Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-12-2024 02:44

General

  • Target

    8e7147a2aaffb6632052f190dad38b7d945ae42f1c4e21307f6d9079afb76372.exe

  • Size

    1.2MB

  • MD5

    e96b9e17da08c5a64c26dc666402c64f

  • SHA1

    cceec5c7f6f4bbf08c63153a0dea8b5834ed38ee

  • SHA256

    8e7147a2aaffb6632052f190dad38b7d945ae42f1c4e21307f6d9079afb76372

  • SHA512

    dd71101f1b6b0dcd545bec2e448c6368a8653b599a5b0de3287ac50126b0c380a325e92fa201bdd869d97cf18e63d0795879923e9364abb92adfc57af02d5040

  • SSDEEP

    24576:QGZn/lA+WQi7Tw3d3pI0eqZb/bte1aMiL/8LLKwi/TIRk:QGzAy1Sob6CsL8

Malware Config

Signatures

  • DcRat 7 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Process spawned unexpected child process 6 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 57 IoCs
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Checks computer location settings 2 TTPs 19 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 38 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 19 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 57 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e7147a2aaffb6632052f190dad38b7d945ae42f1c4e21307f6d9079afb76372.exe
    "C:\Users\Admin\AppData\Local\Temp\8e7147a2aaffb6632052f190dad38b7d945ae42f1c4e21307f6d9079afb76372.exe"
    1⤵
    • DcRat
    • Modifies WinLogon for persistence
    • UAC bypass
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2232
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\H1xLl0hEJc.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2020
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:2296
        • C:\Users\Admin\AppData\Local\Temp\8e7147a2aaffb6632052f190dad38b7d945ae42f1c4e21307f6d9079afb76372.exe
          "C:\Users\Admin\AppData\Local\Temp\8e7147a2aaffb6632052f190dad38b7d945ae42f1c4e21307f6d9079afb76372.exe"
          3⤵
          • Modifies WinLogon for persistence
          • UAC bypass
          • Checks computer location settings
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:3020
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\U8oVTRSfzF.bat"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:460
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              5⤵
                PID:3828
              • C:\Users\Admin\AppData\Local\dllhost.exe
                "C:/Users/Admin/AppData/Local/\dllhost.exe"
                5⤵
                • UAC bypass
                • Checks computer location settings
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2468
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6c12e39d-c10e-43fc-bc1c-e939ed529573.vbs"
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4432
                  • C:\Users\Admin\AppData\Local\dllhost.exe
                    C:\Users\Admin\AppData\Local\dllhost.exe
                    7⤵
                    • UAC bypass
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:2316
                    • C:\Windows\System32\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2eb23847-c65b-4a17-952f-d9465fdaf03c.vbs"
                      8⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1044
                      • C:\Users\Admin\AppData\Local\dllhost.exe
                        C:\Users\Admin\AppData\Local\dllhost.exe
                        9⤵
                        • UAC bypass
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Checks whether UAC is enabled
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        • System policy modification
                        PID:4412
                        • C:\Windows\System32\WScript.exe
                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a53aee3d-5ae3-4931-b32a-3375e402c66f.vbs"
                          10⤵
                          • Suspicious use of WriteProcessMemory
                          PID:940
                          • C:\Users\Admin\AppData\Local\dllhost.exe
                            C:\Users\Admin\AppData\Local\dllhost.exe
                            11⤵
                            • UAC bypass
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            • System policy modification
                            PID:1608
                            • C:\Windows\System32\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c602a12f-7cc1-4997-a17f-70a5a410d698.vbs"
                              12⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3788
                              • C:\Users\Admin\AppData\Local\dllhost.exe
                                C:\Users\Admin\AppData\Local\dllhost.exe
                                13⤵
                                • UAC bypass
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Checks whether UAC is enabled
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                • System policy modification
                                PID:4156
                                • C:\Windows\System32\WScript.exe
                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e6d4519c-27aa-4513-b353-24f83727a975.vbs"
                                  14⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1736
                                  • C:\Users\Admin\AppData\Local\dllhost.exe
                                    C:\Users\Admin\AppData\Local\dllhost.exe
                                    15⤵
                                    • UAC bypass
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Checks whether UAC is enabled
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    • System policy modification
                                    PID:3452
                                    • C:\Windows\System32\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c1e6ee36-3a00-4176-ac50-52432f9aa5a5.vbs"
                                      16⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4028
                                      • C:\Users\Admin\AppData\Local\dllhost.exe
                                        C:\Users\Admin\AppData\Local\dllhost.exe
                                        17⤵
                                        • UAC bypass
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        • System policy modification
                                        PID:2136
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a5d1f028-caae-43e2-92f4-39b66e1e38fe.vbs"
                                          18⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:3248
                                          • C:\Users\Admin\AppData\Local\dllhost.exe
                                            C:\Users\Admin\AppData\Local\dllhost.exe
                                            19⤵
                                            • UAC bypass
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Checks whether UAC is enabled
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of WriteProcessMemory
                                            • System policy modification
                                            PID:4652
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cd4356d7-38f7-44f1-9c84-702af88a8759.vbs"
                                              20⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:2320
                                              • C:\Users\Admin\AppData\Local\dllhost.exe
                                                C:\Users\Admin\AppData\Local\dllhost.exe
                                                21⤵
                                                • UAC bypass
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Checks whether UAC is enabled
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of WriteProcessMemory
                                                • System policy modification
                                                PID:456
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eae3e2af-f75e-4d62-80f5-117a881aebb9.vbs"
                                                  22⤵
                                                    PID:5048
                                                    • C:\Users\Admin\AppData\Local\dllhost.exe
                                                      C:\Users\Admin\AppData\Local\dllhost.exe
                                                      23⤵
                                                      • UAC bypass
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Checks whether UAC is enabled
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • System policy modification
                                                      PID:2704
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ae9d5c92-34a9-421c-ae8b-0b3bd65cb9c1.vbs"
                                                        24⤵
                                                          PID:2256
                                                          • C:\Users\Admin\AppData\Local\dllhost.exe
                                                            C:\Users\Admin\AppData\Local\dllhost.exe
                                                            25⤵
                                                            • UAC bypass
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • Checks whether UAC is enabled
                                                            • Modifies registry class
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • System policy modification
