dcrat | e2d03b6739a8de1b747e53f350420d32e8d3d930a988089e1b9edf6e598c4a6e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2d03b6739a8de1b747e53f350420d32e8d3d930a988089e1b9edf6e598c4a6e.exe
Size

1.3MB
MD5

ff93deacee9f31af19efda4595731582
SHA1

ba6d683976b798f81282262ffec4246375938c22
SHA256

e2d03b6739a8de1b747e53f350420d32e8d3d930a988089e1b9edf6e598c4a6e
SHA512

0d4d8c937b432e8667a9d0e5c0f8f2dd6c2c273ae3b1100914cfeeb09034662f52200aeaa1c30d3f02c33b3ef55691d8c1f2ffbd1487a9f482f202d15d159e3c
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	1868	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3576	1868	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1364	1868	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4196	1868	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	1868	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	1868	schtasks.exe	89

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023cc3-10.dat	dcrat
behavioral2/memory/2684-13-0x0000000000370000-0x0000000000480000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1736	powershell.exe
2092	powershell.exe
4148	powershell.exe

Checks computer location settings 2 TTPs 16 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	e2d03b6739a8de1b747e53f350420d32e8d3d930a988089e1b9edf6e598c4a6e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 15 IoCs

pid	Process
2684	DllCommonsvc.exe
1308	RuntimeBroker.exe
1908	RuntimeBroker.exe
4196	RuntimeBroker.exe
2380	RuntimeBroker.exe
64	RuntimeBroker.exe
4284	RuntimeBroker.exe
4856	RuntimeBroker.exe
4920	RuntimeBroker.exe
3340	RuntimeBroker.exe
4560	RuntimeBroker.exe
2488	RuntimeBroker.exe
4628	RuntimeBroker.exe
1540	RuntimeBroker.exe
4044	RuntimeBroker.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs

Web Service

T1102

flow	ioc
41	raw.githubusercontent.com
42	raw.githubusercontent.com
47	raw.githubusercontent.com
55	raw.githubusercontent.com
17	raw.githubusercontent.com
48	raw.githubusercontent.com
56	raw.githubusercontent.com
58	raw.githubusercontent.com
16	raw.githubusercontent.com
21	raw.githubusercontent.com
43	raw.githubusercontent.com
52	raw.githubusercontent.com
54	raw.githubusercontent.com
57	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e2d03b6739a8de1b747e53f350420d32e8d3d930a988089e1b9edf6e598c4a6e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	e2d03b6739a8de1b747e53f350420d32e8d3d930a988089e1b9edf6e598c4a6e.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4196	schtasks.exe
1160	schtasks.exe
3012	schtasks.exe
4880	schtasks.exe
3576	schtasks.exe
1364	schtasks.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2684	DllCommonsvc.exe
2092	powershell.exe
2092	powershell.exe
4148	powershell.exe
1736	powershell.exe
4148	powershell.exe
1736	powershell.exe
1308	RuntimeBroker.exe
1908	RuntimeBroker.exe
4196	RuntimeBroker.exe
2380	RuntimeBroker.exe
64	RuntimeBroker.exe
4284	RuntimeBroker.exe
4856	RuntimeBroker.exe
4920	RuntimeBroker.exe
3340	RuntimeBroker.exe
4560	RuntimeBroker.exe
2488	RuntimeBroker.exe
4628	RuntimeBroker.exe
1540	RuntimeBroker.exe
4044	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	2684	DllCommonsvc.exe
Token: SeDebugPrivilege	2092	powershell.exe
Token: SeDebugPrivilege	4148	powershell.exe
Token: SeDebugPrivilege	1736	powershell.exe
Token: SeDebugPrivilege	1308	RuntimeBroker.exe
Token: SeDebugPrivilege	1908	RuntimeBroker.exe
Token: SeDebugPrivilege	4196	RuntimeBroker.exe
Token: SeDebugPrivilege	2380	RuntimeBroker.exe
Token: SeDebugPrivilege	64	RuntimeBroker.exe
Token: SeDebugPrivilege	4284	RuntimeBroker.exe
Token: SeDebugPrivilege	4856	RuntimeBroker.exe
Token: SeDebugPrivilege	4920	RuntimeBroker.exe
Token: SeDebugPrivilege	3340	RuntimeBroker.exe
Token: SeDebugPrivilege	4560	RuntimeBroker.exe
Token: SeDebugPrivilege	2488	RuntimeBroker.exe
Token: SeDebugPrivilege	4628	RuntimeBroker.exe
Token: SeDebugPrivilege	1540	RuntimeBroker.exe
Token: SeDebugPrivilege	4044	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 3672	2820	e2d03b6739a8de1b747e53f350420d32e8d3d930a988089e1b9edf6e598c4a6e.exe	85
PID 2820 wrote to memory of 3672	2820	e2d03b6739a8de1b747e53f350420d32e8d3d930a988089e1b9edf6e598c4a6e.exe	85
PID 2820 wrote to memory of 3672	2820	e2d03b6739a8de1b747e53f350420d32e8d3d930a988089e1b9edf6e598c4a6e.exe	85
PID 3672 wrote to memory of 228	3672	WScript.exe	86
PID 3672 wrote to memory of 228	3672	WScript.exe	86
PID 3672 wrote to memory of 228	3672	WScript.exe	86
PID 228 wrote to memory of 2684	228	cmd.exe	88
PID 228 wrote to memory of 2684	228	cmd.exe	88
PID 2684 wrote to memory of 1736	2684	DllCommonsvc.exe	97
PID 2684 wrote to memory of 1736	2684	DllCommonsvc.exe	97
PID 2684 wrote to memory of 2092	2684	DllCommonsvc.exe	98
PID 2684 wrote to memory of 2092	2684	DllCommonsvc.exe	98
PID 2684 wrote to memory of 4148	2684	DllCommonsvc.exe	99
PID 2684 wrote to memory of 4148	2684	DllCommonsvc.exe	99
PID 2684 wrote to memory of 2884	2684	DllCommonsvc.exe	103
PID 2684 wrote to memory of 2884	2684	DllCommonsvc.exe	103
PID 2884 wrote to memory of 1356	2884	cmd.exe	105
PID 2884 wrote to memory of 1356	2884	cmd.exe	105
PID 2884 wrote to memory of 1308	2884	cmd.exe	107
PID 2884 wrote to memory of 1308	2884	cmd.exe	107
PID 1308 wrote to memory of 3500	1308	RuntimeBroker.exe	109
PID 1308 wrote to memory of 3500	1308	RuntimeBroker.exe	109
PID 3500 wrote to memory of 4384	3500	cmd.exe	111
PID 3500 wrote to memory of 4384	3500	cmd.exe	111
PID 3500 wrote to memory of 1908	3500	cmd.exe	113
PID 3500 wrote to memory of 1908	3500	cmd.exe	113
PID 1908 wrote to memory of 776	1908	RuntimeBroker.exe	119
PID 1908 wrote to memory of 776	1908	RuntimeBroker.exe	119
PID 776 wrote to memory of 1216	776	cmd.exe	121
PID 776 wrote to memory of 1216	776	cmd.exe	121
PID 776 wrote to memory of 4196	776	cmd.exe	126
PID 776 wrote to memory of 4196	776	cmd.exe	126
PID 4196 wrote to memory of 4540	4196	RuntimeBroker.exe	133
PID 4196 wrote to memory of 4540	4196	RuntimeBroker.exe	133
PID 4540 wrote to memory of 4312	4540	cmd.exe	135
PID 4540 wrote to memory of 4312	4540	cmd.exe	135
PID 4540 wrote to memory of 2380	4540	cmd.exe	137
PID 4540 wrote to memory of 2380	4540	cmd.exe	137
PID 2380 wrote to memory of 3640	2380	RuntimeBroker.exe	139
PID 2380 wrote to memory of 3640	2380	RuntimeBroker.exe	139
PID 3640 wrote to memory of 3284	3640	cmd.exe	141
PID 3640 wrote to memory of 3284	3640	cmd.exe	141
PID 3640 wrote to memory of 64	3640	cmd.exe	143
PID 3640 wrote to memory of 64	3640	cmd.exe	143
PID 64 wrote to memory of 4516	64	RuntimeBroker.exe	145
PID 64 wrote to memory of 4516	64	RuntimeBroker.exe	145
PID 4516 wrote to memory of 4384	4516	cmd.exe	147
PID 4516 wrote to memory of 4384	4516	cmd.exe	147
PID 4516 wrote to memory of 4284	4516	cmd.exe	149
PID 4516 wrote to memory of 4284	4516	cmd.exe	149
PID 4284 wrote to memory of 5092	4284	RuntimeBroker.exe	152
PID 4284 wrote to memory of 5092	4284	RuntimeBroker.exe	152
PID 5092 wrote to memory of 2680	5092	cmd.exe	154
PID 5092 wrote to memory of 2680	5092	cmd.exe	154
PID 5092 wrote to memory of 4856	5092	cmd.exe	156
PID 5092 wrote to memory of 4856	5092	cmd.exe	156
PID 4856 wrote to memory of 3576	4856	RuntimeBroker.exe	158
PID 4856 wrote to memory of 3576	4856	RuntimeBroker.exe	158
PID 3576 wrote to memory of 1996	3576	cmd.exe	160
PID 3576 wrote to memory of 1996	3576	cmd.exe	160
PID 3576 wrote to memory of 4920	3576	cmd.exe	162
PID 3576 wrote to memory of 4920	3576	cmd.exe	162
PID 4920 wrote to memory of 2248	4920	RuntimeBroker.exe	164
PID 4920 wrote to memory of 2248	4920	RuntimeBroker.exe	164

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e2d03b6739a8de1b747e53f350420d32e8d3d930a988089e1b9edf6e598c4a6e.exe
"C:\Users\Admin\AppData\Local\Temp\e2d03b6739a8de1b747e53f350420d32e8d3d930a988089e1b9edf6e598c4a6e.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:228
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2684
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1736
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2092
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4148
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\daHDUzbFiW.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2884
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1356
      - C:\providercommon\RuntimeBroker.exe
        
        "C:\providercommon\RuntimeBroker.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1308
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JhLzHEla3w.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3500
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:4384
        
        C:\providercommon\RuntimeBroker.exe
        
        "C:\providercommon\RuntimeBroker.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1908
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\q2cXKRfm9B.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:776
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:1216
        
        C:\providercommon\RuntimeBroker.exe
        
        "C:\providercommon\RuntimeBroker.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4196
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\X9PDuMdk3a.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4540
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:4312
        
        C:\providercommon\RuntimeBroker.exe
        
        "C:\providercommon\RuntimeBroker.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2380
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QUR8LTwG0H.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:3640
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:3284
        
        C:\providercommon\RuntimeBroker.exe
        
        "C:\providercommon\RuntimeBroker.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:64
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\n6bUdMbtqP.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:4516
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:4384
        
        C:\providercommon\RuntimeBroker.exe
        
        "C:\providercommon\RuntimeBroker.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4284
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4oJokgKWVw.bat"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:5092
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2680
        
        C:\providercommon\RuntimeBroker.exe
        
        "C:\providercommon\RuntimeBroker.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4856
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VDNADHaqjn.bat"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:3576
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:1996
        
        C:\providercommon\RuntimeBroker.exe
        
        "C:\providercommon\RuntimeBroker.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4920
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\f70LHM7oRz.bat"
        21⤵
        
        PID:2248
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:1456
        
        C:\providercommon\RuntimeBroker.exe
        
        "C:\providercommon\RuntimeBroker.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3340
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JhLzHEla3w.bat"
        23⤵
        
        PID:1388
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:4420
        
        C:\providercommon\RuntimeBroker.exe
        
        "C:\providercommon\RuntimeBroker.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4560
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GRgsn2v6O3.bat"
        25⤵
        
        PID:3784
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:3452
        
        C:\providercommon\RuntimeBroker.exe
        
        "C:\providercommon\RuntimeBroker.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2488
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SQTB2Yz9K3.bat"
        27⤵
        
        PID:4468
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:2600
        
        C:\providercommon\RuntimeBroker.exe
        
        "C:\providercommon\RuntimeBroker.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4628
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jFXOGCU6Cq.bat"
        29⤵
        
        PID:3408
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:1624
        
        C:\providercommon\RuntimeBroker.exe
        
        "C:\providercommon\RuntimeBroker.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1540
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qtVTp5BaF9.bat"
        31⤵
        
        PID:4536
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        32⤵
        
        PID:3916
        
        C:\providercommon\RuntimeBroker.exe
        
        "C:\providercommon\RuntimeBroker.exe"
        32⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\providercommon\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Temp\4oJokgKWVw.bat

