dcrat | fd5201856b63ee93c1a3e41857e7afce525967b6592c3c52d1848da634eaef3c

General

Target

adc85d83fc17ffe2fcfe34eeab35f0e2_JaffaCakes118.exe
Size

1.4MB
MD5

adc85d83fc17ffe2fcfe34eeab35f0e2
SHA1

a837f2267ed9eee9a981bd8448cbe1282866305b
SHA256

fd5201856b63ee93c1a3e41857e7afce525967b6592c3c52d1848da634eaef3c
SHA512

fa47b6eb1705f522a93a9fb9f19048947b07036e3d0283f88d91bef3a9f600e44e87181d404cd5b812969ab9fe9fd7b6bcb06f1fe650433e58c333ba084ccf58
SSDEEP

24576:U2G/nvxW3Ww0tq0BXRF76zMbvO0opwOb9sVuqfIfdQeFWdOCI9+4D:UbA30vbvOTdJkVKdSMEU

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat 16 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

Processes:

adc85d83fc17ffe2fcfe34eeab35f0e2_JaffaCakes118.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	pid	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		adc85d83fc17ffe2fcfe34eeab35f0e2_JaffaCakes118.exe
		2944	schtasks.exe
		2884	schtasks.exe
		724	schtasks.exe
		2384	schtasks.exe
		4668	schtasks.exe
		4996	schtasks.exe
		3460	schtasks.exe
		1240	schtasks.exe
		3832	schtasks.exe
		3392	schtasks.exe
		3300	schtasks.exe
		116	schtasks.exe
		4404	schtasks.exe
		4792	schtasks.exe
		3420	schtasks.exe

Dcrat family
dcrat

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3300	4944	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	4944	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	116	4944	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3460	4944	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4404	4944	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	4944	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4668	4944	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1240	4944	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	4944	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	724	4944	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4792	4944	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	4944	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3832	4944	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3420	4944	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3392	4944	schtasks.exe	89

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral2/files/0x0007000000023c94-10.dat	dcrat
behavioral2/memory/5064-13-0x0000000000DC0000-0x0000000000EE2000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

adc85d83fc17ffe2fcfe34eeab35f0e2_JaffaCakes118.exeWScript.exefontHostMonitorsavesNet.exefontHostMonitorsavesNet.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	adc85d83fc17ffe2fcfe34eeab35f0e2_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontHostMonitorsavesNet.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontHostMonitorsavesNet.exe

Executes dropped EXE 3 IoCs

Processes:

fontHostMonitorsavesNet.exefontHostMonitorsavesNet.exeRegistry.exe

pid	Process
5064	fontHostMonitorsavesNet.exe
2160	fontHostMonitorsavesNet.exe
1764	Registry.exe

Adds Run key to start application 2 TTPs 15 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

fontHostMonitorsavesNet.exefontHostMonitorsavesNet.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Documents and Settings\\conhost.exe\""	fontHostMonitorsavesNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\ProgramData\\ssh\\SppExtComObj.exe\""	fontHostMonitorsavesNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\System32\\wbem\\netnccim\\WmiPrvSE.exe\""	fontHostMonitorsavesNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\Public\\Desktop\\Registry.exe\""	fontHostMonitorsavesNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Windows\\system\\sysmon.exe\""	fontHostMonitorsavesNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\Public\\Pictures\\Registry.exe\""	fontHostMonitorsavesNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Windows\\DtcInstall\\sysmon.exe\""	fontHostMonitorsavesNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\altspace\\RuntimeBroker.exe\""	fontHostMonitorsavesNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Windows\\SystemApps\\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\InputApp\\InputApp\\TextInputHost.exe\""	fontHostMonitorsavesNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\RuntimeBroker.exe\""	fontHostMonitorsavesNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Windows\\System32\\KBDBUG\\conhost.exe\""	fontHostMonitorsavesNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Recovery\\WindowsRE\\Registry.exe\""	fontHostMonitorsavesNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Windows\\System32\\JavaScriptCollectionAgent\\conhost.exe\""	fontHostMonitorsavesNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Windows\\SystemApps\\Microsoft.Windows.Search_cw5n1h2txyewy\\AppxManifest\\SearchApp.exe\""	fontHostMonitorsavesNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\System32\\wbem\\fdWNet\\unsecapp.exe\""	fontHostMonitorsavesNet.exe