                                                            PID:4076
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\20412c88-e3cf-49c3-9a25-9a657fdc1860.vbs"
                                                              26⤵
                                                                PID:860
                                                                • C:\Users\Admin\AppData\Local\dllhost.exe
                                                                  C:\Users\Admin\AppData\Local\dllhost.exe
                                                                  27⤵
                                                                  • UAC bypass
                                                                  • Checks computer location settings
                                                                  • Executes dropped EXE
                                                                  • Checks whether UAC is enabled
                                                                  • Modifies registry class
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  • System policy modification
                                                                  PID:4700
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1cd5f70e-f1ad-41c2-a5d6-e965141f2e27.vbs"
                                                                    28⤵
                                                                      PID:536
                                                                      • C:\Users\Admin\AppData\Local\dllhost.exe
                                                                        C:\Users\Admin\AppData\Local\dllhost.exe
                                                                        29⤵
                                                                        • UAC bypass
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • Checks whether UAC is enabled
                                                                        • Modifies registry class
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        • System policy modification
                                                                        PID:3188
                                                                        • C:\Windows\System32\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\305c635e-39b2-4ae1-a507-e3d4deb35c3a.vbs"
                                                                          30⤵
                                                                            PID:3016
                                                                            • C:\Users\Admin\AppData\Local\dllhost.exe
                                                                              C:\Users\Admin\AppData\Local\dllhost.exe
                                                                              31⤵
                                                                              • UAC bypass
                                                                              • Checks computer location settings
                                                                              • Executes dropped EXE
                                                                              • Checks whether UAC is enabled
                                                                              • Modifies registry class
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              • System policy modification
                                                                              PID:1088
                                                                              • C:\Windows\System32\WScript.exe
                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\70abc21e-a6b7-44cb-8d20-e43fe9f3384d.vbs"
                                                                                32⤵
                                                                                  PID:456
                                                                                  • C:\Users\Admin\AppData\Local\dllhost.exe
                                                                                    C:\Users\Admin\AppData\Local\dllhost.exe
                                                                                    33⤵
                                                                                    • UAC bypass
                                                                                    • Checks computer location settings
                                                                                    • Executes dropped EXE
                                                                                    • Checks whether UAC is enabled
                                                                                    • Modifies registry class
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    • System policy modification
                                                                                    PID:3816
                                                                                    • C:\Windows\System32\WScript.exe
                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\22043ed9-c69c-4919-822d-449ae24d9d8e.vbs"
                                                                                      34⤵
                                                                                        PID:2704
                                                                                        • C:\Users\Admin\AppData\Local\dllhost.exe
                                                                                          C:\Users\Admin\AppData\Local\dllhost.exe
                                                                                          35⤵
                                                                                          • UAC bypass
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Checks whether UAC is enabled
                                                                                          • Modifies registry class
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          • System policy modification
                                                                                          PID:1436
                                                                                          • C:\Windows\System32\WScript.exe
                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\00f8e5d4-cf8f-4b1d-b859-422e15011720.vbs"
                                                                                            36⤵
                                                                                              PID:2944
                                                                                              • C:\Users\Admin\AppData\Local\dllhost.exe
                                                                                                C:\Users\Admin\AppData\Local\dllhost.exe
                                                                                                37⤵
                                                                                                • UAC bypass
                                                                                                • Checks computer location settings
                                                                                                • Executes dropped EXE
                                                                                                • Checks whether UAC is enabled
                                                                                                • Modifies registry class
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                • System policy modification
                                                                                                PID:2636
                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b359d9f6-e39d-4827-9b84-064718f4df2f.vbs"
                                                                                                  38⤵
                                                                                                    PID:4000
                                                                                                  • C:\Windows\System32\WScript.exe
                                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\84553fc3-7886-4c5c-85bf-dba20d057dfb.vbs"
                                                                                                    38⤵
                                                                                                      PID:32
                                                                                                • C:\Windows\System32\WScript.exe
                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\54af4aeb-4d01-42a5-8b3e-ac255a8466f0.vbs"
                                                                                                  36⤵
                                                                                                    PID:3128
                                                                                              • C:\Windows\System32\WScript.exe
                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2791341d-4c19-41b1-9807-945dcc2ace6f.vbs"
                                                                                                34⤵
                                                                                                  PID:3956
                                                                                            • C:\Windows\System32\WScript.exe
                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fa3a08c2-005e-48d5-91a9-623a542d1818.vbs"
                                                                                              32⤵
                                                                                                PID:4380
                                                                                          • C:\Windows\System32\WScript.exe
                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\51ff742c-39e8-4ae8-b9a5-d429c544fcda.vbs"
                                                                                            30⤵
                                                                                              PID:2456
                                                                                        • C:\Windows\System32\WScript.exe
                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6f656733-c72c-4042-9a0a-5c9af3e55a3b.vbs"
                                                                                          28⤵
                                                                                            PID:4564
                                                                                      • C:\Windows\System32\WScript.exe
                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\60ae80fc-2e77-4cf1-8b8f-c154df2839b7.vbs"
                                                                                        26⤵
                                                                                          PID:1412
                                                                                    • C:\Windows\System32\WScript.exe
                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b5dff5a9-94a8-4e5b-bb1d-467f048d107e.vbs"
                                                                                      24⤵
                                                                                        PID:1688
                                                                                  • C:\Windows\System32\WScript.exe
                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\010f589f-0694-4403-b08a-a7379abf5115.vbs"
                                                                                    22⤵
                                                                                      PID:4456
                                                                                • C:\Windows\System32\WScript.exe
                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\98febb0a-a039-4463-8f28-ff2b73f50e67.vbs"
                                                                                  20⤵
                                                                                    PID:1616
                                                                              • C:\Windows\System32\WScript.exe
                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ed7effc9-57fc-4225-928f-a068a0c8d616.vbs"
                                                                                18⤵
                                                                                  PID:2188
                                                                            • C:\Windows\System32\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\69a5958e-f779-4fbf-ae65-623adde2e648.vbs"
                                                                              16⤵
                                                                                PID:4148
                                                                          • C:\Windows\System32\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e5684074-9af7-40d9-9e3a-26a710904b49.vbs"
                                                                            14⤵
                                                                              PID:4712
                                                                        • C:\Windows\System32\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c73cedf6-f354-4312-b70c-1ce4b6540395.vbs"
                                                                          12⤵
                                                                            PID:4948
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c15a3140-ce4a-4ccf-ab58-698aa187cce3.vbs"
                                                                        10⤵
                                                                          PID:844
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2a4a9117-80d5-4d36-9cf5-8ff3d14a5201.vbs"
                                                                      8⤵
                                                                        PID:4400
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e3d7f8f2-aa79-4927-a4ea-887c1f9e720c.vbs"
                                                                    6⤵
                                                                      PID:1952
                                                          • C:\Windows\system32\schtasks.exe
                                                            schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:/Users/Admin/AppData/Local/\Idle.exe'" /f
                                                            1⤵
                                                            • DcRat
                                                            • Process spawned unexpected child process
                                                            • Scheduled Task/Job: Scheduled Task
                                                            PID:1660
                                                          • C:\Windows\system32\schtasks.exe
                                                            schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:/Users/Admin/AppData/Local/\Idle.exe'" /rl HIGHEST /f
                                                            1⤵
                                                            • DcRat
                                                            • Process spawned unexpected child process
                                                            • Scheduled Task/Job: Scheduled Task
                                                            PID:2860
                                                          • C:\Windows\system32\schtasks.exe
                                                            schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:/Users/Admin/AppData/Local/\Idle.exe'" /rl HIGHEST /f
                                                            1⤵
                                                            • DcRat
                                                            • Process spawned unexpected child process
                                                            • Scheduled Task/Job: Scheduled Task
                                                            PID:3256
                                                          • C:\Windows\system32\schtasks.exe
                                                            schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:/Users/Admin/AppData/Local/\dllhost.exe'" /f
                                                            1⤵
                                                            • DcRat
                                                            • Process spawned unexpected child process
                                                            • Scheduled Task/Job: Scheduled Task
                                                            PID:2252
                                                          • C:\Windows\system32\schtasks.exe
                                                            schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:/Users/Admin/AppData/Local/\dllhost.exe'" /rl HIGHEST /f
                                                            1⤵
                                                            • DcRat
                                                            • Process spawned unexpected child process
                                                            • Scheduled Task/Job: Scheduled Task
                                                            PID:988
                                                          • C:\Windows\system32\schtasks.exe
                                                            schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:/Users/Admin/AppData/Local/\dllhost.exe'" /rl HIGHEST /f
                                                            1⤵
                                                            • DcRat
                                                            • Process spawned unexpected child process
                                                            • Scheduled Task/Job: Scheduled Task
                                                            PID:4324

                                                          Network

                                                          MITRE ATT&CK Enterprise v15

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\8e7147a2aaffb6632052f190dad38b7d945ae42f1c4e21307f6d9079afb76372.exe.log

                                                            Filesize

                                                            1KB

                                                            MD5

                                                            7800fca2323a4130444c572374a030f4

                                                            SHA1

                                                            40c9b8e0e5e7d72a5293f4010f2ccf21e637b4aa

                                                            SHA256

                                                            29f5645ac14353ac460858f52c856548f3aeb144b09eef672a6b4849bafe742e

                                                            SHA512

                                                            c8a7ad930b8c07007c7a67d8c32a2a4a401dcc34ab966e0e80901655fcbe1f5c95b72a195e6381b1de56c2c987eeab093d8e89891bec9e9684785c5d824b3554

                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log

                                                            Filesize

                                                            1KB

                                                            MD5

                                                            3ad9a5252966a3ab5b1b3222424717be

                                                            SHA1

                                                            5397522c86c74ddbfb2585b9613c794f4b4c3410

                                                            SHA256

                                                            27525f5fc7871c6828ab5173315e95b5c7e918d2ee532781c562c378584b5249

                                                            SHA512

                                                            b1a745f7a0f33b777ffc34f74f42752144d9f2d06b8bc613e703570494762b3af87e153212c3274b18af14f17b8619e2f350b7c3cc11228f7d4208d4251e90e6

                                                          • C:\Users\Admin\AppData\Local\Temp\1cd5f70e-f1ad-41c2-a5d6-e965141f2e27.vbs

                                                            Filesize

                                                            716B

                                                            MD5

                                                            c2c5b764db7fb10ad9eff5505d1316be

                                                            SHA1

                                                            69b0c12f59b611bd18a8f96d1b9b125e7ee3ab54

                                                            SHA256

                                                            7aea565e8528bf6f2d2b769c0b6827d085378443a859f92d8ac8190b2a623a2d

                                                            SHA512

                                                            479ee833d2e2f5316a39a999b05933f9eec21d7339bb2adf8a48ef59554e5ca9ba3f192b5071561b4b920c7b0165ecbc5675eedc0fc00eba49924ac392b7aaba

                                                          • C:\Users\Admin\AppData\Local\Temp\20412c88-e3cf-49c3-9a25-9a657fdc1860.vbs

                                                            Filesize

                                                            716B

                                                            MD5

                                                            674e7b10f738a57f2722c5feaf01a692

                                                            SHA1

                                                            7773e9c875c6677ccb215f212d802c8ad65e5305

                                                            SHA256

                                                            29a8638ff88a286d43eb12b3c209736c90baf27cdafcdded42b200f5843cb7f0

                                                            SHA512

                                                            500dacb2d3bc224ac3caa64f9ba242d645aeb2582cb75a1b89613e0c589b588e6a4fc9daf9b32b4c40ef5b75a005801eb7a3dc34adc1107831852a4996eb67fd

                                                          • C:\Users\Admin\AppData\Local\Temp\22043ed9-c69c-4919-822d-449ae24d9d8e.vbs

                                                            Filesize

                                                            716B

                                                            MD5

                                                            c05b1456a05d384894831042cec59c44

                                                            SHA1

                                                            c6e3e67ca4bc5e7a4b2554993c20773492261ac5

                                                            SHA256

                                                            9f18cf54c3eb78353732b82e57098f836ab434030507f58d9abd734c89c98101

                                                            SHA512

                                                            2e51edb3ad742ea00d620062ed91f5db1c129644334b97ba14b77be4791cab13af425765741d7bbecda647f4804bc210e2ee7eaaf7c1eb9c0b676f2949e58703

                                                          • C:\Users\Admin\AppData\Local\Temp\2eb23847-c65b-4a17-952f-d9465fdaf03c.vbs

                                                            Filesize

                                                            716B

                                                            MD5

                                                            cd7549300b733f5b674287d21566a67d

                                                            SHA1

                                                            512cb25be864239b295ab5f54cc5e15f55f54786

                                                            SHA256

                                                            42beaf6d2965e4052cbaa8796c99560c8a6b20eded30d6c1588ad266da41813b

                                                            SHA512

                                                            557db44a4f599e05d6e310f53e7dbe9bf8a57c37bff0ed879abf5e58572a5fe21d6804cbe0f1ad994c9edd94faf5a229f552ff092c581e134ae442e1a6ccc26b

                                                          • C:\Users\Admin\AppData\Local\Temp\305c635e-39b2-4ae1-a507-e3d4deb35c3a.vbs

                                                            Filesize

                                                            716B

                                                            MD5

                                                            e7085c5e792efe295b1d17d0cbb25141

                                                            SHA1

                                                            93e300f491b75b18ab7419fb978d7d5e60a07a4b

                                                            SHA256

                                                            9a16540c76d87ec0144592d9087345b7dcb6afe1a0eac3d145feeaeaf80371e9

                                                            SHA512

                                                            f4d3fca7d93f4a7b5d1c2f4d837cb0b9f7bb5e05ad1e92ba8ebc5c7e9ac3ad5a5c1a1ff316e439242ab55acf95123f760f07609114016f31da7b90d9c98210cd

