/Local/discord/Network\audiodg.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:/Users/Admin/AppData/Local/discord/Network\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:/Users/Admin/AppData/Local/discord/Network\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:/Users/Admin/AppData/Local/discord/Network\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:/Users/Admin/AppData/Local/discord/Network\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:/Users/Admin/AppData/Local/discord/Network\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\29732dc3-4a79-4823-8127-d7853699bc0d.vbs

Filesize
730B

MD5
99ef4dd85f102c78bb9fdebe3c5e9fc7

SHA1
54453df271906aaf07a52e85f69564d125944bc1

SHA256
311dfe83d4d2d51833f783e4879ee78a3597e3001a0383218433aeef5f99dd42

SHA512
9d6401e954ffc179414635ccce8b1886b4b267efcdaf720639232deb5ca356142d2e374c23bc66b46cf5a05aad6938c8538ea4d521c8bbd55f1778a28ba86c06

Download Submit
C:\Users\Admin\AppData\Local\Temp\36445498-4322-4f68-886b-a9b82700bec0.vbs

Filesize
729B

MD5
01990ddb062c2101f6bd28005c9a031e

SHA1
602aafc7881f4a83d140554298be28694e724b6c

SHA256
9f7a104f2f228aab083e75221a4c180fb7791cdca5f39fff3edeff8cfbacc4a9

SHA512
3c68a23f5f190671592615d8cf9b4ef76c60da7dc793f7618422b9a36919397b2dc0cc71d6f0d9432fd7f47cf0835b8e8c747565cca16d901a419cf2fd6b3115

Download Submit
C:\Users\Admin\AppData\Local\Temp\36cf938f-41ee-42ec-8ccb-a40c13177be6.vbs

Filesize
730B

MD5
5eacdc8f8ddcc5c9f40e5bc0d060005e

SHA1
daa7f4d036727adc42bc9edef0c4e87376962e3a

SHA256
37441580800d22ebedffb233da584c93bcf57a2ee0ba0e24bff3f1e5a0cfaf04

SHA512
72adfede0dd842735f7fc267c6a823c853d7885668998e76d0bf65fc9f01ddd70114e36bec0339be62ecd4b601dff76e799b486154f7809de7a2df813473837f

Download Submit
C:\Users\Admin\AppData\Local\Temp\419b3ff6-f226-40a3-8bd1-f04b6b15953d.vbs

Filesize
506B

MD5
65655bbd0c0d4ebde4c86349df24c7c9

SHA1
226cb4891364ee17d4dd9168bf449845b8271b2b

SHA256
2d9db8d126b327718c74e37ae78bee59d71ce527603658b9a063a7922e119b86

SHA512
07aeb8ca21073e69e48793f397f3c25bc380c197ae67903e71a254ca7a2244f4ff21daf13a99ba3021e8232fa108c9dc5e0b9ee773500415b4b04ca14e35b85f

Download Submit
C:\Users\Admin\AppData\Local\Temp\6ad98b06-8d99-40cf-a9df-5964d3097e7b.vbs

Filesize
730B

MD5
5b1805f915cf68074caa8e6174e5456e

SHA1
ef1bec497222aaeaf8771301a65e5c42c2f05adf

SHA256
8b3e0abc4b599952f3d95374a17ffea65d0b1f08c0ec117863978b25fa0a1235

SHA512
741a9d9d1fcda01c4552e00305821c6cb8e17fde2240503652e520029ba1499c1c8b6df079288fee26e8bfbd3f8119f5fe267073e94a2e95c31c061541e4db30

Download Submit
C:\Users\Admin\AppData\Local\Temp\7f4b2f16-fad8-440a-bf31-90b1956ef673.vbs

Filesize
730B

MD5
a17fa382bf301a6c257da93e06ac697b

SHA1
d48b5581c420b9434fe4c135edbe0bd2a253f056

SHA256
500de54ca0e183c197143d8e306b976a9782cd2e5c32e74759fc50cbd7379059

SHA512
38e4b48cf8acf801f408199c39363bc32ac242945d6fad979582028536fe15fa9cfc0b1330213361245743ba7f7ef2a849dc0765008a0e8bcfab110231fa844c