Drops file in System32 directory 10 IoCs

Processes:

fontHostMonitorsavesNet.exefontHostMonitorsavesNet.exe

description	ioc	Process
File created	C:\Windows\System32\altspace\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	fontHostMonitorsavesNet.exe
File created	C:\Windows\System32\JavaScriptCollectionAgent\conhost.exe	fontHostMonitorsavesNet.exe
File created	C:\Windows\System32\JavaScriptCollectionAgent\088424020bedd6b28ac7fd22ee35dcd7322895ce	fontHostMonitorsavesNet.exe
File created	C:\Windows\System32\wbem\fdWNet\29c1c3cc0f76855c7e7456076a4ffc27e4947119	fontHostMonitorsavesNet.exe
File created	C:\Windows\System32\wbem\netnccim\WmiPrvSE.exe	fontHostMonitorsavesNet.exe
File created	C:\Windows\System32\altspace\RuntimeBroker.exe	fontHostMonitorsavesNet.exe
File created	C:\Windows\System32\KBDBUG\conhost.exe	fontHostMonitorsavesNet.exe
File created	C:\Windows\System32\KBDBUG\088424020bedd6b28ac7fd22ee35dcd7322895ce	fontHostMonitorsavesNet.exe
File created	C:\Windows\System32\wbem\fdWNet\unsecapp.exe	fontHostMonitorsavesNet.exe
File created	C:\Windows\System32\wbem\netnccim\24dbde2999530ef5fd907494bc374d663924116c	fontHostMonitorsavesNet.exe

Drops file in Program Files directory 2 IoCs

Processes:

fontHostMonitorsavesNet.exe

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe	fontHostMonitorsavesNet.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	fontHostMonitorsavesNet.exe

Drops file in Windows directory 11 IoCs

Processes:

fontHostMonitorsavesNet.exefontHostMonitorsavesNet.exe

description	ioc	Process
File created	C:\Windows\system\sysmon.exe	fontHostMonitorsavesNet.exe
File created	C:\Windows\system\121e5b5079f7c0e46d90f99b3864022518bbbda9	fontHostMonitorsavesNet.exe
File created	C:\Windows\DtcInstall\sysmon.exe	fontHostMonitorsavesNet.exe
File created	C:\Windows\DtcInstall\121e5b5079f7c0e46d90f99b3864022518bbbda9	fontHostMonitorsavesNet.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\AppxManifest\SearchApp.exe	fontHostMonitorsavesNet.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\AppxManifest\38384e6a620884a6b69bcc56f80d556f9200171c	fontHostMonitorsavesNet.exe
File created	C:\Windows\LanguageOverlayCache\spoolsv.exe	fontHostMonitorsavesNet.exe
File opened for modification	C:\Windows\system\sysmon.exe	fontHostMonitorsavesNet.exe
File created	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\TextInputHost.exe	fontHostMonitorsavesNet.exe
File created	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\22eafd247d37c30fed3795ee41d259ec72bb351c	fontHostMonitorsavesNet.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\AppxManifest\SearchApp.exe	fontHostMonitorsavesNet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

adc85d83fc17ffe2fcfe34eeab35f0e2_JaffaCakes118.exeWScript.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adc85d83fc17ffe2fcfe34eeab35f0e2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

Processes:

adc85d83fc17ffe2fcfe34eeab35f0e2_JaffaCakes118.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	adc85d83fc17ffe2fcfe34eeab35f0e2_JaffaCakes118.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	Process
3300	schtasks.exe
116	schtasks.exe
1240	schtasks.exe
2384	schtasks.exe
3420	schtasks.exe
3392	schtasks.exe
3460	schtasks.exe
2944	schtasks.exe
724	schtasks.exe
4792	schtasks.exe
4996	schtasks.exe
4404	schtasks.exe
4668	schtasks.exe
2884	schtasks.exe
3832	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

fontHostMonitorsavesNet.exefontHostMonitorsavesNet.exeRegistry.exe

pid	Process
5064	fontHostMonitorsavesNet.exe
5064	fontHostMonitorsavesNet.exe
5064	fontHostMonitorsavesNet.exe
2160	fontHostMonitorsavesNet.exe
2160	fontHostMonitorsavesNet.exe
2160	fontHostMonitorsavesNet.exe
1764	Registry.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

fontHostMonitorsavesNet.exefontHostMonitorsavesNet.exeRegistry.exe

description	pid	Process
Token: SeDebugPrivilege	5064	fontHostMonitorsavesNet.exe
Token: SeDebugPrivilege	2160	fontHostMonitorsavesNet.exe
Token: SeDebugPrivilege	1764	Registry.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

adc85d83fc17ffe2fcfe34eeab35f0e2_JaffaCakes118.exeWScript.execmd.exefontHostMonitorsavesNet.exefontHostMonitorsavesNet.exe

description	pid	Process	procid_target
PID 5032 wrote to memory of 4744	5032	adc85d83fc17ffe2fcfe34eeab35f0e2_JaffaCakes118.exe	82
PID 5032 wrote to memory of 4744	5032	adc85d83fc17ffe2fcfe34eeab35f0e2_JaffaCakes118.exe	82
PID 5032 wrote to memory of 4744	5032	adc85d83fc17ffe2fcfe34eeab35f0e2_JaffaCakes118.exe	82
PID 4744 wrote to memory of 3872	4744	WScript.exe	85
PID 4744 wrote to memory of 3872	4744	WScript.exe	85
PID 4744 wrote to memory of 3872	4744	WScript.exe	85
PID 3872 wrote to memory of 5064	3872	cmd.exe	87
PID 3872 wrote to memory of 5064	3872	cmd.exe	87
PID 5064 wrote to memory of 2160	5064	fontHostMonitorsavesNet.exe	98
PID 5064 wrote to memory of 2160	5064	fontHostMonitorsavesNet.exe	98
PID 2160 wrote to memory of 1764	2160	fontHostMonitorsavesNet.exe	106
PID 2160 wrote to memory of 1764	2160	fontHostMonitorsavesNet.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\adc85d83fc17ffe2fcfe34eeab35f0e2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\adc85d83fc17ffe2fcfe34eeab35f0e2_JaffaCakes118.exe"
1⤵
- DcRat
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\fontHostMonitor\feh0ZxyV3e7FSf6.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\fontHostMonitor\PwA1zMnsPP.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3872
  - - C:\fontHostMonitor\fontHostMonitorsavesNet.exe
      "C:\fontHostMonitor\fontHostMonitorsavesNet.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5064
    - - C:\fontHostMonitor\fontHostMonitorsavesNet.exe
        
        "C:\fontHostMonitor\fontHostMonitorsavesNet.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2160
      - C:\Users\Public\Desktop\Registry.exe
        
        "C:\Users\Public\Desktop\Registry.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\system\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Public\Pictures\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\altspace\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\DtcInstall\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\System32\JavaScriptCollectionAgent\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\System32\KBDBUG\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\AppxManifest\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Documents and Settings\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\ProgramData\ssh\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\System32\wbem\fdWNet\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\netnccim\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Public\Desktop\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fontHostMonitorsavesNet.exe.log

Filesize
1KB

MD5
b7c0c43fc7804baaa7dc87152cdc9554

SHA1
1bab62bd56af745678d4e967d91e1ccfdeed4038

SHA256
46386a61f3aaf1b1c2e6efc9fc7e9e9ff16cd13ae58b8d856835771fedb6d457

SHA512
9fda3dd00a3406137e0113f13f78e77b20a76512b35820d38df696842cbbf2e2ebabfb99a3846c9637ecb54af858ec1551521187e379872973006426a253f769

Download Submit
C:\fontHostMonitor\PwA1zMnsPP.bat

Filesize
48B

MD5
1e53948fece6a759613e4d182f426d0f

SHA1
06f4f4212d4ac1cb3a585c6418495729530d75a2

SHA256
c449acadd920fc97bf366241ada89791300f99831a7aa6c6fde64a1e800df800

SHA512
b029e6799d936a565fc29d7e8823d1ac3bbbc873d5b8acdda21a234ba6d65496385ff43908e53f3b85fc3bcff86763d851f5dd03c25e289b706b961cecbede4d

Download Submit
C:\fontHostMonitor\feh0ZxyV3e7FSf6.vbe

Filesize
202B

MD5
cb9171302c0cd9e551de72646e89916c

SHA1
112a62c9231c1982a08923df5452ff037e46430f

SHA256
fe4ae655cd3e1dca1f54e20fc49ba01bce5a78f13400bc45700cd958e8a33dfe

SHA512
5d65b239fa3ee81c30e19df1cdeb72842688d23c254700b2cc86a87ffaf6a00e6aaf44096ade937313272c5105d0bcc29107977c690b4523f66436a61b94222e

Download Submit
C:\fontHostMonitor\fontHostMonitorsavesNet.exe

Filesize
1.1MB

MD5
a627f57bf0890b35f70f02ab54e868f7

SHA1
6d1f2e59fbd98b3ae808026e9ca4b00fe70b4ee8

SHA256
a95ee29f75af413547275c267c54ca69fff71ca46f0107cd9485914d070e6a98

SHA512
e33cbfcc864157b8f99bd44482be58a0dd94c612400409c0c1a3b324c51eaf3b6fed85eda30758a7505b57d544dd59b4ad3f196459ca8609451fddf88c392b97

Download Submit
memory/5064-12-0x00007FF8CDEF3000-0x00007FF8CDEF5000-memory.dmp

Filesize
8KB

Download
memory/5064-13-0x0000000000DC0000-0x0000000000EE2000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads