dcrat | b604a57136881d404989406c7efc8698ceb58a5c5c334497cd1ce40bdca92a50

Analysis

max time kernel
146s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 21:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_b604a57136881d404989406c7efc8698ceb58a5c5c334497cd1ce40bdca92a50.exe
Size

1.3MB
MD5

cc790fad68cc9186b68e5da8b6f251d2
SHA1

eac85a758a9f9eddad78302f95a0dd23d8c152a0
SHA256

b604a57136881d404989406c7efc8698ceb58a5c5c334497cd1ce40bdca92a50
SHA512

44b52626aa56df0234c84ab5d4e3683035ee42a28f872533dd30f0612e2e82efb15368ed6451d1032b17e00c3c1f0b4ed61e594f6d58d388d6637a34d105f83f
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	2768	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	2768	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	2768	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	2768	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	2768	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	2768	schtasks.exe	34

DCRat payload 10 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016d0e-9.dat	dcrat
behavioral1/memory/2072-13-0x0000000000190000-0x00000000002A0000-memory.dmp	dcrat
behavioral1/memory/1812-45-0x00000000013E0000-0x00000000014F0000-memory.dmp	dcrat
behavioral1/memory/2860-163-0x00000000000C0000-0x00000000001D0000-memory.dmp	dcrat
behavioral1/memory/3048-223-0x0000000000A80000-0x0000000000B90000-memory.dmp	dcrat
behavioral1/memory/2084-284-0x0000000001330000-0x0000000001440000-memory.dmp	dcrat
behavioral1/memory/2056-345-0x0000000000010000-0x0000000000120000-memory.dmp	dcrat
behavioral1/memory/2500-406-0x00000000009C0000-0x0000000000AD0000-memory.dmp	dcrat
behavioral1/memory/2016-466-0x0000000000C20000-0x0000000000D30000-memory.dmp	dcrat
behavioral1/memory/2248-585-0x00000000003F0000-0x0000000000500000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1932	powershell.exe
2536	powershell.exe
2592	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2072	DllCommonsvc.exe
1812	cmd.exe
2480	cmd.exe
2860	cmd.exe
3048	cmd.exe
2084	cmd.exe
2056	cmd.exe
2500	cmd.exe
2016	cmd.exe
1792	cmd.exe
2248	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
2820	cmd.exe
2820	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
21	raw.githubusercontent.com
28	raw.githubusercontent.com
31	raw.githubusercontent.com
5	raw.githubusercontent.com
12	raw.githubusercontent.com
15	raw.githubusercontent.com
25	raw.githubusercontent.com
4	raw.githubusercontent.com
9	raw.githubusercontent.com
18	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_b604a57136881d404989406c7efc8698ceb58a5c5c334497cd1ce40bdca92a50.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1980	schtasks.exe
2692	schtasks.exe
2632	schtasks.exe
2708	schtasks.exe
2796	schtasks.exe
2360	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2072	DllCommonsvc.exe
2536	powershell.exe
1932	powershell.exe
2592	powershell.exe
1812	cmd.exe
2480	cmd.exe
2860	cmd.exe
3048	cmd.exe
2084	cmd.exe
2056	cmd.exe
2500	cmd.exe
2016	cmd.exe
1792	cmd.exe
2248	cmd.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2072	DllCommonsvc.exe
Token: SeDebugPrivilege	2536	powershell.exe
Token: SeDebugPrivilege	1932	powershell.exe
Token: SeDebugPrivilege	2592	powershell.exe
Token: SeDebugPrivilege	1812	cmd.exe
Token: SeDebugPrivilege	2480	cmd.exe
Token: SeDebugPrivilege	2860	cmd.exe
Token: SeDebugPrivilege	3048	cmd.exe
Token: SeDebugPrivilege	2084	cmd.exe
Token: SeDebugPrivilege	2056	cmd.exe
Token: SeDebugPrivilege	2500	cmd.exe
Token: SeDebugPrivilege	2016	cmd.exe
Token: SeDebugPrivilege	1792	cmd.exe
