Overview

overview

10

Static

static

10

E96B9E17DA...4F.exe

windows7-x64

10

E96B9E17DA...4F.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/11/2024, 07:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    E96B9E17DA08C5A64C26DC666402C64F.exe
  • Size 1.2MB
  • Sample241130-je8s3ssphp
  • SHA256 8e7147a2aaffb6632052f190dad38b7d945ae42f1c4e21307f6d9079afb76372
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
dcratevasioninfostealerpersistencerattrojan

Malware Config

Signatures

  • DcRat 10 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 3 IoCs
    persistence
  • Process spawned unexpected child process 9 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 60 IoCs
    evasiontrojan
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Checks computer location settings 2 TTPs 20 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 40 IoCs
    evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 18 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 60 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\E96B9E17DA08C5A64C26DC666402C64F.exe
    "C:\Users\Admin\AppData\Local\Temp\E96B9E17DA08C5A64C26DC666402C64F.exe"
    1⤵
    • DcRat
    • Modifies WinLogon for persistence
    • UAC bypass
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1100
    • C:\Users\Admin\AppData\Local\Temp\E96B9E17DA08C5A64C26DC666402C64F.exe
      "C:\Users\Admin\AppData\Local\Temp\E96B9E17DA08C5A64C26DC666402C64F.exe"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Checks computer location settings
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3500
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jqxyI9486y.bat"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3540
        • C:\Windows\system32\w32tm.exe
          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
          4⤵
            PID:3076
          • C:\Users\Admin\AppData\Local\Temp\E96B9E17DA08C5A64C26DC666402C64F.exe
            "C:\Users\Admin\AppData\Local\Temp\E96B9E17DA08C5A64C26DC666402C64F.exe"
            4⤵
            • Modifies WinLogon for persistence
            • UAC bypass
            • Checks computer location settings
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1852
            • C:\Users\Admin\AppData\Local\dllhost.exe
              "C:\Users\Admin\AppData\Local\dllhost.exe"
              5⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:2992
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\800bb628-18ae-4320-9b2e-15120af81642.vbs"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:3192
                • C:\Users\Admin\AppData\Local\dllhost.exe
                  C:\Users\Admin\AppData\Local\dllhost.exe
                  7⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:3212
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f3f5beb7-be4f-495e-b3ec-8f05f61bfb89.vbs"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:5076
                    • C:\Users\Admin\AppData\Local\dllhost.exe
                      C:\Users\Admin\AppData\Local\dllhost.exe
                      9⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:4768
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bd532337-abb7-47fc-ac3b-7bf15a0fe920.vbs"
                        10⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2372
                        • C:\Users\Admin\AppData\Local\dllhost.exe
                          C:\Users\Admin\AppData\Local\dllhost.exe
                          11⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:464
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5de541e6-15d5-4f70-b6ae-7aaa78d6c000.vbs"
                            12⤵
                            • Suspicious use of WriteProcessMemory
                            PID:5012
                            • C:\Users\Admin\AppData\Local\dllhost.exe
                              C:\Users\Admin\AppData\Local\dllhost.exe
                              13⤵
                              • UAC bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:2396
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\593bfa11-5079-45d4-86d9-506f0837524d.vbs"
                                14⤵
                                • Suspicious use of WriteProcessMemory
                                PID:2412
                                • C:\Users\Admin\AppData\Local\dllhost.exe
                                  C:\Users\Admin\AppData\Local\dllhost.exe
                                  15⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  • System policy modification
                                  PID:4292
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b5d01f63-d47e-4556-a19c-41ac37faa168.vbs"
                                    16⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:3644
                                    • C:\Users\Admin\AppData\Local\dllhost.exe
                                      C:\Users\Admin\AppData\Local\dllhost.exe
                                      17⤵
                                      • UAC bypass
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      • System policy modification
                                      PID:3684
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bfbfdc74-77a2-4fca-b9f0-42991cc8dc49.vbs"
                                        18⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:3212
                                        • C:\Users\Admin\AppData\Local\dllhost.exe
                                          C:\Users\Admin\AppData\Local\dllhost.exe
                                          19⤵
                                          • UAC bypass
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Checks whether UAC is enabled
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          • System policy modification
                                          PID:4824
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\883d5947-390a-4de7-98d4-f35190e79b5c.vbs"
                                            20⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:4768
                                            • C:\Users\Admin\AppData\Local\dllhost.exe
                                              C:\Users\Admin\AppData\Local\dllhost.exe
                                              21⤵
                                              • UAC bypass
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              • System policy modification
                                              PID:2548
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\afc0a5a4-dca6-48ee-a0bb-63d6dafd8798.vbs"
                                                22⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:4092
                                                • C:\Users\Admin\AppData\Local\dllhost.exe
                                                  C:\Users\Admin\AppData\Local\dllhost.exe
                                                  23⤵
                                                  • UAC bypass
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Checks whether UAC is enabled
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • System policy modification
                                                  PID:2880
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\47cbafe0-1c77-4e63-86ee-86d76b2525fa.vbs"
                                                    24⤵
                                                      PID:1076
                                                      • C:\Users\Admin\AppData\Local\dllhost.exe
                                                        C:\Users\Admin\AppData\Local\dllhost.exe
                                                        25⤵
                                                        • UAC bypass
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Checks whether UAC is enabled
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • System policy modification
                                                        PID:3680
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0100fab0-1065-4394-948e-c4c417db20ae.vbs"
                                                          26⤵
                                                            PID:2324
                                                            • C:\Users\Admin\AppData\Local\dllhost.exe
                                                              C:\Users\Admin\AppData\Local\dllhost.exe
                                                              27⤵
                                                              • UAC bypass
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Checks whether UAC is enabled
                                                              • Modifies registry class
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • System policy modification
                                                              PID:3644
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a4b9b5cc-b35b-4635-b199-1448993f2213.vbs"
                                                                28⤵
                                                                  PID:4372
                                                                  • C:\Users\Admin\AppData\Local\dllhost.exe
                                                                    C:\Users\Admin\AppData\Local\dllhost.exe
                                                                    29⤵
                                                                    • UAC bypass
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Checks whether UAC is enabled
                                                                    • Modifies registry class
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    • System policy modification
                                                                    PID:1996
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\51730467-7b41-40a8-9723-bd7e899e47b9.vbs"
                                                                      30⤵
                                                                        PID:2012
                                                                        • C:\Users\Admin\AppData\Local\dllhost.exe
                                                                          C:\Users\Admin\AppData\Local\dllhost.exe
                                                                          31⤵
                                                                          • UAC bypass
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • Checks whether UAC is enabled
                                                                          • Modifies registry class
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          • System policy modification
                                                                          PID:696
                                                                          • C:\Windows\System32\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6b2df84d-2101-4baa-a9ed-08c7f25c0e49.vbs"
                                                                            32⤵
                                                                              PID:1676
                                                                              • C:\Users\Admin\AppData\Local\dllhost.exe
                                                                                C:\Users\Admin\AppData\Local\dllhost.exe
                                                                                33⤵
                                                                                • UAC bypass
                                                                                • Checks computer location settings
                                                                                • Executes dropped EXE
                                                                                • Checks whether UAC is enabled
                                                                                • Modifies registry class
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                • System policy modification
                                                                                PID:5012
                                                                                • C:\Windows\System32\WScript.exe
                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\677396ad-9b0a-478b-a630-850542c14200.vbs"
                                                                                  34⤵
                                                                                    PID:2232
                                                                                    • C:\Users\Admin\AppData\Local\dllhost.exe
                                                                                      C:\Users\Admin\AppData\Local\dllhost.exe
                                                                                      35⤵
                                                                                      • UAC bypass
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Checks whether UAC is enabled
                                                                                      • Modifies registry class
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • System policy modification
                                                                                      PID:1124
                                                                                      • C:\Windows\System32\WScript.exe
                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e7718537-4eb9-4c35-8624-4fd888f17529.vbs"
                                                                                        36⤵
                                                                                          PID:4124
                                                                                          • C:\Users\Admin\AppData\Local\dllhost.exe
                                                                                            C:\Users\Admin\AppData\Local\dllhost.exe
                                                                                            37⤵
                                                                                            • UAC bypass
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • Checks whether UAC is enabled
                                                                                            • Modifies registry class
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • System policy modification
                                                                                            PID:4116
                                                                                            • C:\Windows\System32\WScript.exe
                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1557aa14-fd0f-4848-a670-d58044122f40.vbs"
                                                                                              38⤵
                                                                                                PID:3500
                                                                                              • C:\Windows\System32\WScript.exe
                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e91027d1-7443-4b05-a0c0-47c130bf1ee6.vbs"
                                                                                                38⤵
                                                                                                  PID:3216
                                                                                            • C:\Windows\System32\WScript.exe
                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8133b2cc-dc96-47b2-ae94-00e66b1d2af8.vbs"
                                                                                              36⤵
                                                                                                PID:2400
                                                                                          • C:\Windows\System32\WScript.exe
                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5f35c771-dc4f-43f5-b5b1-9faad877d39f.vbs"
                                                                                            34⤵
                                                                                              PID:4980
                                                                                        • C:\Windows\System32\WScript.exe
                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ca928d47-7728-45ba-bd38-a220f779ca85.vbs"
                                                                                          32⤵
                                                                                            PID:2136
                                                                                      • C:\Windows\System32\WScript.exe
                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3e49ee1a-0e9f-4318-b573-f2c3ea29a783.vbs"
                                                                                        30⤵
                                                                                          PID:2568
