dcrat | 9c4b81fe156b9d9974e7296854a52e3c0bd9e6509e0d8a2161d7c611edaf1a4f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2025, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
{VKK+KODS}/vkk.exe
Size 653KB
Sample250101-ntp2qstmcx
SHA256 878683a67bb95a2a2917b57b9a737ae1f085fcb8950b212c3a28884abf9c1a34
MD5 91bd6c254ee87e5c67ec306277cd4aaa
SHA1 a7c343316582f0bbd25f23c6a082d0061f0e560b
SHA512 1159b53efc6bc16376504f87e4717ad630b094b3f33ae135409f27296ff2e2fc2e9f9aa21908c2789b7b094deafdbb247925a3691cb1a5bd1fc3a87fda9a7824
SSDEEP 12288:nRZ+IoG/n9IQxW3OBsegHibt32N7oqcLCf8VI3WYwSTdxjZQ:P2G/nvxW3Wu0t32VCk3WY1xju
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat discovery infostealer rat

Malware Config

Signatures

DcRat 63 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		3812	schtasks.exe
File created	C:\Program Files (x86)\Google\Temp\ea1d8f6d871115		BridgeMsDll.exe
		4780	schtasks.exe
		1236	schtasks.exe
		2688	schtasks.exe
		4252	schtasks.exe
		3684	schtasks.exe
		3856	schtasks.exe
		4848	schtasks.exe
		5104	schtasks.exe
		2000	schtasks.exe
		3420	schtasks.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\719767dc400ffa		BridgeMsDll.exe
		2656	schtasks.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\38384e6a620884		BridgeMsDll.exe
		1880	schtasks.exe
		5016	schtasks.exe
		2956	schtasks.exe
		4964	schtasks.exe
File created	C:\Windows\fr-FR\ebf1f9fa8afd6d		BridgeMsDll.exe
		2800	schtasks.exe
		996	schtasks.exe
		4092	schtasks.exe
		708	schtasks.exe
		2984	schtasks.exe
		1752	schtasks.exe
		1052	schtasks.exe
		844	schtasks.exe
		448	schtasks.exe
		5008	schtasks.exe
		3972	schtasks.exe
		516	schtasks.exe
		1248	schtasks.exe
		3240	schtasks.exe
		4556	schtasks.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\9e8d7a4ca61bd9		BridgeMsDll.exe
		2844	schtasks.exe
		624	schtasks.exe
		2004	schtasks.exe
		1072	schtasks.exe
		4548	schtasks.exe
		3936	schtasks.exe
		1432	schtasks.exe
File created	C:\Windows\RemotePackages\RemoteApps\6203df4a6bafc7		BridgeMsDll.exe
		3852	schtasks.exe
		1016	schtasks.exe
		2472	schtasks.exe
		4580	schtasks.exe
		628	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		vkk.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\886983d96e3d3e		BridgeMsDll.exe
		2888	schtasks.exe
File created	C:\Program Files\Windows NT\TableTextService\7a0fd90576e088		BridgeMsDll.exe
		1520	schtasks.exe
		2012	schtasks.exe
		3348	schtasks.exe
		4480	schtasks.exe
		1852	schtasks.exe
		1932	schtasks.exe
		1180	schtasks.exe
		1768	schtasks.exe
		4644	schtasks.exe
		3636	schtasks.exe

Dcrat family
dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3936	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	516	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3240	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	844	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1072	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3420	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	628	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3812	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1880	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4848	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3856	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3636	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3348	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4548	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1180	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1016	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1052	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1236	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	708	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5016	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	448	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3852	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4644	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5104	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	624	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	996	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3972	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4092	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2472	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4252	2840	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3684	2840	schtasks.exe	86

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral4/files/0x000a000000023b9f-10.dat	dcrat
behavioral4/memory/4464-13-0x0000000000470000-0x00000000004C6000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	vkk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	BridgeMsDll.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	BridgeMsDll.exe