Token: SeDebugPrivilege	2248	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1624	2008	JaffaCakes118_b604a57136881d404989406c7efc8698ceb58a5c5c334497cd1ce40bdca92a50.exe	30
PID 2008 wrote to memory of 1624	2008	JaffaCakes118_b604a57136881d404989406c7efc8698ceb58a5c5c334497cd1ce40bdca92a50.exe	30
PID 2008 wrote to memory of 1624	2008	JaffaCakes118_b604a57136881d404989406c7efc8698ceb58a5c5c334497cd1ce40bdca92a50.exe	30
PID 2008 wrote to memory of 1624	2008	JaffaCakes118_b604a57136881d404989406c7efc8698ceb58a5c5c334497cd1ce40bdca92a50.exe	30
PID 1624 wrote to memory of 2820	1624	WScript.exe	31
PID 1624 wrote to memory of 2820	1624	WScript.exe	31
PID 1624 wrote to memory of 2820	1624	WScript.exe	31
PID 1624 wrote to memory of 2820	1624	WScript.exe	31
PID 2820 wrote to memory of 2072	2820	cmd.exe	33
PID 2820 wrote to memory of 2072	2820	cmd.exe	33
PID 2820 wrote to memory of 2072	2820	cmd.exe	33
PID 2820 wrote to memory of 2072	2820	cmd.exe	33
PID 2072 wrote to memory of 2536	2072	DllCommonsvc.exe	41
PID 2072 wrote to memory of 2536	2072	DllCommonsvc.exe	41
PID 2072 wrote to memory of 2536	2072	DllCommonsvc.exe	41
PID 2072 wrote to memory of 2592	2072	DllCommonsvc.exe	42
PID 2072 wrote to memory of 2592	2072	DllCommonsvc.exe	42
PID 2072 wrote to memory of 2592	2072	DllCommonsvc.exe	42
PID 2072 wrote to memory of 1932	2072	DllCommonsvc.exe	43
PID 2072 wrote to memory of 1932	2072	DllCommonsvc.exe	43
PID 2072 wrote to memory of 1932	2072	DllCommonsvc.exe	43
PID 2072 wrote to memory of 988	2072	DllCommonsvc.exe	47
PID 2072 wrote to memory of 988	2072	DllCommonsvc.exe	47
PID 2072 wrote to memory of 988	2072	DllCommonsvc.exe	47
PID 988 wrote to memory of 2880	988	cmd.exe	49
PID 988 wrote to memory of 2880	988	cmd.exe	49
PID 988 wrote to memory of 2880	988	cmd.exe	49
PID 988 wrote to memory of 1812	988	cmd.exe	50
PID 988 wrote to memory of 1812	988	cmd.exe	50
PID 988 wrote to memory of 1812	988	cmd.exe	50
PID 1812 wrote to memory of 340	1812	cmd.exe	52
PID 1812 wrote to memory of 340	1812	cmd.exe	52
PID 1812 wrote to memory of 340	1812	cmd.exe	52
PID 340 wrote to memory of 1736	340	cmd.exe	54
PID 340 wrote to memory of 1736	340	cmd.exe	54
PID 340 wrote to memory of 1736	340	cmd.exe	54
PID 340 wrote to memory of 2480	340	cmd.exe	55
PID 340 wrote to memory of 2480	340	cmd.exe	55
PID 340 wrote to memory of 2480	340	cmd.exe	55
PID 2480 wrote to memory of 2560	2480	cmd.exe	56
PID 2480 wrote to memory of 2560	2480	cmd.exe	56
PID 2480 wrote to memory of 2560	2480	cmd.exe	56
PID 2560 wrote to memory of 1100	2560	cmd.exe	58
PID 2560 wrote to memory of 1100	2560	cmd.exe	58
PID 2560 wrote to memory of 1100	2560	cmd.exe	58
PID 2560 wrote to memory of 2860	2560	cmd.exe	59
PID 2560 wrote to memory of 2860	2560	cmd.exe	59
PID 2560 wrote to memory of 2860	2560	cmd.exe	59
PID 2860 wrote to memory of 1116	2860	cmd.exe	60
PID 2860 wrote to memory of 1116	2860	cmd.exe	60
PID 2860 wrote to memory of 1116	2860	cmd.exe	60
PID 1116 wrote to memory of 2812	1116	cmd.exe	62
PID 1116 wrote to memory of 2812	1116	cmd.exe	62
PID 1116 wrote to memory of 2812	1116	cmd.exe	62
PID 1116 wrote to memory of 3048	1116	cmd.exe	63
PID 1116 wrote to memory of 3048	1116	cmd.exe	63
PID 1116 wrote to memory of 3048	1116	cmd.exe	63
PID 3048 wrote to memory of 1708	3048	cmd.exe	64
PID 3048 wrote to memory of 1708	3048	cmd.exe	64
PID 3048 wrote to memory of 1708	3048	cmd.exe	64
PID 1708 wrote to memory of 1668	1708	cmd.exe	66
PID 1708 wrote to memory of 1668	1708	cmd.exe	66
PID 1708 wrote to memory of 1668	1708	cmd.exe	66
PID 1708 wrote to memory of 2084	1708	cmd.exe	67

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b604a57136881d404989406c7efc8698ceb58a5c5c334497cd1ce40bdca92a50.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b604a57136881d404989406c7efc8698ceb58a5c5c334497cd1ce40bdca92a50.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2072
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2536
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2592
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1932
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hK16ZrMtBk.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:988
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2880
      - C:\providercommon\cmd.exe
        
        "C:\providercommon\cmd.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1812
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7C7JiPLtAl.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:340
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1736
        
        C:\providercommon\cmd.exe
        
        "C:\providercommon\cmd.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2480
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\V68XQM6FdC.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2560
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:1100
        
        C:\providercommon\cmd.exe
        
        "C:\providercommon\cmd.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2860
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kyAhxuXJBD.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1116
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2812
        
        C:\providercommon\cmd.exe
        
        "C:\providercommon\cmd.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3048
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5fBkFKqKat.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:1668
        
        C:\providercommon\cmd.exe
        
        "C:\providercommon\cmd.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2084
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hGj9C4kLBH.bat"
        15⤵
        
        PID:2568
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2484
        
        C:\providercommon\cmd.exe
        
        "C:\providercommon\cmd.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2056
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eON2Ze4cSc.bat"
        17⤵
        
        PID:2028
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2264
        
        C:\providercommon\cmd.exe
        
        "C:\providercommon\cmd.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2500
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Mw1PlbJmoj.bat"
        19⤵
        
        PID:1440
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:1476
        
        C:\providercommon\cmd.exe
        
        "C:\providercommon\cmd.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2016
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kXH0MsH7jV.bat"
        21⤵
        
        PID:2220
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:1784
        
        C:\providercommon\cmd.exe
        
        "C:\providercommon\cmd.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1792
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cLz7lFEPwa.bat"
        23⤵
        
        PID:2828
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2992
        
        C:\providercommon\cmd.exe
        
        "C:\providercommon\cmd.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\providercommon\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\providercommon\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7375a87d6df534db3916dc56da821ad1

SHA1
b98f2c10a1245ea8b33b3f2778333e8211251f9c

SHA256
a9ae7d02d2676e1e9b90a93fb56a7272f844e316a87f0fea451102cd0f6bdf9f

SHA512
30ca685d2ff8d65d31fefcba14dbbc9b99e6fcef0d1d44bd9a63adcfb9fe5ae039f1dead29c635558fd3540900332124d84ba92d7a98a8f23a3ff242d3147712

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4a0f64980ecc4a6889cefb72f37d59c