Download Submit
C:\Users\Admin\AppData\Local\Temp\FtCbY7IXL1.bat

Filesize
267B

MD5
e1857d28645034b7d407ab91cb17be53

SHA1
17e8a30d7d4b7bfb495d8e2ea2749f834db666d2

SHA256
c9a9decc371e0982ddab861d44e9ff1dfa4a7188cc83120679ffb3d47bb635f4

SHA512
bd6795013ef2d159d33550d8b744237738957952987c497fb1052341eeed0c3b0a72fdfda075bacf29d2a3c2891752ceb5e805ffedb3f7e0a25a28d85cb0cba7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MUePSOvW3u.bat

Filesize
267B

MD5
8dcf2bfc064331c733c7caab3875e382

SHA1
cb43754386e1d7487d10975443b8edbc9f348123

SHA256
4964c5bec25d67eb137613505ab7c249b9cef4889c337ef1703a67f06670d223

SHA512
68474c469bb0e26af1d87ebf32b16a98b59e3972bd24aaa32ddd2cfae5865f5604f22e138c4c49d4b959ede823259480d7f6c9db9848e0ed6acf9be3c5cc45c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\a02d69e9-2dd2-46ab-990b-32c0ccbdea39.vbs

Filesize
730B

MD5
8e8f1079de64c09c9b523db1b40a1686

SHA1
8ccd719323f8ae31619c7442f04b751d1c5b7a87

SHA256
4e9573060d51904205f0af363f29a67c751f3ba43b27a4aecd46d99301a7b1bd

SHA512
6f5ff798e4ffd300977bd39b86611aff610dfcffe26941c2dae24309e6e2a97b32101129d3eaf7e6a334e0bb0994a7ce7fe780a0ed4a87ed88ad2fc43ed4bfe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\a3618c72-efe7-4b55-bc9b-d339898ba49a.vbs

Filesize
729B

MD5
58330061e72457a7b47b7a3a8c853e57

SHA1
796a85f250f7475f358d7ff20f7008668cc7a47b

SHA256
ae72d1decbb51fe849ad6f2f6d0ffc90460bd14e1ee43d6053ce84e9fda01903

SHA512
a42d9cb00c015cc939325563eacf3cf8875737ae444bc4db629d227a1ef8e59f51a277ed0ed4ecac02bddde350955008376f3d8cb1f720e60f82cb42fc02d8b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\b8bed08e-1986-4bed-8c75-457e5c288d60.vbs

Filesize
730B

MD5
007c0678a00e4897bf8378c0668b4e67

SHA1
d6ad30dd772d909aa1ee147942d11975f7b49882

SHA256
6718400e55952a5dad23e9373c89efdb2a8d5839c94a99a9750a848a637ad371

SHA512
7c53e1fc74d5ee53e4b299e77f60e437e17d777bca02f9bcafe06425e02fde9a8f1acd05921da268fdc06ba6cb565806c169b5df7a7854daad6f8e1a7718a4a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec63a8d5-6876-43c4-979a-e52c6b1f9532.vbs

Filesize
730B

MD5
4a00bd0a72e51b3f1a5a419ab4d7f6f5

SHA1
d2c9403de095506798195b273e2c3210d5355eeb

SHA256
4170dd1809fb26bdbd5cfa1378b25b6815bf965cda4051247579ca8493c17785

SHA512
fae55516567f5848ddbc2a1e566e47da0872bd01d9062dde1c950d791508d24b0a69ff1bdb74446c15f6bd2843aa84b3798501a537b2e9a36c79b9e5db511a2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\f3f7a9e1-a9c7-4319-84a1-094cc51c8f68.vbs

Filesize
730B

MD5
d1be60430d4c467fd6b44cf74e118681

SHA1
c3d55e93b138c9e9d78ca994e51520b495fbcd1d

SHA256
d034fce4592fcfd1a1e48373d7ad751f2573d39a1e62f5838a4b52f311984c4e

SHA512
d425b372f222c4cd20ed85d508f9c3f8ef05bf8e56f4d2383ca97bb6f9a8429063ff343fa212601e6f7da7e99cdaf18bbde987a6510d0c2fb59db12f3c337f15

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpCFFD8.tmp

Filesize
316B

MD5
293ee0f9c8266172bb412098cf0b5c48

SHA1
3ff88a872809a06c38497b1fa5c3aaf968685eb1

SHA256
5181c89c73cd89064003a07f6f0a7296ca0b87d7cb97c93a208b3531c3e6ae94

SHA512
0c9601315075fda042c8a7ed82381b846e985b6cacb62c59e2f7abaca398f4bd21297dfa61c796d15feecf263b3fe35043cca1ef3c7b06336eae5833d797d546

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpCFFD8.tmp

Filesize
316B

MD5
d81a8a02715c061d54c355f5632f9c64

SHA1
f0f4a6c91aa4a98106d97978c7eb3535cb83dbb5

SHA256
d095fe75c55055504155cd81e658bb7ab5a92e0054c7dfd33f10b69332353532

SHA512
4b4a7cc907a43077fdaac728930c868c615a5cb6d018a8033bfc8c10e08aa88d56d43355d3dcb7a5dfcac841734abceda7bda705352aa29dfba3926003496344

Download Submit
C:\Users\Admin\AppData\Local\discord\Network\csrss.exe

Filesize
2.4MB

MD5
16be4b35fbc59aa471fff4ab77f53c5e

SHA1
5d31d96f0562309fc24294ecfdb3d2a26b238764

SHA256
d9aef85fc0e89a01c741f919fd9740bc71a970777746338d7c689bb69a5b08cf

SHA512
29c902990c748f34c260a08811f1f24956bbc62b7135e58095753ef1f9ad5a094bc560a3dc7aaadb6295eb518b6ad4d645d4775cf11b9a87fd868dc138cf9b45

Download Submit
memory/1372-8-0x0000000002210000-0x000000000221A000-memory.dmp

Filesize
40KB

Download
memory/1372-19-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmp

Filesize
9.9MB

Download
memory/1372-11-0x00000000022C0000-0x00000000022CC000-memory.dmp

Filesize
48KB

Download
memory/1372-10-0x00000000022B0000-0x00000000022B8000-memory.dmp

Filesize
32KB

Download
memory/1372-0-0x000007FEF5DC3000-0x000007FEF5DC4000-memory.dmp

Filesize
4KB

Download
memory/1372-1-0x0000000000A10000-0x0000000000C7E000-memory.dmp

Filesize
2.4MB

Download
memory/1372-9-0x0000000002220000-0x000000000222E000-memory.dmp

Filesize
56KB

Download
memory/1372-2-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmp

Filesize
9.9MB

Download
memory/1372-7-0x0000000000A00000-0x0000000000A12000-memory.dmp

Filesize
72KB

Download
memory/1372-6-0x00000000021A0000-0x00000000021F6000-memory.dmp

Filesize
344KB

Download
memory/1372-5-0x0000000000240000-0x000000000024A000-memory.dmp

Filesize
40KB

Download
memory/1372-4-0x0000000002180000-0x0000000002196000-memory.dmp

Filesize
88KB

Download
memory/1372-3-0x00000000005D0000-0x00000000005EC000-memory.dmp

Filesize
112KB

Download
memory/1752-42-0x0000000000020000-0x000000000028E000-memory.dmp

Filesize
2.4MB

Download
memory/1752-43-0x0000000000750000-0x00000000007A6000-memory.dmp

Filesize
344KB

Download
memory/1804-55-0x00000000007F0000-0x0000000000802000-memory.dmp

Filesize
72KB

Download
memory/1804-54-0x0000000000D10000-0x0000000000F7E000-memory.dmp

Filesize
2.4MB

Download
memory/2084-78-0x0000000000410000-0x0000000000422000-memory.dmp

Filesize
72KB

Download
memory/2432-126-0x0000000000E00000-0x000000000106E000-memory.dmp

Filesize
2.4MB

Download
memory/2432-127-0x00000000005A0000-0x00000000005F6000-memory.dmp

Filesize
344KB

Download
memory/2652-139-0x0000000000F10000-0x000000000117E000-memory.dmp

Filesize
2.4MB

Download
memory/2652-140-0x0000000000320000-0x0000000000332000-memory.dmp

Filesize
72KB

Download
memory/2916-22-0x0000000000470000-0x0000000000482000-memory.dmp

Filesize
72KB

Download
memory/2916-21-0x0000000000A70000-0x0000000000CDE000-memory.dmp

Filesize
2.4MB

Download
memory/3008-90-0x0000000000360000-0x00000000005CE000-memory.dmp

Filesize
2.4MB

Download
memory/3012-103-0x00000000006A0000-0x00000000006B2000-memory.dmp

Filesize
72KB

Download
memory/3012-102-0x0000000000CE0000-0x0000000000F4E000-memory.dmp

Filesize
2.4MB

Download