                                                                                    • C:\Windows\System32\WScript.exe
                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bf0d059b-1c4e-49b3-91fd-71d0e211f772.vbs"
                                                                                      28⤵
                                                                                        PID:640
                                                                                  • C:\Windows\System32\WScript.exe
                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\30706cc3-32a9-4f0b-ab84-93e39b81a1be.vbs"
                                                                                    26⤵
                                                                                      PID:4060
                                                                                • C:\Windows\System32\WScript.exe
                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\da9121ba-2b85-440d-b901-60f0a93654b5.vbs"
                                                                                  24⤵
                                                                                    PID:2316
                                                                              • C:\Windows\System32\WScript.exe
                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7ad5c456-9357-405d-b1eb-e3a115a3b2af.vbs"
                                                                                22⤵
                                                                                  PID:2188
                                                                            • C:\Windows\System32\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cad14b59-c840-49bc-8a32-14403cd0325b.vbs"
                                                                              20⤵
                                                                                PID:3252
                                                                          • C:\Windows\System32\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a8e5c31c-041e-4707-bd5e-eff20d75d5a0.vbs"
                                                                            18⤵
                                                                              PID:3632
                                                                        • C:\Windows\System32\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5b633e10-fc42-4d5d-bba6-f506c76f94ac.vbs"
                                                                          16⤵
                                                                            PID:1588
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\be6544c5-17b7-4d87-89ab-4b27bedf011f.vbs"
                                                                        14⤵
                                                                          PID:4504
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e88a76af-808a-4612-840e-0b2a4a9f198d.vbs"
                                                                      12⤵
                                                                        PID:720
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7ce43fd3-625f-40b3-8e93-45c9b1189e86.vbs"
                                                                    10⤵
                                                                      PID:4696
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3c294dd9-abc6-4b6f-bdc7-929d3a8a7565.vbs"
                                                                  8⤵
                                                                    PID:3092
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\04af0e32-dadb-40f1-985a-9b08fe9551f3.vbs"
                                                                6⤵
                                                                  PID:3596
                                                      • C:\Windows\system32\schtasks.exe
                                                        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:/Users/Admin/AppData/Local/\dllhost.exe'" /f
                                                        1⤵
                                                        • DcRat
                                                        • Process spawned unexpected child process
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:2336
                                                      • C:\Windows\system32\schtasks.exe
                                                        schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:/Users/Admin/AppData/Local/\dllhost.exe'" /rl HIGHEST /f
                                                        1⤵
                                                        • DcRat
                                                        • Process spawned unexpected child process
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:1264
                                                      • C:\Windows\system32\schtasks.exe
                                                        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:/Users/Admin/AppData/Local/\dllhost.exe'" /rl HIGHEST /f
                                                        1⤵
                                                        • DcRat
                                                        • Process spawned unexpected child process
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:212
                                                      • C:\Windows\system32\schtasks.exe
                                                        schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:/Users/Admin/AppData/Local/\upfc.exe'" /f
                                                        1⤵
                                                        • DcRat
                                                        • Process spawned unexpected child process
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:3772
                                                      • C:\Windows\system32\schtasks.exe
                                                        schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:/Users/Admin/AppData/Local/\upfc.exe'" /rl HIGHEST /f
                                                        1⤵
                                                        • DcRat
                                                        • Process spawned unexpected child process
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:4352
                                                      • C:\Windows\system32\schtasks.exe
                                                        schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:/Users/Admin/AppData/Local/\upfc.exe'" /rl HIGHEST /f
                                                        1⤵
                                                        • DcRat
                                                        • Process spawned unexpected child process
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:3756
                                                      • C:\Windows\system32\schtasks.exe
                                                        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:/Users/Admin/AppData/Local/\dllhost.exe'" /f
                                                        1⤵
                                                        • DcRat
                                                        • Process spawned unexpected child process
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:3436
                                                      • C:\Windows\system32\schtasks.exe
                                                        schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:/Users/Admin/AppData/Local/\dllhost.exe'" /rl HIGHEST /f
                                                        1⤵
                                                        • DcRat
                                                        • Process spawned unexpected child process
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:3532
                                                      • C:\Windows\system32\schtasks.exe
                                                        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:/Users/Admin/AppData/Local/\dllhost.exe'" /rl HIGHEST /f
                                                        1⤵
                                                        • DcRat
                                                        • Process spawned unexpected child process
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:1544

                                                      Network

                                                            MITRE ATT&CK Enterprise v15

                                                            Reconnaissance

                                                            Resource Development

                                                            Initial Access

                                                            Execution

                                                            Scheduled Task/Job

                                                            1
                                                            T1053

                                                            Scheduled Task

                                                            1
                                                            T1053.005

                                                            Persistence

                                                            Boot or Logon Autostart Execution

                                                            2
                                                            T1547

                                                            Registry Run Keys / Startup Folder

                                                            1
                                                            T1547.001

                                                            Winlogon Helper DLL

                                                            1
                                                            T1547.004

                                                            Scheduled Task/Job

                                                            1
                                                            T1053

                                                            Scheduled Task

                                                            1
                                                            T1053.005

                                                            Privilege Escalation

                                                            Abuse Elevation Control Mechanism

                                                            1
                                                            T1548

                                                            Bypass User Account Control

                                                            1
                                                            T1548.002

                                                            Boot or Logon Autostart Execution

                                                            2
                                                            T1547

                                                            Registry Run Keys / Startup Folder

                                                            1
                                                            T1547.001

                                                            Winlogon Helper DLL

                                                            1
                                                            T1547.004

                                                            Scheduled Task/Job

                                                            1
                                                            T1053

                                                            Scheduled Task

                                                            1
                                                            T1053.005

                                                            Defense Evasion

                                                            Abuse Elevation Control Mechanism

                                                            1
                                                            T1548

                                                            Bypass User Account Control

                                                            1
                                                            T1548.002

                                                            Impair Defenses

                                                            1
                                                            T1562

                                                            Disable or Modify Tools

                                                            1
                                                            T1562.001

                                                            Modify Registry

                                                            4
                                                            T1112

                                                            Credential Access

                                                            Discovery

                                                            Query Registry

                                                            2
                                                            T1012

                                                            System Information Discovery

                                                            3
                                                            T1082

                                                            Lateral Movement

                                                            Collection

                                                            Command and Control

                                                            Exfiltration

                                                            Impact

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            5940a34987c991
                                                            • Path C:\Users\Admin\AppData\Local\5940a34987c991
                                                            • Size 408B
                                                            • SHA256 f6a6ac4bd6d58834967033a2d3fb4e8aeed6f9d1454913ef45023aad9e7e74a5
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            E96B9E17DA08C5A64C26DC666402C64F.exe.log
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\E96B9E17DA08C5A64C26DC666402C64F.exe.log
                                                            • Size 1KB
                                                            • SHA256 29f5645ac14353ac460858f52c856548f3aeb144b09eef672a6b4849bafe742e
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            dllhost.exe.log
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log
                                                            • Size 1KB
                                                            • SHA256 27525f5fc7871c6828ab5173315e95b5c7e918d2ee532781c562c378584b5249
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            0100fab0-1065-4394-948e-c4c417db20ae.vbs
                                                            • Path C:\Users\Admin\AppData\Local\Temp\0100fab0-1065-4394-948e-c4c417db20ae.vbs
                                                            • Size 716B
                                                            • SHA256 f52fdfe2267c284000d23b5b51372343df996fbdb4624965c2654f8ab3d4ef03
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            04af0e32-dadb-40f1-985a-9b08fe9551f3.vbs
                                                            • Path C:\Users\Admin\AppData\Local\Temp\04af0e32-dadb-40f1-985a-9b08fe9551f3.vbs
                                                            • Size 492B
                                                            • SHA256 9f552476fe37ebe1038391e07aef92b7327c4ea10de4d78130df693fdc6c2bcc
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            47cbafe0-1c77-4e63-86ee-86d76b2525fa.vbs
                                                            • Path C:\Users\Admin\AppData\Local\Temp\47cbafe0-1c77-4e63-86ee-86d76b2525fa.vbs
                                                            • Size 716B
                                                            • SHA256 a3c070f03cd707c3efde01f7e2af34af5817a41caabe731036a6c3a5aec7c80f
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            51730467-7b41-40a8-9723-bd7e899e47b9.vbs
                                                            • Path C:\Users\Admin\AppData\Local\Temp\51730467-7b41-40a8-9723-bd7e899e47b9.vbs
                                                            • Size 716B
                                                            • SHA256 1efad5470dad6e70420a747f2dcf015167aa465131bbb650d06dcf8741d0a4b3
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            593bfa11-5079-45d4-86d9-506f0837524d.vbs
                                                            • Path C:\Users\Admin\AppData\Local\Temp\593bfa11-5079-45d4-86d9-506f0837524d.vbs
                                                            • Size 716B
                                                            • SHA256 8bc0a403a41c4371ef88212bbdf262fff350a3298409bd592402a222c61ae93a
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            5de541e6-15d5-4f70-b6ae-7aaa78d6c000.vbs
                                                            • Path C:\Users\Admin\AppData\Local\Temp\5de541e6-15d5-4f70-b6ae-7aaa78d6c000.vbs
                                                            • Size 715B
                                                            • SHA256 25c657a809e3c064f64dc2c178752783cd23803d2a9bb5c151156418a2bf8739
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            6b2df84d-2101-4baa-a9ed-08c7f25c0e49.vbs
                                                            • Path C:\Users\Admin\AppData\Local\Temp\6b2df84d-2101-4baa-a9ed-08c7f25c0e49.vbs
                                                            • Size 715B
                                                            • SHA256 038c448f98171728c6700911224719cf0794bd607647cd50ad04404e73d2c9f8
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            800bb628-18ae-4320-9b2e-15120af81642.vbs
                                                            • Path C:\Users\Admin\AppData\Local\Temp\800bb628-18ae-4320-9b2e-15120af81642.vbs
                                                            • Size 716B
                                                            • SHA256 50c727d4ed6787bfe21e6fa2a04f41eaa17cb2ad50400efa70973740870e40f1
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            883d5947-390a-4de7-98d4-f35190e79b5c.vbs
                                                            • Path C:\Users\Admin\AppData\Local\Temp\883d5947-390a-4de7-98d4-f35190e79b5c.vbs
                                                            • Size 716B
                                                            • SHA256 6d46927d69c113ad6d9d5fd5d31be582fc0ae5d1bc6722d659efda760e31e704
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            a4b9b5cc-b35b-4635-b199-1448993f2213.vbs
                                                            • Path C:\Users\Admin\AppData\Local\Temp\a4b9b5cc-b35b-4635-b199-1448993f2213.vbs
                                                            • Size 716B
                                                            • SHA256 8c72ba6c875ab07f15cb449aca0f66e1324e75b5f00379d7e4b0ef93669e7f5b
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            afc0a5a4-dca6-48ee-a0bb-63d6dafd8798.vbs
                                                            • Path C:\Users\Admin\AppData\Local\Temp\afc0a5a4-dca6-48ee-a0bb-63d6dafd8798.vbs
                                                            • Size 716B
                                                            • SHA256 b3c70f485bf7e4c5e929fe5dc3a876958674272861a77e34531d339680e12a48
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            b5d01f63-d47e-4556-a19c-41ac37faa168.vbs
                                                            • Path C:\Users\Admin\AppData\Local\Temp\b5d01f63-d47e-4556-a19c-41ac37faa168.vbs
                                                            • Size 716B
                                                            • SHA256 7615a6348d4af12642674f2a2b4fd1ab035a8412c5ba0b525f673364b822d342
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            bd532337-abb7-47fc-ac3b-7bf15a0fe920.vbs
                                                            • Path C:\Users\Admin\AppData\Local\Temp\bd532337-abb7-47fc-ac3b-7bf15a0fe920.vbs
                                                            • Size 716B
                                                            • SHA256 6b26b0525d4368566bd2a817dffbc9ae4f2445a0432a2a9afddfac2fd587972f
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            bfbfdc74-77a2-4fca-b9f0-42991cc8dc49.vbs
                                                            • Path C:\Users\Admin\AppData\Local\Temp\bfbfdc74-77a2-4fca-b9f0-42991cc8dc49.vbs
                                                            • Size 716B
                                                            • SHA256 499819caa4422bc613afee5d7f3e1b212380f81d65cc043cf34c4a04f0013ab7
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            f3f5beb7-be4f-495e-b3ec-8f05f61bfb89.vbs
                                                            • Path C:\Users\Admin\AppData\Local\Temp\f3f5beb7-be4f-495e-b3ec-8f05f61bfb89.vbs
                                                            • Size 716B
                                                            • SHA256 55c47f140f8f09212b6c07c1258f40e4900fb0aeae04f3b1727d312fa9f33fa2
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            jqxyI9486y.bat
                                                            • Path C:\Users\Admin\AppData\Local\Temp\jqxyI9486y.bat
                                                            • Size 235B
                                                            • SHA256 7f0690ca84f55195ef8eb847bf815d7bea8a9b4a64f3b788dc361b4b264efd5b
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            tmpB083E.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Temp\tmpB083E.tmp
                                                            • Size 252B
                                                            • SHA256 00165eb5ce16f74ae3192ba9f963d4ea778c1e9fc9ba8c2c1b90f7528a4dc70b
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            tmpB083E.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Temp\tmpB083E.tmp
                                                            • Size 256B
                                                            • SHA256 ad667a681914a44c7b3c372f6a23a5974331ed5919bfd9dc0cc3aa53676e1f17
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            dllhost.exe
                                                            • Path C:\Users\Admin\AppData\Local\dllhost.exe
                                                            • Size 1.2MB
                                                            • SHA256 8e7147a2aaffb6632052f190dad38b7d945ae42f1c4e21307f6d9079afb76372
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            memory/1100-0-0x00007FFA102C3000-0x00007FFA102C5000-memory.dmp
                                                            Download

                                                            memory/1100-14-0x00007FFA102C0000-0x00007FFA10D81000-memory.dmp
                                                            Download

                                                            memory/1100-7-0x0000000002DA0000-0x0000000002DAA000-memory.dmp
                                                            Download

                                                            memory/1100-8-0x000000001B8A0000-0x000000001B8AC000-memory.dmp
                                                            Download

                                                            memory/1100-5-0x0000000002D70000-0x0000000002D86000-memory.dmp
                                                            Download

                                                            memory/1100-6-0x0000000002D90000-0x0000000002D9A000-memory.dmp
                                                            Download

                                                            memory/1100-4-0x000000001BF80000-0x000000001BFD0000-memory.dmp
                                                            Download

                                                            memory/1100-3-0x0000000002D50000-0x0000000002D6C000-memory.dmp
                                                            Download

                                                            memory/1100-2-0x00007FFA102C0000-0x00007FFA10D81000-memory.dmp
                                                            Download

                                                            memory/1100-1-0x0000000000B00000-0x0000000000C44000-memory.dmp
                                                            Download