dcrat | 79dd01cce6f984152a8e07f6bbc447387a355794bc717a1348644f8b57565a98

Analysis

max time kernel
97s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2025, 02:45 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79dd01cce6f984152a8e07f6bbc447387a355794bc717a1348644f8b57565a98.exe
Size

1.6MB
MD5

e4d5bf96ef8643dcfd7a7f54e572cf59
SHA1

b80bc4046716b909a2f0692faef8d037a61cb9ee
SHA256

79dd01cce6f984152a8e07f6bbc447387a355794bc717a1348644f8b57565a98
SHA512

6704a1d6da446ab58717dc154180d817d4d3561a4e369d7f066421302c514950a51dd6104ec1e1b180488f7262c2bff00c02438aabc5e74e00e554e2290e1822
SSDEEP

24576:yTbBv5rUTxMWorF6OswaKn31LdWnriW26/kSBn3vwof0XcpDAFsGo5kCfBC2MRy:UBaM3ZdjV4nri+FT0XPQLCBRy

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\en-US\\dwm.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\en-US\\dwm.exe\", \"C:\\Windows\\BitLockerDiscoveryVolumeContents\\System.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\en-US\\dwm.exe\", \"C:\\Windows\\BitLockerDiscoveryVolumeContents\\System.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\en-US\\dwm.exe\", \"C:\\Windows\\BitLockerDiscoveryVolumeContents\\System.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\de-DE\\SppExtComObj.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\en-US\\dwm.exe\", \"C:\\Windows\\BitLockerDiscoveryVolumeContents\\System.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\de-DE\\SppExtComObj.exe\", \"C:\\Windows\\Panther\\setup.exe\\dwm.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\en-US\\dwm.exe\", \"C:\\Windows\\BitLockerDiscoveryVolumeContents\\System.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\de-DE\\SppExtComObj.exe\", \"C:\\Windows\\Panther\\setup.exe\\dwm.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\bridgeChainBlockreviewWin\\DrivermonitorNetdhcp.exe\""	DrivermonitorNetdhcp.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	1396	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4004	1396	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	1396	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	1396	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4696	1396	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	1396	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3400	1396	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4984	1396	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	1396	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4396	1396	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	1396	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	1396	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4700	1396	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	1396	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3096	1396	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4520	1396	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	1396	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	1396	schtasks.exe	86

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	79dd01cce6f984152a8e07f6bbc447387a355794bc717a1348644f8b57565a98.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	DrivermonitorNetdhcp.exe

