dcrat | 8050f43862d93cfd709af334580335f642705ae15b4daaf16199bdc3a9ca037b

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 23:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Size

1.4MB
MD5

13aeda86aafde4051d7ca9280dac9a67
SHA1

fd4a6168c79c28d6e25be7c799ffd25c2dbd69d0
SHA256

01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111
SHA512

ddfc9a2a5a2f3b83023eecf4053de1930ebf9486d1cff869ab6d2199c5978926b2c4a6468358c627f4cff16a235c8d23b98711d8b3bf608ed03f4e4d7d7d0194
SSDEEP

24576:Lw/d/t+9SDGMoRNkj63uYnqzW1yqCc/CfVsdEYXHo1o9edFt4k:M/d/HP6+Ynb18Kfdx3IoIt

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\taskhostw.exe\", \"C:\\Users\\Default User\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Favorites\\sysmon.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\taskhostw.exe\", \"C:\\Users\\Default User\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Favorites\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\MusNotification.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\taskhostw.exe\", \"C:\\Users\\Default User\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Favorites\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\MusNotification.exe\", \"C:\\Windows\\Branding\\Basebrd\\es-ES\\OfficeClickToRun.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files\\7-Zip\\Lang\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\sysmon.exe\", \"C:\\Windows\\RemotePackages\\sysmon.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\dwm.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\taskhostw.exe\", \"C:\\Users\\Default User\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Favorites\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\MusNotification.exe\", \"C:\\Windows\\Branding\\Basebrd\\es-ES\\OfficeClickToRun.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files\\7-Zip\\Lang\\winlogon.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\taskhostw.exe\", \"C:\\Users\\Default User\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Favorites\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\MusNotification.exe\", \"C:\\Windows\\Branding\\Basebrd\\es-ES\\OfficeClickToRun.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files\\7-Zip\\Lang\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\sysmon.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\taskhostw.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\taskhostw.exe\", \"C:\\Users\\Default User\\Registry.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\taskhostw.exe\", \"C:\\Users\\Default User\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\taskhostw.exe\", \"C:\\Users\\Default User\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Favorites\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\taskhostw.exe\", \"C:\\Users\\Default User\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Favorites\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\MusNotification.exe\", \"C:\\Windows\\Branding\\Basebrd\\es-ES\\OfficeClickToRun.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\taskhostw.exe\", \"C:\\Users\\Default User\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Favorites\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\MusNotification.exe\", \"C:\\Windows\\Branding\\Basebrd\\es-ES\\OfficeClickToRun.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\taskhostw.exe\", \"C:\\Users\\Default User\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Favorites\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\MusNotification.exe\", \"C:\\Windows\\Branding\\Basebrd\\es-ES\\OfficeClickToRun.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files\\7-Zip\\Lang\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\sysmon.exe\", \"C:\\Windows\\RemotePackages\\sysmon.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	224	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3720	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4908	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4840	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	340	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3872	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	656	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3076	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	844	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3692	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	768	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4328	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4048	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4280	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3708	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3964	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4680	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4828	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3568	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3148	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2212	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3136	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	2600	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3760	2600	schtasks.exe	83

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2644-1-0x0000000000450000-0x00000000005B6000-memory.dmp	dcrat
behavioral2/files/0x000a000000023b8e-19.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe

Executes dropped EXE 1 IoCs

pid	Process
3252	sysmon.exe

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\WindowsRE\\wininit.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Program Files (x86)\\Windows NT\\Accessories\\sysmon.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Windows\\RemotePackages\\sysmon.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Users\\Admin\\taskhostw.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Users\\Default\\Favorites\\sysmon.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\dwm.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Users\\Default\\Favorites\\sysmon.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MusNotification = "\"C:\\Program Files (x86)\\Windows Sidebar\\MusNotification.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Program Files (x86)\\Windows NT\\Accessories\\sysmon.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MusNotification = "\"C:\\Program Files (x86)\\Windows Sidebar\\MusNotification.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Windows\\Branding\\Basebrd\\es-ES\\OfficeClickToRun.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Windows\\Branding\\Basebrd\\es-ES\\OfficeClickToRun.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files\\7-Zip\\Lang\\winlogon.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Users\\Admin\\taskhostw.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\Default User\\Registry.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files\\7-Zip\\Lang\\winlogon.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Windows\\RemotePackages\\sysmon.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\dwm.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\Default User\\Registry.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\WindowsRE\\wininit.exe\""	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Sidebar\MusNotification.exe	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
File created	C:\Program Files (x86)\Windows Sidebar\aa97147c4c782d	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\sysmon.exe	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\121e5b5079f7c0	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\6cb0b6c459d5d3	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\RuntimeBroker.exe	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\9e8d7a4ca61bd9	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
File created	C:\Program Files\7-Zip\Lang\winlogon.exe	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
File created	C:\Program Files\7-Zip\Lang\cc11b995f2a76d	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\dwm.exe	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\RemotePackages\121e5b5079f7c0	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
File created	C:\Windows\Speech\Common\backgroundTaskHost.exe	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
File created	C:\Windows\Branding\Basebrd\es-ES\OfficeClickToRun.exe	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
File created	C:\Windows\Branding\Basebrd\es-ES\e6c9b481da804f	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
File created	C:\Windows\RemotePackages\sysmon.exe	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
656	schtasks.exe
2020	schtasks.exe
4328	schtasks.exe
3568	schtasks.exe
2212	schtasks.exe
2816	schtasks.exe
2916	schtasks.exe
3760	schtasks.exe
3148	schtasks.exe
844	schtasks.exe
1476	schtasks.exe
1868	schtasks.exe
3708	schtasks.exe
4680	schtasks.exe
3136	schtasks.exe
2348	schtasks.exe
2028	schtasks.exe
2508	schtasks.exe
3964	schtasks.exe
3076	schtasks.exe
3692	schtasks.exe
3720	schtasks.exe
4908	schtasks.exe
3872	schtasks.exe
4048	schtasks.exe
1608	schtasks.exe
224	schtasks.exe
2008	schtasks.exe
4776	schtasks.exe
8	schtasks.exe
4840	schtasks.exe
2612	schtasks.exe
768	schtasks.exe
4280	schtasks.exe
4828	schtasks.exe
340	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2644	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
2644	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
2644	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
2644	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
2644	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
2644	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
2644	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
2644	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
2644	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
2644	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
2644	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
3252	sysmon.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2644	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
Token: SeDebugPrivilege	3252	sysmon.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 4676	2644	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe	120
PID 2644 wrote to memory of 4676	2644	01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe	120
PID 4676 wrote to memory of 4660	4676	cmd.exe	122
PID 4676 wrote to memory of 4660	4676	cmd.exe	122
PID 4676 wrote to memory of 3252	4676	cmd.exe	124
PID 4676 wrote to memory of 3252	4676	cmd.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe
"C:\Users\Admin\AppData\Local\Temp\01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mudJuAXQjT.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4660
- - C:\Users\Default\Favorites\sysmon.exe
    "C:\Users\Default\Favorites\sysmon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\Admin\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Favorites\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Default\Favorites\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Favorites\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Sidebar\MusNotification.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Sidebar\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Windows\Branding\Basebrd\es-ES\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\Branding\Basebrd\es-ES\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Windows\Branding\Basebrd\es-ES\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files\7-Zip\Lang\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files\7-Zip\Lang\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\Accessories\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows NT\Accessories\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Windows\RemotePackages\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\RemotePackages\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Windows\RemotePackages\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\WindowsRE\csrss.exe

Filesize
1.4MB

MD5
13aeda86aafde4051d7ca9280dac9a67

SHA1
fd4a6168c79c28d6e25be7c799ffd25c2dbd69d0

SHA256
01ef75f76ae452476b1de15a3238617f33c4b685e5bb423de49f34f44b0a0111

SHA512
ddfc9a2a5a2f3b83023eecf4053de1930ebf9486d1cff869ab6d2199c5978926b2c4a6468358c627f4cff16a235c8d23b98711d8b3bf608ed03f4e4d7d7d0194

Download Submit
C:\Users\Admin\AppData\Local\Temp\mudJuAXQjT.bat

Filesize
202B

MD5
762298add20f77cc9230ae485d4fafc1

SHA1
690622445cddf4808da0955bbfed435faba36244

SHA256
1b545475561a0c5b010e8ef67eb3c70a3ea934b122042d169de7dd0c9f3a69ec

SHA512
068009ead9432153dc01f99b23f957e003472ad2c7ae1b42f6de8b805c866d1f07761a81ef0571897e2185cb40163bf203c440283695e597e33756cfdf0d0a06

Download Submit
memory/2644-7-0x000000001B1B0000-0x000000001B1C0000-memory.dmp

Filesize
64KB

Download
memory/2644-3-0x0000000002750000-0x000000000275E000-memory.dmp

Filesize
56KB

Download
memory/2644-4-0x000000001B190000-0x000000001B1AC000-memory.dmp

Filesize
112KB

Download
memory/2644-6-0x000000001B710000-0x000000001B726000-memory.dmp

Filesize
88KB

Download
memory/2644-0-0x00007FFD35BC3000-0x00007FFD35BC5000-memory.dmp

Filesize
8KB

Download
memory/2644-5-0x000000001B760000-0x000000001B7B0000-memory.dmp

Filesize
320KB

Download
memory/2644-8-0x000000001B730000-0x000000001B742000-memory.dmp

Filesize
72KB

Download
memory/2644-9-0x000000001BE20000-0x000000001C348000-memory.dmp

Filesize
5.2MB

Download
memory/2644-10-0x000000001B7B0000-0x000000001B7B8000-memory.dmp

Filesize
32KB

Download
memory/2644-2-0x00007FFD35BC0000-0x00007FFD36681000-memory.dmp

Filesize
10.8MB

Download
memory/2644-40-0x00007FFD35BC0000-0x00007FFD36681000-memory.dmp

Filesize
10.8MB

Download
memory/2644-1-0x0000000000450000-0x00000000005B6000-memory.dmp

Filesize
1.4MB

Download