Filesize
200B

MD5
91c60854c73ce80b2371074bbba50e97

SHA1
e536e37400d0c04d59433fbb275cc7c46c65abc3

SHA256
64b49b863b30fbb5e2788e694dee14bf8864acd302950bfce4e84a9a5fcf5e20

SHA512
6c8f912f3db083e72903358d3853a0b6bb615bf6286a8f644ad860902fa3b6b639b4d88bc850df22f37485538c6c3fbdd4178b8939e9d13b76734c861e6bd14b

Download Submit
C:\Users\Admin\AppData\Local\Temp\GRgsn2v6O3.bat

Filesize
200B

MD5
52bd0f3b27faff733d99b4a172f05fa2

SHA1
67b700ccfbcfd7c8025aa1a44b959b54d3ac5cc8

SHA256
7647e02cfa6de5911653759013056d66c7a396fdc9e83760575f2ecff29e068c

SHA512
cd788451911f87d68333fe1d833567fed755b31652824b8c48152d0f6fe5bab9173f219c5c9c6efb854e44b6e828e87eabb20846247f413925a09f20c69cd4f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\JhLzHEla3w.bat

Filesize
200B

MD5
47cec33bfd9b4cae2a442f12e0bf99c5

SHA1
63fded563d28737e4007850657a36b2a287866bf

SHA256
b869d46073512930ffc8781ede12c7592c67649e9d662dbcd207025efe6713cc

SHA512
35f0dc949326a379d85d7d71d41270f1a5e44d0fdc6e41c34d971d5b73e5fc6bd29d266bde13abbb6ca6509c27f90b01ed68936689ebabded77e9ea0feac15c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\QUR8LTwG0H.bat

Filesize
200B

MD5
86bb696da623e25efba3efbfd5022b25

SHA1
44bd011ab6ac72e135a53664ad31046bf67a4bea

SHA256
d9497c12bcb9e1c402df8f8c2f37075d881993a43ba17c35323402800f959a4f

SHA512
d9f9b9b3ab4a4a839ae060c41a19fc73f93ff2a73f0524bbb7092b5784f325de4b767a6474ef6af9c31483771f6f27802de54e6aa196be8d6b281bdb145fd372

Download Submit
C:\Users\Admin\AppData\Local\Temp\SQTB2Yz9K3.bat

Filesize
200B

MD5
f426ec7df6ec494a77d4a60c300077de

SHA1
291b6e45c7a8d504e81c083593fa621c50e2569c

SHA256
b4c66bf64fb72685c2fde966bf133e6e45bd19371c46b5b0c8d185a9087fb1c6

SHA512
d839b132f20521f9e8163a00d1a04e315f451fce924fa106248098d3649ce89e34845d43e481f55333aa336a1a87638aedf3e90be242128e8c7b08d636601304

Download Submit
C:\Users\Admin\AppData\Local\Temp\VDNADHaqjn.bat

Filesize
200B

MD5
4403c447b3e160cffb0023ba6fb23029

SHA1
b2465e2cefafb34e56ee58d51ba1ed7340fb1c1e

SHA256
f8bfde86bbaa4cb1032876718e23fe34559ca7ec35dad6f00ed94104e67b0e95

SHA512
ee235f7ab74026aadd73476618c0947a8b5ee4a797ecf0882713e45bf033655fb866225de0700be1f8c57b7dd9a79b4bdd36efde580f366cd193baa43870e88a

Download Submit
C:\Users\Admin\AppData\Local\Temp\X9PDuMdk3a.bat

Filesize
200B

MD5
16aeb170dd3d8bf2c56698f209293305

SHA1
73c841a37789ed9d94ecb01688918f8a45c2d5ba

SHA256
12ab56d07042be60199fc2dd67097d6c0b8346f52edd0d329e8c608a5f840745

SHA512
7643bb10a4bcbe5607535fb7161bca36e98e8c2335fce6fcf0825a76d20bb42e206a6050f55d42aec265244909486f6ea53bfa7e443f9af9ac06a4056a6c2019

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_djunir4w.aj3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\daHDUzbFiW.bat

Filesize
200B

MD5
37d9bb281a16d9557f8e2fdd7bee7c70

SHA1
fbb4ca94c699eb139dc5b72330968603bdc09303

SHA256
03aabbf7e2fa4e081d8481999a06ec42122b5ed51a08b951e9151f47dfdb50df

SHA512
46df7ad36766626a006fd31fb459761ac43456b53781f032ae13ca9e832c2cc46c0bf458cf58400db6a508baebb55ef6f1440364d4a7e3371b795a5095730e8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\f70LHM7oRz.bat

Filesize
200B

MD5
119c3717ba8300474a95a7a984e2674c

SHA1
3b88ef8926f9df7e8abe5492fa35990a9fa6c153

SHA256
3496e5bfeef70e4cc20e0ff902a2e7d6717f95eb5bbeed9de96a9a9642801501

SHA512
610f66cc3c3c8de2327ae7be6d805c70954f6c56d2b706676939ac507b14ce646fdfe9c9650badb342ec81f54fe4c16b368ee7d04cff80c21e30808f19459925

Download Submit
C:\Users\Admin\AppData\Local\Temp\jFXOGCU6Cq.bat

Filesize
200B

MD5
4cf8eb85986fb53d56e362e9142c24fa

SHA1
b846ab345d3f33fdfc7bf6f4ced407784882c4db

SHA256
a468e00f7cd7703649baac03664d624189089adaa2efd356e789329c82891b1b

SHA512
da8a77a76619d69dd565894717aa91472eec7bf96b36865309c4be8f417cee2bfd882b8884186cfe4e74c84348bd4743aad31f437450dcf0203ec033db6673b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\n6bUdMbtqP.bat

Filesize
200B

MD5
aa4835d93aecb4eb53e6da1426ff0169

SHA1
ef9c6702ce44b0d9914b7cf8147804769358e2a9

SHA256
58b45c3e0a77f2ab9c088d8527149aa852ee2954020503e606222c6094210a8f

SHA512
a1e097673f7593e3135ededf8df6f254e6297ab800c6c52886ebbb920148e56629dc2fcf153bfd0520ef4967067de65e657a79a6e7d3663737e308010a8356b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\q2cXKRfm9B.bat

Filesize
200B

MD5
fdc924c76f57a027af83c4627a0c1e67

SHA1
6b21d7566d9b8ef1ce475981050682a3f23c3e5a

SHA256
cc7473453a45251fca7cd5114a6a23f0bb6ba1ec8ff03bf985291783553e1df2

SHA512
7a773c933a52b18c1241e96b7c5de38bedbae65b13c0a6fb7e6407bb4a7c6e16257550b921a14e52246b65780e5ffe175c0ff73e961ad43612abf15642634acb

Download Submit
C:\Users\Admin\AppData\Local\Temp\qtVTp5BaF9.bat

Filesize
200B

MD5
5a9245f5aa00171d6619a4ca1fbca761

SHA1
d6d890d0cbada3c21322bb5c095f2060e7a0564d

SHA256
1736b4ad773141b904c7bdf4da9cfe04186c9e540c18c3130c830fef8177f934

SHA512
f4849867638e9c2fa28d0e8d6031f38db8b1f1b597a518f9842e40ff43228a5c450a5ab846c4ee4c3b45f99c08f247b9ba0eed31fd6f718cd63dcb472d67cf71

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/64-93-0x00000000015F0000-0x0000000001602000-memory.dmp

Filesize
72KB

Download
memory/1308-66-0x00000000017F0000-0x0000000001802000-memory.dmp

Filesize
72KB

Download
memory/2092-31-0x00000160F0AD0000-0x00000160F0AF2000-memory.dmp

Filesize
136KB

Download
memory/2488-131-0x000000001ADF0000-0x000000001AE02000-memory.dmp

Filesize
72KB

Download
memory/2684-17-0x0000000002580000-0x000000000258C000-memory.dmp

Filesize
48KB

Download
memory/2684-16-0x0000000002570000-0x000000000257C000-memory.dmp

Filesize
48KB

Download
memory/2684-15-0x0000000002550000-0x000000000255C000-memory.dmp

Filesize
48KB

Download
memory/2684-14-0x0000000002540000-0x0000000002552000-memory.dmp

Filesize
72KB

Download
memory/2684-13-0x0000000000370000-0x0000000000480000-memory.dmp

Filesize
1.1MB

Download
memory/2684-12-0x00007FFC0F873000-0x00007FFC0F875000-memory.dmp

Filesize
8KB

Download
memory/3340-118-0x000000001BDF0000-0x000000001BE02000-memory.dmp

Filesize
72KB

Download