                                                          • C:\Users\Admin\AppData\Local\Temp\6c12e39d-c10e-43fc-bc1c-e939ed529573.vbs

                                                            Filesize

                                                            716B

                                                            MD5

                                                            6d1c1836ce28ad77a08019d120c83ecc

                                                            SHA1

                                                            74c49d9f191e9536ffc7b284025677be52174fe1

                                                            SHA256

                                                            8e355ec4fe03aeade1c488edc366edb181bf9929c59149ed516722c50b47b612

                                                            SHA512

                                                            8250557b969a9b82c30444b34d3ec7d7d5db4f19268bdf97261f3f842bd9b4f1bdec468ad537053b7e3b950eec28a46a617a9be63c0b19de3030a4c5e9b8f89e

                                                          • C:\Users\Admin\AppData\Local\Temp\70abc21e-a6b7-44cb-8d20-e43fe9f3384d.vbs

                                                            Filesize

                                                            716B

                                                            MD5

                                                            d1c14cb99832db59c60078bd40eb30d3

                                                            SHA1

                                                            050f08ff0bb358c7ab1ba40667c1540cbbc631a0

                                                            SHA256

                                                            dbba2a160b119a2ae411559ad4c9ab355d1f13bcc3784f8b49dc34d33a85ce5e

                                                            SHA512

                                                            96d4e286a771d823be0d0d6c1f2b3aa554198839102fa41ed29c5aaeb4ba8bb65518d9b17be5f0edbbac08612072c6e0555cf1c8a1e4a2fc0d03a74edff87d07

                                                          • C:\Users\Admin\AppData\Local\Temp\H1xLl0hEJc.bat

                                                            Filesize

                                                            267B

                                                            MD5

                                                            ddbe19573a5bf16418e25d3462a11a59

                                                            SHA1

                                                            ebf7a1d8686fd26c3ad593c5879aa09aeaafe94d

                                                            SHA256

                                                            5a32d1cb9cfd8d98e81ddedec5b14f443383ccb0b1583c160b606f826631aa0f

                                                            SHA512

                                                            4696ec5c4b37f3d5c65abcc9528a060fcdd8196c8291788be7dc8054d12124eb326f4bdc58fb0cae441578a2a5ad2089157343b5aead00ce13addff5741cb33e

                                                          • C:\Users\Admin\AppData\Local\Temp\U8oVTRSfzF.bat

                                                            Filesize

                                                            206B

                                                            MD5

                                                            564b6736c58b4f81cc0c8f827f326fa5

                                                            SHA1

                                                            bed16868086c4961b699dbf494a4582991276ad8

                                                            SHA256

                                                            9afdadccb336fc5d9e5c0581c54f7f495c055ee5feedb3931fadcb548f21a11c

                                                            SHA512

                                                            51f0957634f3944dae278add6e27deddba783921257154789828ff7c533c91ef7ed17161c02ccce3e08d68f26509f5f0bba4c0b393013da453b53c7bcb25576b

                                                          • C:\Users\Admin\AppData\Local\Temp\a53aee3d-5ae3-4931-b32a-3375e402c66f.vbs

                                                            Filesize

                                                            716B

                                                            MD5

                                                            c81af2291e2dbcb9e8cfde689a686283

                                                            SHA1

                                                            e8b02c6afabc528f0440be9a7aeee0f6bb3a1450

                                                            SHA256

                                                            74a33cf37b7c66d32a0ccb348f5d5347a90cefc758ad7801e78c9c4d0aa83ec0

                                                            SHA512

                                                            33cda660ac02a1e3fcb40a373f66652e2ff0c3ebfc5ba58a31fbd74dd0e3e342a7647bdc531b74cee30646f90c3b8ff9379188c7ff3889b841cda2b472047c77

                                                          • C:\Users\Admin\AppData\Local\Temp\a5d1f028-caae-43e2-92f4-39b66e1e38fe.vbs

                                                            Filesize

                                                            716B

                                                            MD5

                                                            e6ea6c4a7c634f061684b548e16352d8

                                                            SHA1

                                                            a0eea02fb08f1bdac8aa0f924c6f6db4c3a836a0

                                                            SHA256

                                                            7bf26c308752306b6d2fb65516e0d2cef3ad001363efc77e6a0bd5df44596963

                                                            SHA512

                                                            61ac0a12520df85afcec3c3dc89641fed7bbddbfe49e3c36e42fa184fa0924ab5365b6c80816fcd6e1dc0683e2d4196558082ee139220381aca8f85314b8cee1

                                                          • C:\Users\Admin\AppData\Local\Temp\ae9d5c92-34a9-421c-ae8b-0b3bd65cb9c1.vbs

                                                            Filesize

                                                            716B

                                                            MD5

                                                            0ee41a73dac6d0051a64222a49d383cf

                                                            SHA1

                                                            bb7c1aacdec6d8b397777b68a59bd74b42dcfff8

                                                            SHA256

                                                            c33f511dc4f9ae239edf75a3f3e805b7075f03561b4d4cd9c077e9b5af86abf9

                                                            SHA512

                                                            ba22f81c7809e431e761a411c21d100d5c5f07146c07420d0224a15f397d07ba258fe5cf08e618a1b8697d4c640809c744af284671b06191b3a0eb82bb98928c

                                                          • C:\Users\Admin\AppData\Local\Temp\c1e6ee36-3a00-4176-ac50-52432f9aa5a5.vbs

                                                            Filesize

                                                            716B

                                                            MD5

                                                            440e4d703833f45a9b917c37b62de86c

                                                            SHA1

                                                            30209635c37e51d444d9f5fa597b2f38a1d9f9aa

                                                            SHA256

                                                            fa4500b5f8e4e14d85e1b5555b7c09584d613ec83fc85ef2dd3b4a9699d1d060

                                                            SHA512

                                                            a5137c8d89d44b1f8f091982b8db7f4d1257df5c39f75fc88bb1d9c76d095b041c57e3fb02c77cf0434cf69c3e7ffd6d474b3b9d395453b5f158b40d162f5394

                                                          • C:\Users\Admin\AppData\Local\Temp\c602a12f-7cc1-4997-a17f-70a5a410d698.vbs

                                                            Filesize

                                                            716B

                                                            MD5

                                                            04fc1a6580cd50edf840643461d701e4

                                                            SHA1

                                                            eda30ad390ab66120ceec386804b53864d2f99f8

                                                            SHA256

                                                            373807b9212302be55c08137836192ff326934e8f6306fd5f1890774baa2166c

                                                            SHA512

                                                            86d666c301a3645bb9dd41866e56727373965eb70c97d92acc9cf9453a801b0995de3d802bb96239eb4a436d27f37f87c735ba56c2f163ca8e519e9ab41e5ab0

                                                          • C:\Users\Admin\AppData\Local\Temp\cd4356d7-38f7-44f1-9c84-702af88a8759.vbs

                                                            Filesize

                                                            716B

                                                            MD5

                                                            323fd295fa1965c41c4f369c0a4d8ccf

                                                            SHA1

                                                            1cda30f2558fe0bc052c0041bf253bb74b936e56

                                                            SHA256

                                                            cd7543420746609604e6c73d8d08740443893cf506b48db93af0ca4f0d628a12

                                                            SHA512

                                                            818ce8af0973b74aee5a914ab35ddfe0b925b93c873a75a3bcdee0b053cf20ceeab28729ddbf3b4b893a39179d6b62ee1eb4c6031819e383fb53c302d3901d81

                                                          • C:\Users\Admin\AppData\Local\Temp\e3d7f8f2-aa79-4927-a4ea-887c1f9e720c.vbs

                                                            Filesize

                                                            492B

                                                            MD5

                                                            e5036376596ce3f71257bb8f9635dda3

                                                            SHA1

                                                            756b8f634c8aaf37edd45a30cf47c02b98ce8747

                                                            SHA256

                                                            dc5718d7faef5ed409811d3ba5a73d1e2d4b57275f87060def15da4d06f43924

                                                            SHA512

                                                            5bd3d32d970c3843fa2758ada28d419a1898ed3f5bda0fc58629ce5d86b19c044e2955baba56b3a028417a328fef95dacbd024642fbdc18e6c82846985b09f40

                                                          • C:\Users\Admin\AppData\Local\Temp\e6d4519c-27aa-4513-b353-24f83727a975.vbs

                                                            Filesize

                                                            716B

                                                            MD5

                                                            5a5febee01ec17964066e4c45ef56c25

                                                            SHA1

                                                            209a37f049286f4567f5665831db7c325ce1e8be

                                                            SHA256

                                                            7acf0aaf5c29c6be3ea292a876552fa4897483611dc37fa5e57c6dc2b3942088

                                                            SHA512

                                                            4ef791123b7eb2bd518e140f5391c7e8710c12339b2f7566e5fc88f49a9daac954198a2beb8e9cd04f4e4c2d091f602214215347866db32e5c1d4be11b3e1bb7

                                                          • C:\Users\Admin\AppData\Local\Temp\eae3e2af-f75e-4d62-80f5-117a881aebb9.vbs

                                                            Filesize

                                                            715B

                                                            MD5

                                                            4efb8f4f44b1ab93589329ad752c1e1e

                                                            SHA1

                                                            3e656306c37b23ae7656566974c990949a0b49a9

                                                            SHA256

                                                            8568feaaef34a70e1a40b14e6a333a0c9c586e7f7cd6c66b8fcfbf4ac7b98e59

                                                            SHA512

                                                            838f9b939f4340a709ebfd55b76b4b768efaade5d17e1cf26b76a9b072c5fdfa21073afb32544ad7a4314cd20bf7c3921be2e535880057ad5d349bec3cd04664

                                                          • C:\Users\Admin\AppData\Local\Temp\tmpB083E.tmp

                                                            Filesize

                                                            296B

                                                            MD5

                                                            865028c2c69ab4d604d4cc2bcef464b9

                                                            SHA1

                                                            ef122ae5fdbeb2bdd15286315e082e91ee6ec4b5

                                                            SHA256

                                                            8c3346eb43576172f6235e0fe9297046535ed39da110284ec10a67410d1d4f98

                                                            SHA512

                                                            d5d592a94530376e7df3b556115ac09caed80645523ff7a5f7bfd2e7a9817edd9229de9dcc4cd284c1523760bfb4800135891f546cb0d6fc4815d13b553781e8

                                                          • C:\Users\Admin\AppData\Local\dllhost.exe

                                                            Filesize

                                                            1.2MB

                                                            MD5

                                                            e96b9e17da08c5a64c26dc666402c64f

                                                            SHA1

                                                            cceec5c7f6f4bbf08c63153a0dea8b5834ed38ee

                                                            SHA256

                                                            8e7147a2aaffb6632052f190dad38b7d945ae42f1c4e21307f6d9079afb76372

                                                            SHA512

                                                            dd71101f1b6b0dcd545bec2e448c6368a8653b599a5b0de3287ac50126b0c380a325e92fa201bdd869d97cf18e63d0795879923e9364abb92adfc57af02d5040

                                                          • memory/2232-8-0x000000001BA70000-0x000000001BA7C000-memory.dmp

                                                            Filesize

                                                            48KB

                                                          • memory/2232-7-0x0000000003170000-0x000000000317A000-memory.dmp

                                                            Filesize

                                                            40KB

                                                          • memory/2232-0-0x00007FFA81943000-0x00007FFA81945000-memory.dmp

                                                            Filesize

                                                            8KB

                                                          • memory/2232-17-0x00007FFA81940000-0x00007FFA82401000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/2232-5-0x00000000018A0000-0x00000000018B6000-memory.dmp

                                                            Filesize

                                                            88KB

                                                          • memory/2232-6-0x0000000001860000-0x000000000186A000-memory.dmp

                                                            Filesize

                                                            40KB

                                                          • memory/2232-4-0x000000001BAC0000-0x000000001BB10000-memory.dmp

                                                            Filesize

                                                            320KB

                                                          • memory/2232-3-0x0000000001880000-0x000000000189C000-memory.dmp

                                                            Filesize

                                                            112KB

                                                          • memory/2232-2-0x00007FFA81940000-0x00007FFA82401000-memory.dmp

                                                            Filesize

                                                            10.8MB

                                                          • memory/2232-1-0x0000000000DC0000-0x0000000000F04000-memory.dmp

                                                            Filesize

                                                            1.3MB