Executes dropped EXE 2 IoCs

pid	Process
2716	DrivermonitorNetdhcp.exe
3928	System.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files (x86)\\Windows Media Player\\de-DE\\SppExtComObj.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files (x86)\\Windows Media Player\\de-DE\\SppExtComObj.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\Panther\\setup.exe\\dwm.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DrivermonitorNetdhcp = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\bridgeChainBlockreviewWin\\DrivermonitorNetdhcp.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DrivermonitorNetdhcp = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\bridgeChainBlockreviewWin\\DrivermonitorNetdhcp.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\en-US\\dwm.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\en-US\\dwm.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Recovery\\WindowsRE\\cmd.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\Panther\\setup.exe\\dwm.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\BitLockerDiscoveryVolumeContents\\System.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\BitLockerDiscoveryVolumeContents\\System.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Recovery\\WindowsRE\\cmd.exe\""	DrivermonitorNetdhcp.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\s_kgxh.exe	csc.exe
File created	\??\c:\Windows\System32\CSCE1599ACDB469417DBA2C25F9E4031E8.TMP	csc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Media Player\de-DE\SppExtComObj.exe	DrivermonitorNetdhcp.exe
File created	C:\Program Files (x86)\Windows Media Player\de-DE\e1ef82546f0b02	DrivermonitorNetdhcp.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_microsoft.dtc.power..l.scripts.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_38fa54758cbc1082\RuntimeBroker.exe	DrivermonitorNetdhcp.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\System.exe	DrivermonitorNetdhcp.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\27d1bcfc3c54e0	DrivermonitorNetdhcp.exe
File created	C:\Windows\en-US\dwm.exe	DrivermonitorNetdhcp.exe
File created	C:\Windows\en-US\6cb0b6c459d5d3	DrivermonitorNetdhcp.exe
File created	C:\Windows\Panther\setup.exe\dwm.exe	DrivermonitorNetdhcp.exe
File opened for modification	C:\Windows\Panther\setup.exe\dwm.exe	DrivermonitorNetdhcp.exe
File created	C:\Windows\Panther\setup.exe\6cb0b6c459d5d3	DrivermonitorNetdhcp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	79dd01cce6f984152a8e07f6bbc447387a355794bc717a1348644f8b57565a98.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3576	PING.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	79dd01cce6f984152a8e07f6bbc447387a355794bc717a1348644f8b57565a98.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	DrivermonitorNetdhcp.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3576	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1984	schtasks.exe
2108	schtasks.exe
4396	schtasks.exe
4512	schtasks.exe
4520	schtasks.exe
2168	schtasks.exe
4984	schtasks.exe
1600	schtasks.exe
3400	schtasks.exe
2248	schtasks.exe
2696	schtasks.exe
4004	schtasks.exe
1804	schtasks.exe
4696	schtasks.exe
1728	schtasks.exe
4932	schtasks.exe
4700	schtasks.exe
3096	schtasks.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
2716	DrivermonitorNetdhcp.exe
3928	System.exe
3928	System.exe
3928	System.exe
3928	System.exe
3928	System.exe
3928	System.exe
3928	System.exe
3928	System.exe
3928	System.exe
3928	System.exe
3928	System.exe
3928	System.exe
3928	System.exe
3928	System.exe
3928	System.exe
3928	System.exe
3928	System.exe
3928	System.exe
3928	System.exe
3928	System.exe
3928	System.exe
3928	System.exe
3928	System.exe
3928	System.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2716	DrivermonitorNetdhcp.exe
Token: SeDebugPrivilege	3928	System.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 4704	4760	79dd01cce6f984152a8e07f6bbc447387a355794bc717a1348644f8b57565a98.exe	82
PID 4760 wrote to memory of 4704	4760	79dd01cce6f984152a8e07f6bbc447387a355794bc717a1348644f8b57565a98.exe	82
PID 4760 wrote to memory of 4704	4760	79dd01cce6f984152a8e07f6bbc447387a355794bc717a1348644f8b57565a98.exe	82
PID 4704 wrote to memory of 1996	4704	WScript.exe	83
PID 4704 wrote to memory of 1996	4704	WScript.exe	83
PID 4704 wrote to memory of 1996	4704	WScript.exe	83
PID 1996 wrote to memory of 2716	1996	cmd.exe	85
PID 1996 wrote to memory of 2716	1996	cmd.exe	85
PID 2716 wrote to memory of 1964	2716	DrivermonitorNetdhcp.exe	90
PID 2716 wrote to memory of 1964	2716	DrivermonitorNetdhcp.exe	90
PID 1964 wrote to memory of 4312	1964	csc.exe	92
PID 1964 wrote to memory of 4312	1964	csc.exe	92
PID 2716 wrote to memory of 4688	2716	DrivermonitorNetdhcp.exe	110
PID 2716 wrote to memory of 4688	2716	DrivermonitorNetdhcp.exe	110
PID 4688 wrote to memory of 540	4688	cmd.exe	112
PID 4688 wrote to memory of 540	4688	cmd.exe	112
PID 4688 wrote to memory of 3576	4688	cmd.exe	113
PID 4688 wrote to memory of 3576	4688	cmd.exe	113
PID 4688 wrote to memory of 3928	4688	cmd.exe	118
PID 4688 wrote to memory of 3928	4688	cmd.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\79dd01cce6f984152a8e07f6bbc447387a355794bc717a1348644f8b57565a98.exe
"C:\Users\Admin\AppData\Local\Temp\79dd01cce6f984152a8e07f6bbc447387a355794bc717a1348644f8b57565a98.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bridgeChainBlockreviewWin\3gKZAXCAg1FGbpHNytlddzV22hguHiZY84812G8yGhM.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bridgeChainBlockreviewWin\KfNj92OB2q89BQqYS4KdyWp300Lk8au5.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1996
  - - C:\Users\Admin\AppData\Local\Temp\bridgeChainBlockreviewWin\DrivermonitorNetdhcp.exe
      "C:\Users\Admin\AppData\Local\Temp\bridgeChainBlockreviewWin/DrivermonitorNetdhcp.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2716
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bz1hjqkh\bz1hjqkh.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1964
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAF99.tmp" "c:\Windows\System32\CSCE1599ACDB469417DBA2C25F9E4031E8.TMP"
        6⤵
        
        PID:4312
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NINuIl2O0i.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4688
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:540
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3576
      - C:\Windows\BitLockerDiscoveryVolumeContents\System.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\System.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Windows\en-US\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\en-US\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Windows\en-US\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Windows\Panther\setup.exe\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Panther\setup.exe\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Windows\Panther\setup.exe\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DrivermonitorNetdhcpD" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\AppData\Local\Temp\bridgeChainBlockreviewWin\DrivermonitorNetdhcp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DrivermonitorNetdhcp" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\bridgeChainBlockreviewWin\DrivermonitorNetdhcp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DrivermonitorNetdhcpD" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Local\Temp\bridgeChainBlockreviewWin\DrivermonitorNetdhcp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

Network

DNS

241.150.49.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

241.150.49.20.in-addr.arpa

IN PTR

Response
DNS

60.153.16.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

60.153.16.2.in-addr.arpa

IN PTR

Response

60.153.16.2.in-addr.arpa

IN PTR

a2-16-153-60deploystaticakamaitechnologiescom
DNS

73.159.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

73.159.190.20.in-addr.arpa

IN PTR

Response
DNS

167.173.78.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

167.173.78.104.in-addr.arpa

IN PTR

Response

167.173.78.104.in-addr.arpa

IN PTR

a104-78-173-167deploystaticakamaitechnologiescom
DNS

104.219.191.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

104.219.191.52.in-addr.arpa

IN PTR

Response
DNS

930167cm.nyashkoon.ru

System.exe

Remote address:

