dcrat | a2f2e7faee09ff22d394d74ca44ec2a153199d3af3936d1841f3d57c8eae721c

General

Target

MsSavesSessionDll/agentreviewPerf.exe
Size

2.3MB
MD5

4e69fcf73418a08fcb8b3e7e2ecb43c4
SHA1

a3ecd09f65ca4e7821a0b7f8596edcd679573f5b
SHA256

fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4
SHA512

a6d1a2b6363ad8a560567e6c11a48f8d1bc4cdfc36474902edf39f676440be82619aae52279121a776486d0edfe7a448f0fe9707b27ae760c1d6dd0201f6adc3
SSDEEP

49152:BwpUwcTZ0rUinysyVZl5LCCcG3RTXM34FIIPWYJxuQfUgtFneJ8BG5U:Bw1ctUyjTLC8puaX/neJ8BgU

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat 20 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

Processes:

schtasks.exeschtasks.exeagentreviewPerf.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	pid	Process
		2604	schtasks.exe
		1432	schtasks.exe
File created	C:\Windows\ServiceProfiles\System.exe		agentreviewPerf.exe
File created	C:\Windows\ServiceProfiles\27d1bcfc3c54e0		agentreviewPerf.exe
		2612	schtasks.exe
		1220	schtasks.exe
		276	schtasks.exe
		2596	schtasks.exe
		1888	schtasks.exe
		2676	schtasks.exe
		2056	schtasks.exe
		560	schtasks.exe
		2308	schtasks.exe
		2552	schtasks.exe
		3040	schtasks.exe
		604	schtasks.exe
		2652	schtasks.exe
		2512	schtasks.exe
		2852	schtasks.exe
		2892	schtasks.exe

Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

agentreviewPerf.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ServiceProfiles\\System.exe\""	agentreviewPerf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ServiceProfiles\\System.exe\", \"C:\\Users\\Default\\OSPPSVC.exe\""	agentreviewPerf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ServiceProfiles\\System.exe\", \"C:\\Users\\Default\\OSPPSVC.exe\", \"C:\\Program Files\\Common Files\\System\\ja-JP\\WmiPrvSE.exe\""	agentreviewPerf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ServiceProfiles\\System.exe\", \"C:\\Users\\Default\\OSPPSVC.exe\", \"C:\\Program Files\\Common Files\\System\\ja-JP\\WmiPrvSE.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\winlogon.exe\""	agentreviewPerf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ServiceProfiles\\System.exe\", \"C:\\Users\\Default\\OSPPSVC.exe\", \"C:\\Program Files\\Common Files\\System\\ja-JP\\WmiPrvSE.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\winlogon.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\audiodg.exe\""	agentreviewPerf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ServiceProfiles\\System.exe\", \"C:\\Users\\Default\\OSPPSVC.exe\", \"C:\\Program Files\\Common Files\\System\\ja-JP\\WmiPrvSE.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\winlogon.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\audiodg.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\winlogon.exe\""	agentreviewPerf.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2584	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	2584	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	2584	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	2584	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	2584	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1220	2584	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	604	2584	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	276	2584	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	2584	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	2584	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	2584	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	2584	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	2584	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	560	2584	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1888	2584	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2584	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	2584	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2308	2584	schtasks.exe	30

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral5/memory/2748-1-0x0000000000E30000-0x0000000001082000-memory.dmp	dcrat
behavioral5/files/0x0006000000016d46-18.dat	dcrat
behavioral5/memory/1872-31-0x0000000000FF0000-0x0000000001242000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

Processes:

System.exe

pid	Process
1872	System.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

agentreviewPerf.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\audiodg.exe\""	agentreviewPerf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\audiodg.exe\""	agentreviewPerf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files\\VideoLAN\\VLC\\winlogon.exe\""	agentreviewPerf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\ServiceProfiles\\System.exe\""	agentreviewPerf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files\\Common Files\\System\\ja-JP\\WmiPrvSE.exe\""	agentreviewPerf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files\\Common Files\\System\\ja-JP\\WmiPrvSE.exe\""	agentreviewPerf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\winlogon.exe\""	agentreviewPerf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\winlogon.exe\""	agentreviewPerf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files\\VideoLAN\\VLC\\winlogon.exe\""	agentreviewPerf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\ServiceProfiles\\System.exe\""	agentreviewPerf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Users\\Default\\OSPPSVC.exe\""	agentreviewPerf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Users\\Default\\OSPPSVC.exe\""	agentreviewPerf.exe

Drops file in Program Files directory 4 IoCs

Processes:

agentreviewPerf.exe

description	ioc	Process
File created	C:\Program Files\Common Files\System\ja-JP\WmiPrvSE.exe	agentreviewPerf.exe
File created	C:\Program Files\Common Files\System\ja-JP\24dbde2999530e	agentreviewPerf.exe
File created	C:\Program Files\VideoLAN\VLC\winlogon.exe	agentreviewPerf.exe
File created	C:\Program Files\VideoLAN\VLC\cc11b995f2a76d	agentreviewPerf.exe