Executes dropped EXE 3 IoCs

pid	Process
4464	BridgeMsDll.exe
1696	BridgeMsDll.exe
2124	sihost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Tasks\Microsoft\Windows\TaskScheduler\taskhostw.exe	BridgeMsDll.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\upfc.exe	BridgeMsDll.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\9e8d7a4ca61bd9	BridgeMsDll.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\BridgeMsDll.exe	BridgeMsDll.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\719767dc400ffa	BridgeMsDll.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\SearchApp.exe	BridgeMsDll.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\38384e6a620884	BridgeMsDll.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\csrss.exe	BridgeMsDll.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\upfc.exe	BridgeMsDll.exe
File created	C:\Program Files (x86)\Google\Temp\ea1d8f6d871115	BridgeMsDll.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe	BridgeMsDll.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\886983d96e3d3e	BridgeMsDll.exe
File created	C:\Program Files\Windows NT\TableTextService\explorer.exe	BridgeMsDll.exe
File created	C:\Program Files\Windows NT\TableTextService\7a0fd90576e088	BridgeMsDll.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\fr-FR\ebf1f9fa8afd6d	BridgeMsDll.exe
File created	C:\Windows\rescache\_merged\942976607\winlogon.exe	BridgeMsDll.exe
File created	C:\Windows\es-ES\WmiPrvSE.exe	BridgeMsDll.exe
File created	C:\Windows\InputMethod\CHS\c5b4cb5e9653cc	BridgeMsDll.exe
File created	C:\Windows\es-ES\24dbde2999530e	BridgeMsDll.exe
File created	C:\Windows\InputMethod\CHS\services.exe	BridgeMsDll.exe
File created	C:\Windows\fr-FR\cmd.exe	BridgeMsDll.exe
File created	C:\Windows\RemotePackages\RemoteApps\lsass.exe	BridgeMsDll.exe
File created	C:\Windows\RemotePackages\RemoteApps\6203df4a6bafc7	BridgeMsDll.exe
File opened for modification	C:\Windows\es-ES\WmiPrvSE.exe	BridgeMsDll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vkk.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	vkk.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	BridgeMsDll.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	BridgeMsDll.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
516	schtasks.exe
3812	schtasks.exe
2000	schtasks.exe
2956	schtasks.exe
1768	schtasks.exe
2012	schtasks.exe
448	schtasks.exe
4644	schtasks.exe
1752	schtasks.exe
1852	schtasks.exe
1236	schtasks.exe
1520	schtasks.exe
3240	schtasks.exe
996	schtasks.exe
2844	schtasks.exe
5008	schtasks.exe
1180	schtasks.exe
1016	schtasks.exe
4252	schtasks.exe
1072	schtasks.exe
1880	schtasks.exe
1052	schtasks.exe
844	schtasks.exe
4848	schtasks.exe
2800	schtasks.exe
2656	schtasks.exe
2688	schtasks.exe
624	schtasks.exe
3856	schtasks.exe
3852	schtasks.exe
5104	schtasks.exe
3684	schtasks.exe
3420	schtasks.exe
3636	schtasks.exe
4964	schtasks.exe
708	schtasks.exe
1432	schtasks.exe
4580	schtasks.exe
628	schtasks.exe
4780	schtasks.exe
4480	schtasks.exe
2472	schtasks.exe
4556	schtasks.exe
1932	schtasks.exe
1248	schtasks.exe
5016	schtasks.exe
3972	schtasks.exe
2888	schtasks.exe
2004	schtasks.exe
3936	schtasks.exe
2984	schtasks.exe
3348	schtasks.exe
4548	schtasks.exe
4092	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4464	BridgeMsDll.exe
4464	BridgeMsDll.exe
4464	BridgeMsDll.exe
4464	BridgeMsDll.exe
4464	BridgeMsDll.exe
4464	BridgeMsDll.exe
4464	BridgeMsDll.exe
1696	BridgeMsDll.exe
1696	BridgeMsDll.exe
1696	BridgeMsDll.exe
2124	sihost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4464	BridgeMsDll.exe
Token: SeDebugPrivilege	1696	BridgeMsDll.exe
Token: SeDebugPrivilege	2124	sihost.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 2672	4616	vkk.exe	82
PID 4616 wrote to memory of 2672	4616	vkk.exe	82
PID 4616 wrote to memory of 2672	4616	vkk.exe	82
PID 2672 wrote to memory of 3376	2672	WScript.exe	87
PID 2672 wrote to memory of 3376	2672	WScript.exe	87
PID 2672 wrote to memory of 3376	2672	WScript.exe	87
PID 3376 wrote to memory of 4464	3376	cmd.exe	89
PID 3376 wrote to memory of 4464	3376	cmd.exe	89
PID 4464 wrote to memory of 1132	4464	BridgeMsDll.exe	132
PID 4464 wrote to memory of 1132	4464	BridgeMsDll.exe	132
PID 1132 wrote to memory of 1976	1132	cmd.exe	134
PID 1132 wrote to memory of 1976	1132	cmd.exe	134
PID 1132 wrote to memory of 1696	1132	cmd.exe	138
PID 1132 wrote to memory of 1696	1132	cmd.exe	138
PID 1696 wrote to memory of 2636	1696	BridgeMsDll.exe	151
PID 1696 wrote to memory of 2636	1696	BridgeMsDll.exe	151
PID 2636 wrote to memory of 2948	2636	cmd.exe	153
PID 2636 wrote to memory of 2948	2636	cmd.exe	153
PID 2636 wrote to memory of 2124	2636	cmd.exe	154
PID 2636 wrote to memory of 2124	2636	cmd.exe	154

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\{VKK+KODS}\vkk.exe
"C:\Users\Admin\AppData\Local\Temp\{VKK+KODS}\vkk.exe"
1⤵
- DcRat
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Combrowser\Fcaxb7I9ITZe2hUWU.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Combrowser\10l79m1i778n.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3376
  - - C:\Combrowser\BridgeMsDll.exe
      "C:\Combrowser\BridgeMsDll.exe"
      4⤵
      DcRat
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4464
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4YI1pUcLXl.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1132
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1976
      - C:\Combrowser\BridgeMsDll.exe
        
        "C:\Combrowser\BridgeMsDll.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1696
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QgfazpYndg.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2636
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2948
        
        C:\Recovery\WindowsRE\sihost.exe
        
        "C:\Recovery\WindowsRE\sihost.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Google\Temp\upfc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\upfc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\Temp\upfc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Windows\fr-FR\cmd.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\fr-FR\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Windows\fr-FR\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Windows\RemotePackages\RemoteApps\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteApps\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Windows\RemotePackages\RemoteApps\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BridgeMsDllB" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\BridgeMsDll.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BridgeMsDll" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\es-ES\BridgeMsDll.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BridgeMsDllB" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\BridgeMsDll.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Combrowser\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Combrowser\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Combrowser\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Combrowser\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Combrowser\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Combrowser\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Combrowser\StartMenuExperienceHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Combrowser\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Combrowser\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BridgeMsDllB" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\BridgeMsDll.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BridgeMsDll" /sc ONLOGON /tr "'C:\Users\Default User\BridgeMsDll.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BridgeMsDllB" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\BridgeMsDll.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows NT\TableTextService\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows NT\TableTextService\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Windows\es-ES\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\es-ES\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Windows\es-ES\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Combrowser\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Combrowser\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Combrowser\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Windows\InputMethod\CHS\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\InputMethod\CHS\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Windows\InputMethod\CHS\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

10l79m1i778n.bat

Path C:\Combrowser\10l79m1i778n.bat
Size 31B
SHA256 0ef204e2c7f3c6d5ace003c6864db74cc2f085543409a3366af99a5f45823933
MD5 e229e6475655dbf48debe39ea7e4c0d0
SHA1 835a9dc7bd837e6096df8d97dff90ab88e656a41
SHA512 6aa3ae4bf881de134b54ca4e5f813ed380645091a51762046b41d47e56318a3970a5b4158d302fc887e0ccff41304050364acde8fcf0e126721e0eea1bc42b27
MD5 SHA1 SHA512

Submit Download

BridgeMsDll.exe

Path C:\Combrowser\BridgeMsDll.exe
Size 315KB
SHA256 ea420c16fb24ec295eca3c796d735a758bdc00071d233ff73ee841d56b4b004a
MD5 57566762e7d37fdeae9c4740f16f1b75
SHA1 e6d5a1055d1064569977dc54f5ba162348e2bebb
SHA512 0d94f11242de7f01804e9e35fd5f422be6bcc62a292d900aa708b01c74472e2bee20dfc682786c88dd26d97614d00b2fc5106b7557d4eff090487ca7032f8783
SSDEEP 6144:hVYy2oo7KUEZ08R5LCfSWIs5sVIO7xMW2D0770w5/45Jdxfbvr9u:h32N7oqcLCf8VI3WYwSTdxjZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fcaxb7I9ITZe2hUWU.vbe

Path C:\Combrowser\Fcaxb7I9ITZe2hUWU.vbe
Size 199B
SHA256 cb4216925fc61c39e18644995303fc6b6eedd4154ce6b10a6e42a71db8170101
MD5 75cec359961d378447f24b18efadc0c5
SHA1 9fec81fc93c8d8b17a4070057ec8e68da824c14d
SHA512 1f0f57c0a11485c656c49d8b897e101660775e8cd7c35c2cb302dabc9bd9024bfd173d7a938f733b12d30636715238325ea6fa4955e344822c512ff4ab030597
MD5 SHA1 SHA512

Submit Download

BridgeMsDll.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\BridgeMsDll.exe.log
Size 1KB
SHA256 519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900
MD5 7f3c0ae41f0d9ae10a8985a2c327b8fb
SHA1 d58622bf6b5071beacf3b35bb505bde2000983e3
SHA512 8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125
MD5 SHA1 SHA512

Submit Download

4YI1pUcLXl.bat

Path C:\Users\Admin\AppData\Local\Temp\4YI1pUcLXl.bat
Size 194B
SHA256 06e09b646921429bfccf71e93d304a23de7cc8c24d7736498b6cbf85f89c62bc
MD5 ec41c274a4f3a49e17f794ee89a362e4
SHA1 ce497b856988923a9e07d91c3252de2a6c6e28d5
SHA512 a8efb1cef3bb1343962b39ea2fef2156044f1f97ef4fd888dfeb0aaf28b78e217049fae73297de59c5a1bd91b2bc6122cd7525e16b1b9d7dbbb55b2e1f72d120
MD5 SHA1 SHA512

Submit Download

QgfazpYndg.bat

Path C:\Users\Admin\AppData\Local\Temp\QgfazpYndg.bat
Size 197B
SHA256 33c23391ad090ac3788b9ddb2488e14f58042c0d9101c13e1aef963a91e47556
MD5 2b23fd67f2c7aaa20943f8e4bfd51c90
SHA1 ebe81ade59ef24f71fb3481811d815c725adc00a
SHA512 07aedee442be6f81d069956a9b554bc5affa1b51edb146b347ae9d0d5a19521589be2d024464ab8c0a696cd703e93c70d7d02b9cdb39f227565aedd9a489a072
MD5 SHA1 SHA512

Submit Download

memory/4464-12-0x00007FFD99CD3000-0x00007FFD99CD5000-memory.dmp

Download

memory/4464-13-0x0000000000470000-0x00000000004C6000-memory.dmp

Download