SHA1
fb952e0386df4d9551582621b180872302afb176

SHA256
e81c6fc38d19641bd599909307f45c1afcdeb21b6721d1833df39b5b736cf876

SHA512
5f0da4dd1522b0e5f6a9b6ec74321654f1ce5d4e7956e9989906bce59810735d3da96672b520cc17c950cc6a72de85dcc8fca6ec3d3902770b92a2287211886c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
145e1f5b474b07e1fa109ea8b26c0606

SHA1
638c1534fb426e17b81e8504612f6cfa7fb42a59

SHA256
6503fa9798605ed85134d2b05a8e3f80a8934a196227f08165d50c4206e8edf6

SHA512
9292aaffb5236b32e27da74ec638788224dd07333789e30cc9f8fbca906b7e4cc22677c0cf3e56b45d5a1b8fe6111177c750b37ab18c4f643b34ee5789d56bbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e542ba8a219877d1afcb2bfa19b6eb3

SHA1
7a652b31e33a9d32243af24ae1e328dcea35cbe5

SHA256
0be8887ed9c7a5fdf46fbc3e84b94db7f374934bf52d71d0e13630f86ad18923

SHA512
8a507cd54f612a4f85807d3f5ba8fbf5c7b3140ff42fb2489f3d06dc766ef024671aff947b8ea24bf2d118c45b732a46150384ee3ccbfe6791b3be3f5b243bf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f00b5809dda9bb4eb9f3fd2eca977d4

SHA1
a6491c9e299c5e280aa5a3a529dc369feff288ce

SHA256
9ee11a73d5a1d06ee8c573f525c59ef37f60c005b5989184b8ae0276a0d8c148

SHA512
f3285affc89d02d7f5d29edce76fd62d49691cc04dd8d5ea38c00a61788192b897ba540f45a65d7702f1b50cb41e995f302b155eaba62af7613c0217a9f4a9a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d07bbe45dcb9b376dd42994cdf3df42

SHA1
273c09f3738c5b3b0b0ace188f651937e239a3d8

SHA256
53b0b3f5eaa8a0ad4e5c7d5ff1365fb5dcf03f599e7940a0378d900e8d97f04a

SHA512
d841830d0381c952f3e4e87a3a18e57c3f5e78449eab3e9139785cae459e4a91aaad31e8fb7b669e209e2a9c84e5bb3d10c272bf319c430378710a9b75cfb53d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d32a694609b5e7ed79c0500d98be067

SHA1
6476a3398cec354acdb9e88f50850ad717f3cf88

SHA256
e7aa167927c35a00c7922e61ae54f9616d4229e4a139e8a2357a691881825b79

SHA512
8f15136dc49061fc61a5b7923a704e7db3909e82251d340c5bab35b035cb7529519744d3604078e3395269bc29e6844bacb0a4b705bde2f102e04cb40f512b98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3020d700f339998036e1cd3ce69c1565

SHA1
4f5925fd75a64554df5adf35041a528bdc851289

SHA256
9140a03d5d812b9a223f5acdc4113b348e1c0dd365f041f4612b97a97a7ed7ad

SHA512
51c1b5f392c992236cb99df9a8de369e3f7095cce525261294330739b973ba9766bd170e799dafae929f717f1718135741bcdac319eafc7cb053c6badac6aabc

Download Submit
C:\Users\Admin\AppData\Local\Temp\5fBkFKqKat.bat

Filesize
190B

MD5
d4e0ac75a917ff4fc3fd91c2fdc11fbd

SHA1
486e937dbcfba1769dc2d3af630a7a30a35f37c8

SHA256
b94b47371550a8c6146c0bb92da418e264d3bdd14e0d7a258a53a3a542b97eaf

SHA512
e4225e315bf3e7db955d9941a30d521d9c94eabd7eb64e9b520070be5036b79a33a71b1a3f45531d8c504527c08c816aa4d4a7c68cc5e1d3dc900b3217f42cff

Download Submit
C:\Users\Admin\AppData\Local\Temp\7C7JiPLtAl.bat

Filesize
190B

MD5
ca05d74188858adf5a0705bc1496ccaf

SHA1
936945cb1e7eb875b777c29c17cb448da99173cc

SHA256
84744cc58571a55653efe820435f5499db89123f5fcf2f90683768f5abe2e749

SHA512
ac45c047a2782bc9348c5df2d61b5127830f6efc29f1229800470eda67ed7719ee588c48874a0c677b493e0d12dd9f208857bfe7d2b836e870c2b93d2d6e495a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD2DB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mw1PlbJmoj.bat

Filesize
190B

MD5
81dcf8c1dd30265d885017d7e19da73b

SHA1
a0d19ed25e92d233a979d922f22afc6ad2a12318

SHA256
0d0abadabd715359162d05aa1cdee51b1054ab3211f3d4e9f60a96411bf5a39b

SHA512
f17acd24baafbce973956ecf2c13ab6a0e1516b7c1e44655cadd9d338b496da3285acffd12fb39c5fd51beb8aee001cdf5cb74eb742ef17668cbc4bd85d52d79

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD2FD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\V68XQM6FdC.bat

Filesize
190B

MD5
de8efda50074d64bb6689763a47e7eb5

SHA1
0a2d4770610a2c2e788841380f2665736f8d3db4

SHA256
4e858d27fcc8bad18e6b540da294d07c1fb05044ebb04741d757931d212d9204

SHA512
06ee5d7d6a6948fa8d4b7f58959bc09f594dff8bedf7426902c999da69206c5c9a0d91a102b3cb4472d7dc53e378e2f038f78e02cc568e0d48afb4b868196161

Download Submit
C:\Users\Admin\AppData\Local\Temp\cLz7lFEPwa.bat

Filesize
190B

MD5
764aaa647535a40554fe864d660374f3

SHA1
dd00dc7ac8264c664a83d260dcc12801a44f21fa

SHA256
0c1493e43f7c131505d5d968c17219518bf2d39df8bc0b96387d9d06a1af95c5

SHA512
a25b098d4d92118add70ac4dcea7df10d6d5092835c9bb3fcdd8d3532b6a8c391ad8d83e1d799eddd99dfc79ff54ee54be3cdaf5bf695e90a232e7c2171e3d0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\eON2Ze4cSc.bat

Filesize
190B

MD5
969d2325d160a607c68ed19f9f56c69f

SHA1
17ad5e4704c0c6abfed30a6f824296a5bb28ad70

SHA256
aa7574325e44ecd9c5eda466cf04ad3ba1d98d4b89f0160bdc4dac5d3a714566

SHA512
3735ff6b9cb0863c2703386a036686cb8bd926c36196d67d8fde1820b6d48d5dc8570254efceb6753aa828f87323b83bad3984e568d25fb0bd377f9127b5cd1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\hGj9C4kLBH.bat

Filesize
190B

MD5
9701b946fbb0778b0caffb81f9cbff93

SHA1
bc722415799476f7f3b2f6f397d5f53e7b82c6c9

SHA256
837056edc87970ca78ab8600dfde2d4d0e0e5e1acdbd749786cfa46e92af13e9

SHA512
b1bcd21006df89d584bbce70b963e41ca25ad7abe7cebc03553012ec01011f39b84f47503fb4666b1cf9c6ac7e131403a27458822adb957036248478173ac46f

Download Submit
C:\Users\Admin\AppData\Local\Temp\hK16ZrMtBk.bat

Filesize
190B

MD5
603d71c537ffd76cd4068385a5f3d382

SHA1
2a96a4387483cb56f4c18cc7d926e3d0648a6dde

SHA256
cfc7bda12b0fe1995d0dc25696830a21b9fbd2dc4a2629da2060465418af9bdc

SHA512
f55b8dc3a52289e1c0e6c7c1be4c61bea044c63d049579bdcfc01d35251fd156201dde01b11feaf58a6c4511c4e433ecc19d838d68dd98a74b61e9cbf0c3a95f

Download Submit
C:\Users\Admin\AppData\Local\Temp\kXH0MsH7jV.bat

Filesize
190B

MD5
4abe3041dc3ee0f80c5d112e07252ea9

SHA1
a311cf4fc347859122eb0a830807ef68ca8856f1

SHA256
7b60c53ad4c7e917a2fbbc733b0bee6d666960447568240f3ea9f8b0bbededfe

SHA512
b46cdc0f2235e9d310fb8dbe4bddbba95fdcfbe4e5a545a23dcd35b09cbfaf9d7fdc26851e6e1cf1b9413243fdfe9b2567dbc3ecebda6c78ba5771b9f30971f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\kyAhxuXJBD.bat

Filesize
190B

MD5
629a854b06b867f48233471782cf9169

SHA1
8ae147ae40a1720eac6de1130bc3eba75d9817cd

SHA256
848752864c190c076e6d4f0c8e8da502738655d592d28a2dccb2973235edee1f

SHA512
9b21ed86d0f0efa0ba08c037abe5ecce82a7367a6ba94538db6efbee7efbee61009c657c406a39a1946dc2a02df453d3df3991c265af8c5cb8204b8f9fdef3dc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\U99O7417PF7VIU8U7J6R.temp

Filesize
7KB

MD5
a37b3750b7943302fbb8252ab3f55849

SHA1
e116d4620ab9c7705192b330a9351e521ef354cd

SHA256
6de4664f3a5b2ab9a4dd947d542c04081108a81e402ec8cda9364cf37a7e60c3

SHA512
0393abb6d905241309b214ffbadd611d6a1f1f1873342bb7c2a673d234be87d2e69af03c2dd35a75c5c83c216c69ec850090cc4b3701ef588ce027ef4069ff85

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/1812-45-0x00000000013E0000-0x00000000014F0000-memory.dmp

Filesize
1.1MB

Download
memory/2016-466-0x0000000000C20000-0x0000000000D30000-memory.dmp

Filesize
1.1MB

Download
memory/2056-346-0x0000000000440000-0x0000000000452000-memory.dmp

Filesize
72KB

Download
memory/2056-345-0x0000000000010000-0x0000000000120000-memory.dmp

Filesize
1.1MB

Download
memory/2072-17-0x0000000000170000-0x000000000017C000-memory.dmp

Filesize
48KB

Download
memory/2072-13-0x0000000000190000-0x00000000002A0000-memory.dmp

Filesize
1.1MB

Download
memory/2072-14-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download
memory/2072-15-0x0000000000160000-0x000000000016C000-memory.dmp

Filesize
48KB

Download
memory/2072-16-0x0000000000150000-0x000000000015C000-memory.dmp

Filesize
48KB

Download
memory/2084-284-0x0000000001330000-0x0000000001440000-memory.dmp

Filesize
1.1MB

Download
memory/2084-285-0x00000000001E0000-0x00000000001F2000-memory.dmp

Filesize
72KB

Download
memory/2248-585-0x00000000003F0000-0x0000000000500000-memory.dmp

Filesize
1.1MB

Download
memory/2500-406-0x00000000009C0000-0x0000000000AD0000-memory.dmp

Filesize
1.1MB

Download
memory/2536-35-0x000000001B740000-0x000000001BA22000-memory.dmp

Filesize
2.9MB

Download
memory/2536-41-0x0000000001DF0000-0x0000000001DF8000-memory.dmp

Filesize
32KB

Download
memory/2860-163-0x00000000000C0000-0x00000000001D0000-memory.dmp

Filesize
1.1MB

Download
memory/3048-223-0x0000000000A80000-0x0000000000B90000-memory.dmp

Filesize
1.1MB

Download
memory/3048-224-0x0000000000430000-0x0000000000442000-memory.dmp

Filesize
72KB

Download