Drops file in Windows directory 3 IoCs

Processes:

agentreviewPerf.exe

description	ioc	Process
File created	C:\Windows\ServiceProfiles\System.exe	agentreviewPerf.exe
File opened for modification	C:\Windows\ServiceProfiles\System.exe	agentreviewPerf.exe
File created	C:\Windows\ServiceProfiles\27d1bcfc3c54e0	agentreviewPerf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	Process
2604	schtasks.exe
2552	schtasks.exe
2596	schtasks.exe
560	schtasks.exe
2612	schtasks.exe
604	schtasks.exe
276	schtasks.exe
2512	schtasks.exe
2852	schtasks.exe
2892	schtasks.exe
2676	schtasks.exe
1220	schtasks.exe
1432	schtasks.exe
2652	schtasks.exe
2056	schtasks.exe
2308	schtasks.exe
3040	schtasks.exe
1888	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

agentreviewPerf.exeSystem.exe

pid	Process
2748	agentreviewPerf.exe
1872	System.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

agentreviewPerf.exeSystem.exe

description	pid	Process
Token: SeDebugPrivilege	2748	agentreviewPerf.exe
Token: SeDebugPrivilege	1872	System.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

agentreviewPerf.execmd.exe

description	pid	Process	procid_target
PID 2748 wrote to memory of 1052	2748	agentreviewPerf.exe	49
PID 2748 wrote to memory of 1052	2748	agentreviewPerf.exe	49
PID 2748 wrote to memory of 1052	2748	agentreviewPerf.exe	49
PID 1052 wrote to memory of 3056	1052	cmd.exe	51
PID 1052 wrote to memory of 3056	1052	cmd.exe	51
PID 1052 wrote to memory of 3056	1052	cmd.exe	51
PID 1052 wrote to memory of 1872	1052	cmd.exe	52
PID 1052 wrote to memory of 1872	1052	cmd.exe	52
PID 1052 wrote to memory of 1872	1052	cmd.exe	52

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\MsSavesSessionDll\agentreviewPerf.exe
"C:\Users\Admin\AppData\Local\Temp\MsSavesSessionDll\agentreviewPerf.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sdnzbYHJb4.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3056
- - C:\Windows\ServiceProfiles\System.exe
    "C:\Windows\ServiceProfiles\System.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Windows\ServiceProfiles\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Windows\ServiceProfiles\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\Users\Default\OSPPSVC.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\Default\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\Users\Default\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Program Files\Common Files\System\ja-JP\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Common Files\System\ja-JP\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files\Common Files\System\ja-JP\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\audiodg.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files\VideoLAN\VLC\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files\VideoLAN\VLC\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\audiodg.exe

Filesize
2.3MB

MD5
4e69fcf73418a08fcb8b3e7e2ecb43c4

SHA1
a3ecd09f65ca4e7821a0b7f8596edcd679573f5b

SHA256
fa78ac8f4c94923c7e53a3bf6936b46aff02f7746ee9518460c2d529ea2982d4

SHA512
a6d1a2b6363ad8a560567e6c11a48f8d1bc4cdfc36474902edf39f676440be82619aae52279121a776486d0edfe7a448f0fe9707b27ae760c1d6dd0201f6adc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\sdnzbYHJb4.bat

Filesize
202B

MD5
36277f8913831ae74b72ce48cef20a45

SHA1
9f201c71147a33b3dc95e80b00c5917a6a557d78

SHA256
bd726e62f929f416b2d055dd741148779ea144059ee34cc88e78616d296b603a

SHA512
ac73903f111ec870224553deb3eccde3cf298e9e6b6e7e2058285a9383f2a83636c8b99be51335880a52ec7c28add29efb84a3d10e5b556f8c455a3f4bda3bfd

Download Submit
memory/1872-32-0x0000000000D50000-0x0000000000DA6000-memory.dmp

Filesize
344KB

Download
memory/1872-31-0x0000000000FF0000-0x0000000001242000-memory.dmp

Filesize
2.3MB

Download
memory/2748-6-0x0000000000AC0000-0x0000000000AD2000-memory.dmp

Filesize
72KB

Download
memory/2748-5-0x0000000000DE0000-0x0000000000E36000-memory.dmp

Filesize
344KB

Download
memory/2748-0-0x000007FEF6033000-0x000007FEF6034000-memory.dmp

Filesize
4KB

Download
memory/2748-7-0x0000000000AD0000-0x0000000000ADE000-memory.dmp

Filesize
56KB

Download
memory/2748-8-0x000000001ACE0000-0x000000001ACE8000-memory.dmp

Filesize
32KB

Download
memory/2748-9-0x000000001ACF0000-0x000000001ACF8000-memory.dmp

Filesize
32KB

Download
memory/2748-4-0x0000000000AA0000-0x0000000000AB6000-memory.dmp

Filesize
88KB

Download
memory/2748-27-0x000007FEF6030000-0x000007FEF6A1C000-memory.dmp

Filesize
9.9MB

Download
memory/2748-3-0x0000000000A80000-0x0000000000A9C000-memory.dmp

Filesize
112KB

Download
memory/2748-2-0x000007FEF6030000-0x000007FEF6A1C000-memory.dmp

Filesize
9.9MB

Download
memory/2748-1-0x0000000000E30000-0x0000000001082000-memory.dmp

Filesize
2.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads