dcrat | 6bc67978f583db1ef99eb832b456c978b8c42a5233f9ed5810fed58455e6cd6f

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12-01-2025 02:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6bc67978f583db1ef99eb832b456c978b8c42a5233f9ed5810fed58455e6cd6f.exe
Size

1.8MB
MD5

092f45dac00ef24f3836dbfe18dfa931
SHA1

7583f7a96b649ff903b79615ac889fdd9c1fa94d
SHA256

6bc67978f583db1ef99eb832b456c978b8c42a5233f9ed5810fed58455e6cd6f
SHA512

a9ab5073a183f0a8994d805ac368f160775f899a0e1e9fe9a62ee4f6fd81d28ade5af06b5677cc5e13ffd0b5a54edd2c36576d5b44d88c6ffa3fc04bb4e64b78
SSDEEP

49152:IBJ3w9opl/yaOHkGiQzblm+WsfjEjCAX+fgnlaNkGy+Ms:yhUopl/CCQzxm+rf4um+fklaGFs

Score

10^/10

dcrat discovery evasion execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1692	powershell.exe
584	powershell.exe
1260	powershell.exe
1988	powershell.exe
736	powershell.exe
548	powershell.exe
1788	powershell.exe
776	powershell.exe
1104	powershell.exe
3036	powershell.exe
1636	powershell.exe
2044	powershell.exe
2756	powershell.exe
1160	powershell.exe
2200	powershell.exe
2152	powershell.exe
1044	powershell.exe
1420	powershell.exe

Disables Task Manager via registry modification
evasion

Executes dropped EXE 9 IoCs

pid	Process
2988	ComrefNetsvc.exe
2376	spoolsv.exe
2228	spoolsv.exe
2580	spoolsv.exe
2044	spoolsv.exe
2912	spoolsv.exe
2504	spoolsv.exe
956	spoolsv.exe
2568	spoolsv.exe

Loads dropped DLL 2 IoCs

pid	Process
1892	cmd.exe
1892	cmd.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Portable Devices\csrss.exe	ComrefNetsvc.exe
File opened for modification	C:\Program Files\Windows Portable Devices\csrss.exe	ComrefNetsvc.exe
File created	C:\Program Files\Windows Portable Devices\886983d96e3d3e	ComrefNetsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\dllhost.exe	ComrefNetsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\5940a34987c991	ComrefNetsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Vss\Writers\System\ComrefNetsvc.exe	ComrefNetsvc.exe
File created	C:\Windows\Vss\Writers\System\a47adf4e1da207	ComrefNetsvc.exe
File created	C:\Windows\ja-JP\spoolsv.exe	ComrefNetsvc.exe
File created	C:\Windows\ja-JP\f3b6ecef712a24	ComrefNetsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6bc67978f583db1ef99eb832b456c978b8c42a5233f9ed5810fed58455e6cd6f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2188	PING.EXE
1672	PING.EXE
1968	PING.EXE
1128	PING.EXE

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1684	reg.exe

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery

T1018

pid	Process
2188	PING.EXE
1672	PING.EXE
1968	PING.EXE
1128	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe
2988	ComrefNetsvc.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	2988	ComrefNetsvc.exe
Token: SeDebugPrivilege	1788	powershell.exe
Token: SeDebugPrivilege	2756	powershell.exe
Token: SeDebugPrivilege	2200	powershell.exe
Token: SeDebugPrivilege	1692	powershell.exe
Token: SeDebugPrivilege	1260	powershell.exe
Token: SeDebugPrivilege	1420	powershell.exe
Token: SeDebugPrivilege	1044	powershell.exe
Token: SeDebugPrivilege	736	powershell.exe
Token: SeDebugPrivilege	776	powershell.exe
Token: SeDebugPrivilege	548	powershell.exe
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeDebugPrivilege	584	powershell.exe
Token: SeDebugPrivilege	1636	powershell.exe
Token: SeDebugPrivilege	1104	powershell.exe
Token: SeDebugPrivilege	1988	powershell.exe
Token: SeDebugPrivilege	1160	powershell.exe
Token: SeDebugPrivilege	3036	powershell.exe
Token: SeDebugPrivilege	2152	powershell.exe
Token: SeDebugPrivilege	2376	spoolsv.exe
Token: SeDebugPrivilege	2228	spoolsv.exe
Token: SeDebugPrivilege	2580	spoolsv.exe
Token: SeDebugPrivilege	2044	spoolsv.exe
Token: SeDebugPrivilege	2912	spoolsv.exe
Token: SeDebugPrivilege	2504	spoolsv.exe
Token: SeDebugPrivilege	956	spoolsv.exe
Token: SeDebugPrivilege	2568	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2652	2736	6bc67978f583db1ef99eb832b456c978b8c42a5233f9ed5810fed58455e6cd6f.exe	30
PID 2736 wrote to memory of 2652	2736	6bc67978f583db1ef99eb832b456c978b8c42a5233f9ed5810fed58455e6cd6f.exe	30
PID 2736 wrote to memory of 2652	2736	6bc67978f583db1ef99eb832b456c978b8c42a5233f9ed5810fed58455e6cd6f.exe	30
PID 2736 wrote to memory of 2652	2736	6bc67978f583db1ef99eb832b456c978b8c42a5233f9ed5810fed58455e6cd6f.exe	30
PID 2652 wrote to memory of 1892	2652	WScript.exe	31
PID 2652 wrote to memory of 1892	2652	WScript.exe	31
PID 2652 wrote to memory of 1892	2652	WScript.exe	31
PID 2652 wrote to memory of 1892	2652	WScript.exe	31
PID 1892 wrote to memory of 1684	1892	cmd.exe	33
PID 1892 wrote to memory of 1684	1892	cmd.exe	33
PID 1892 wrote to memory of 1684	1892	cmd.exe	33
PID 1892 wrote to memory of 1684	1892	cmd.exe	33
PID 1892 wrote to memory of 2988	1892	cmd.exe	34
PID 1892 wrote to memory of 2988	1892	cmd.exe	34
PID 1892 wrote to memory of 2988	1892	cmd.exe	34
PID 1892 wrote to memory of 2988	1892	cmd.exe	34
PID 2988 wrote to memory of 2756	2988	ComrefNetsvc.exe	35
PID 2988 wrote to memory of 2756	2988	ComrefNetsvc.exe	35
PID 2988 wrote to memory of 2756	2988	ComrefNetsvc.exe	35
PID 2988 wrote to memory of 1420	2988	ComrefNetsvc.exe	36
PID 2988 wrote to memory of 1420	2988	ComrefNetsvc.exe	36
PID 2988 wrote to memory of 1420	2988	ComrefNetsvc.exe	36
PID 2988 wrote to memory of 1160	2988	ComrefNetsvc.exe	38
PID 2988 wrote to memory of 1160	2988	ComrefNetsvc.exe	38
PID 2988 wrote to memory of 1160	2988	ComrefNetsvc.exe	38
PID 2988 wrote to memory of 736	2988	ComrefNetsvc.exe	39
PID 2988 wrote to memory of 736	2988	ComrefNetsvc.exe	39
PID 2988 wrote to memory of 736	2988	ComrefNetsvc.exe	39
PID 2988 wrote to memory of 1636	2988	ComrefNetsvc.exe	40
PID 2988 wrote to memory of 1636	2988	ComrefNetsvc.exe	40
PID 2988 wrote to memory of 1636	2988	ComrefNetsvc.exe	40
PID 2988 wrote to memory of 2200	2988	ComrefNetsvc.exe	41
PID 2988 wrote to memory of 2200	2988	ComrefNetsvc.exe	41
PID 2988 wrote to memory of 2200	2988	ComrefNetsvc.exe	41
PID 2988 wrote to memory of 1988	2988	ComrefNetsvc.exe	42
PID 2988 wrote to memory of 1988	2988	ComrefNetsvc.exe	42
PID 2988 wrote to memory of 1988	2988	ComrefNetsvc.exe	42
PID 2988 wrote to memory of 1788	2988	ComrefNetsvc.exe	43
PID 2988 wrote to memory of 1788	2988	ComrefNetsvc.exe	43
PID 2988 wrote to memory of 1788	2988	ComrefNetsvc.exe	43
PID 2988 wrote to memory of 776	2988	ComrefNetsvc.exe	44
PID 2988 wrote to memory of 776	2988	ComrefNetsvc.exe	44
PID 2988 wrote to memory of 776	2988	ComrefNetsvc.exe	44
PID 2988 wrote to memory of 2152	2988	ComrefNetsvc.exe	46
PID 2988 wrote to memory of 2152	2988	ComrefNetsvc.exe	46
PID 2988 wrote to memory of 2152	2988	ComrefNetsvc.exe	46
PID 2988 wrote to memory of 3036	2988	ComrefNetsvc.exe	48
PID 2988 wrote to memory of 3036	2988	ComrefNetsvc.exe	48
PID 2988 wrote to memory of 3036	2988	ComrefNetsvc.exe	48
PID 2988 wrote to memory of 1260	2988	ComrefNetsvc.exe	50
PID 2988 wrote to memory of 1260	2988	ComrefNetsvc.exe	50
PID 2988 wrote to memory of 1260	2988	ComrefNetsvc.exe	50
PID 2988 wrote to memory of 1692	2988	ComrefNetsvc.exe	51
PID 2988 wrote to memory of 1692	2988	ComrefNetsvc.exe	51
PID 2988 wrote to memory of 1692	2988	ComrefNetsvc.exe	51
PID 2988 wrote to memory of 1104	2988	ComrefNetsvc.exe	52
PID 2988 wrote to memory of 1104	2988	ComrefNetsvc.exe	52
PID 2988 wrote to memory of 1104	2988	ComrefNetsvc.exe	52
PID 2988 wrote to memory of 1044	2988	ComrefNetsvc.exe	53
PID 2988 wrote to memory of 1044	2988	ComrefNetsvc.exe	53
PID 2988 wrote to memory of 1044	2988	ComrefNetsvc.exe	53
PID 2988 wrote to memory of 2044	2988	ComrefNetsvc.exe	56
PID 2988 wrote to memory of 2044	2988	ComrefNetsvc.exe	56
PID 2988 wrote to memory of 2044	2988	ComrefNetsvc.exe	56

C:\Users\Admin\AppData\Local\Temp\6bc67978f583db1ef99eb832b456c978b8c42a5233f9ed5810fed58455e6cd6f.exe
"C:\Users\Admin\AppData\Local\Temp\6bc67978f583db1ef99eb832b456c978b8c42a5233f9ed5810fed58455e6cd6f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\ComProviderDriversavescrt\zavVQKy7Y1920izKCt5xjM9GjoXxNpPSllMDj1uh.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Roaming\ComProviderDriversavescrt\XyQqwqHSpVeTNnNDm2Xa4eg.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1892
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1684
  - - C:\Users\Admin\AppData\Roaming\ComProviderDriversavescrt\ComrefNetsvc.exe
      "C:\Users\Admin\AppData\Roaming\ComProviderDriversavescrt/ComrefNetsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2988
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2756
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1420
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1160
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:736
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1636
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2200
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1988
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1788
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:776
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2152
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3036
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1260
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1692
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ja-JP\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1104
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Vss\Writers\System\ComrefNetsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:584
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\ComProviderDriversavescrt\ComrefNetsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:548
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iyjP7VOFTW.bat"
        5⤵
        
        PID:860
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2344
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1216
      - C:\Windows\ja-JP\spoolsv.exe
        
        "C:\Windows\ja-JP\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2376
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RvL1cycbdY.bat"
        7⤵
        
        PID:1016
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2280
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1940
        
        C:\Windows\ja-JP\spoolsv.exe
        
        "C:\Windows\ja-JP\spoolsv.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2228
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\V20VgTPM9z.bat"
        9⤵
        
        PID:896
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:3060
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2188
        
        C:\Windows\ja-JP\spoolsv.exe
        
        "C:\Windows\ja-JP\spoolsv.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2580
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RvL1cycbdY.bat"
        11⤵
        
        PID:1884
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:2752
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:1688
        
        C:\Windows\ja-JP\spoolsv.exe
        
        "C:\Windows\ja-JP\spoolsv.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2044
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\g3J0tdP0ue.bat"
        13⤵
        
        PID:1424
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:2928
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1672
        
        C:\Windows\ja-JP\spoolsv.exe
        
        "C:\Windows\ja-JP\spoolsv.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2912
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GogtzRNUlL.bat"
        15⤵
        
        PID:2216
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2880
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1968
        
        C:\Windows\ja-JP\spoolsv.exe
        
        "C:\Windows\ja-JP\spoolsv.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2504
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\B8RGJU8TMM.bat"
        17⤵
        
        PID:1596
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2812
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:1444
        
        C:\Windows\ja-JP\spoolsv.exe
        
        "C:\Windows\ja-JP\spoolsv.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:956
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hKJR6a159q.bat"
        19⤵
        
        PID:532
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:1384
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1128
        
        C:\Windows\ja-JP\spoolsv.exe
        
        "C:\Windows\ja-JP\spoolsv.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\B8RGJU8TMM.bat

Filesize
204B

MD5
3b655196a579982d179373b4460ab392

SHA1
b89e28255da88d82b720036803250f256ff0523b

SHA256
f0b35672887006865c5b5707354dca30cefb2f19478ab56b75e2aad772cb02dc

SHA512
1ff9e6b79c5a8b1ac4cb9c1b714f26216228bd0ccc9b2c6f93305c17e86c2930ae5d3ee6c028e8d3cd2ce6f93016fd3eeea42cce7cdc2df911346b6c55733e6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\GogtzRNUlL.bat

Filesize
156B

MD5
64eb228037e409d75ad33052b5e85c64

SHA1
812271a22a77ddc03c6c2aac504914985dcf413b

SHA256
6b5102eb9722d5d27b6ed1aae5157ef0dec43c78574387899195f2744b32514e

SHA512
c9e55442f03644ee16dc217371b496545a3fdd84de21f4946561159c35a0482443c3b4af9d5d55e187f0e92ba22df3657d64c3ba6487f3bd1be7eaeaff87ae12

Download Submit
C:\Users\Admin\AppData\Local\Temp\RvL1cycbdY.bat

Filesize
204B

MD5
998486ca00435f06de79302535d2c0a6

SHA1
e43fc60c4fa14802dc6cb14951ca6a92d6169994

SHA256
731373515b57976582cdfe495a4d7c72c7992742ba17dcf970a40c7eaeb688af

SHA512
684abaaa8e3ead5603e5ee6e9695cad96d6561c4b4764a5e057f5e2ac55477fa289de9b2fa6cc713bfcf4953972ffb412b53501a5d5417a9abb4d064e47d9de3

Download Submit
C:\Users\Admin\AppData\Local\Temp\V20VgTPM9z.bat

Filesize
156B

MD5
ba2fcc4a54cd497743eefcb6869d0e7a

SHA1
9b7215460b7899e3c3f1b2caab855509e7bc9b3b

SHA256
c8f7092284c0736b58710ba14ae0e22c47e62dbb9ee81a974e1b3e7e7c875db9

SHA512
7f080bb5c00e4680c064294263598b8f1ee3cf2a0d309c0fc0cfaf1b5e7ac79a41a644c1fa500fa1832e7fd3f148007216c62ca246484b18ac84c413f4dff8d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\g3J0tdP0ue.bat

Filesize
156B

MD5
97330a26f9c9866c201ececd2e36beee

SHA1
389af3fd447dba10a5898861853a19dd650c3844

SHA256
b874e2cd6ae78270972834755ab79a167a0a89b68e234f16aada7ea7da888bff

SHA512
dcc055e395a8db4cdb055fbaf5e70afc976084dd3372033f8c0a2e2bd04c76fdf2aee7b395f6822c7ee60fb4289b779f415fba314a8a8ff0b2ac82d880c3d7f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\hKJR6a159q.bat

Filesize
156B

MD5
09a0fe2806d9aa34cdac2c3776cc7ee5

SHA1
b032c965e30b33725cf1d822522e86f0faab25d0

SHA256
4738b49127650a1582df6ef989ee9bcf18053ec3b3c1590d5d2305470d1efbdf

SHA512
5d84801e08f0a8f473522576340343e485d415f9c0fccc56018fb4c78d38bc1185a79872b2bb46a7bd211a635e8a79b3a74469306c02d1729d7702309f9b9e1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\iyjP7VOFTW.bat

Filesize
204B

MD5
57460dbf53c3d1f03eaed1bc9e56dbe8

SHA1
ea726d26c6d2a8ce90b22fb18bb8d7f03b6d9c54

SHA256
ed7ed33c4b547af4229e55ee7e1b99eb9435c781b00408fac2edc2ba5fa4a31e

SHA512
193369d51d9a9a44bebac7f2a10aa794711591f3f6c8e67fbd27e3feff6610b52829f01aaea124dd9cae35cd8e7a6921d4323a0e701c56272daaabeac8ae3d81

Download Submit
C:\Users\Admin\AppData\Roaming\ComProviderDriversavescrt\XyQqwqHSpVeTNnNDm2Xa4eg.bat

Filesize
213B

MD5
a29756b59756f0110f008e371f219ba1

SHA1
33686da500c2a1af6344a5ca50a924523af18eb5

SHA256
151f21446759fed3bb2cb40de1caecba71a6770140afa50d3da46457a247b590

SHA512
06154e108095a2f53fdd3fdb69abfbf51e9e7613c89f254f3f20d37c3e9006c8868c57b0d3ebacc1a7d434001f4476a8d7a256e9e5f27cd493400948898cdee6

Download Submit
C:\Users\Admin\AppData\Roaming\ComProviderDriversavescrt\zavVQKy7Y1920izKCt5xjM9GjoXxNpPSllMDj1uh.vbe

Filesize
234B

MD5
58d9bc3c577a005201a94186763725eb

SHA1
df8f1da5e019f66d2aa107515b5fbd9db863492d

SHA256
41699e402bd653184f8abbe6d56416dc4e5cf8b51e5809752cc79515a8dc2309

SHA512
f1337eeb89851a3c93b8e3a60f30d96f9e9708960c7bec6fcf468fd2e892601d61bd15c412be815b8686fcdc13d77f603b47001a56d0b32978f936ac92a00ed9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
332fec812adea53bec2175230450b368

SHA1
1d68994fd3549955b27ec6ee3fb0e5b676758762

SHA256
a1b59f4deb8db05800992815cd59d7680aef76ffd2664e9ffea64cb65fa2d814

SHA512
2acec19a0ac90fe41b55a3fe7aec5643dfbe0118a84c86fd0916040a233bf080b66b24f65b6034f3b8f71b4daca96c09054e0e5633450750de8d80f384c0a1e7

Download Submit
\Users\Admin\AppData\Roaming\ComProviderDriversavescrt\ComrefNetsvc.exe

Filesize
2.0MB

MD5
7a6b9e23eccb90b36eb6a4fe87427d41

SHA1
61b75cd9ac8551ef47c5d7c9f09bb42cd0e5d8d5

SHA256
bde2679020ade3f5ec36455bf8bb57f4ef24724fddf832d41e5121c249c75c5d

SHA512
73637592e95c291a9ff7991c4f2eaca70455b2cf5d7fbdc1974f93d3191153d2be7eb5b970c340f1d9a04a28e946c63e6ac9d070ba6991c59fa2843d5e45a83b

Download Submit
memory/956-222-0x0000000000E30000-0x0000000001030000-memory.dmp

Filesize
2.0MB

Download
memory/1160-135-0x0000000002390000-0x0000000002398000-memory.dmp

Filesize
32KB

Download
memory/1788-52-0x000000001B340000-0x000000001B622000-memory.dmp

Filesize
2.9MB

Download
memory/1788-53-0x0000000002450000-0x0000000002458000-memory.dmp

Filesize
32KB

Download
memory/2044-180-0x0000000000FF0000-0x00000000011F0000-memory.dmp

Filesize
2.0MB

Download
memory/2228-152-0x0000000001080000-0x0000000001280000-memory.dmp

Filesize
2.0MB

Download
memory/2376-138-0x0000000000D00000-0x0000000000F00000-memory.dmp

Filesize
2.0MB

Download
memory/2504-208-0x0000000000240000-0x0000000000440000-memory.dmp

Filesize
2.0MB

Download
memory/2568-236-0x0000000000F40000-0x0000000001140000-memory.dmp

Filesize
2.0MB

Download
memory/2580-166-0x0000000000100000-0x0000000000300000-memory.dmp

Filesize
2.0MB

Download
memory/2912-194-0x0000000001140000-0x0000000001340000-memory.dmp

Filesize
2.0MB

Download
memory/2988-25-0x0000000001FD0000-0x0000000001FDE000-memory.dmp

Filesize
56KB

Download
memory/2988-21-0x0000000002020000-0x0000000002036000-memory.dmp

Filesize
88KB

Download
memory/2988-19-0x0000000001FC0000-0x0000000001FD0000-memory.dmp

Filesize
64KB

Download
memory/2988-23-0x0000000002150000-0x0000000002162000-memory.dmp

Filesize
72KB

Download
memory/2988-17-0x0000000001FE0000-0x0000000001FFC000-memory.dmp

Filesize
112KB

Download
memory/2988-15-0x0000000001FB0000-0x0000000001FBE000-memory.dmp

Filesize
56KB

Download
memory/2988-13-0x00000000001C0000-0x00000000003C0000-memory.dmp

Filesize
2.0MB

Download
memory/2988-27-0x0000000002000000-0x000000000200C000-memory.dmp

Filesize
48KB

Download