8.8.8.8:53

Request

930167cm.nyashkoon.ru

IN A

Response
DNS

930167cm.nyashkoon.ru

System.exe

Remote address:

8.8.8.8:53

Request

930167cm.nyashkoon.ru

IN A

Response
DNS

200.163.202.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

200.163.202.172.in-addr.arpa

IN PTR

Response
DNS

206.23.85.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

206.23.85.13.in-addr.arpa

IN PTR

Response
DNS

180.129.81.91.in-addr.arpa

Remote address:

8.8.8.8:53

Request

180.129.81.91.in-addr.arpa

IN PTR

Response
DNS

172.214.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.214.232.199.in-addr.arpa

IN PTR

Response
DNS

43.229.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

43.229.111.52.in-addr.arpa

IN PTR

Response

No results found

8.8.8.8:53

241.150.49.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

241.150.49.20.in-addr.arpa
8.8.8.8:53

60.153.16.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

60.153.16.2.in-addr.arpa
8.8.8.8:53

73.159.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

73.159.190.20.in-addr.arpa
8.8.8.8:53

167.173.78.104.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

167.173.78.104.in-addr.arpa
8.8.8.8:53

104.219.191.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

104.219.191.52.in-addr.arpa
8.8.8.8:53

930167cm.nyashkoon.ru

dns

System.exe

134 B
256 B
2
2

DNS Request

930167cm.nyashkoon.ru

DNS Request

930167cm.nyashkoon.ru
8.8.8.8:53

200.163.202.172.in-addr.arpa

dns

74 B
160 B
1
1

DNS Request

200.163.202.172.in-addr.arpa
8.8.8.8:53

206.23.85.13.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

206.23.85.13.in-addr.arpa
8.8.8.8:53

180.129.81.91.in-addr.arpa

dns

72 B
147 B
1
1

DNS Request

180.129.81.91.in-addr.arpa
8.8.8.8:53

172.214.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.214.232.199.in-addr.arpa
8.8.8.8:53

43.229.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

43.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NINuIl2O0i.bat

Filesize
182B

MD5
2486f3968604b67d9af3064a0d76d9d5

SHA1
a91aa0665cf5de786b2826d617d1fd936a9249a2

SHA256
fbab195ef75d2330fb505c470a2297f6f7dba1942b414ef3717194dd1cfcb282

SHA512
0902bd6225be986bd9f519b376eb16e84882528dcb06b2de045b47b9bfa58ce26004ddb580dc3359d452979cf4345ca329343dd5f72a9d56af1301b60026f1d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESAF99.tmp

Filesize
1KB

MD5
894e08ba43b8284e7d2936877ad85de4

SHA1
e581b6091c14e3fa2e1d2e24bd33a8b732157f3e

SHA256
f62b186d1f8da2e2ff4474a88023410b52cb02a07f3825c01c2c0af322f8e78a

SHA512
448656eac9e6e1b88a941c268395a30a31a84d1d72ec2412b471cf6e4c981663a2aba24d67ca36d9a2128c157cf1249c9383faa4b490ec08a6e6713eccd594e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\bridgeChainBlockreviewWin\3gKZAXCAg1FGbpHNytlddzV22hguHiZY84812G8yGhM.vbe

Filesize
239B

MD5
bfa798b1e505fdf4c3d5935690d520c1

SHA1
c0f49114a795b2475d0b8b22b0a55455a50d29e5

SHA256
dbf18fbdbc65ebf9ef0fe14d2241f00c03dd2a1666e49ddb47c4871c67db2e8d

SHA512
cf512995697de828d6bdb198d0e38c3173ea486e266744eded48541a128cfafb690324c7ff21c921854c78ea43a471bd286625af0307f4974ef24b875daf0460

Download Submit
C:\Users\Admin\AppData\Local\Temp\bridgeChainBlockreviewWin\DrivermonitorNetdhcp.exe

Filesize
1.3MB

MD5
f7ed452b6b36fe1a6ad40017405f95a2

SHA1
de073fdf34b56af4f03d0ec8a2d221cbf4d0c5d4

SHA256
509a80dd4d58739d863b7fefbbfce44c3588119e9b5a258e0cbf58ac4bc8fb04

SHA512
a51f7e2028ff8016ab9dddfd0f5a320e9b3516ea32476a7bc82f9d3f33339fe2aa104bb48b630f3081deda2146a58164705af150519eb5ec1b6ecb3b8e0e6635

Download Submit
C:\Users\Admin\AppData\Local\Temp\bridgeChainBlockreviewWin\KfNj92OB2q89BQqYS4KdyWp300Lk8au5.bat

Filesize
90B

MD5
ca4c23f79ee470ef660f3c2c7fa64e86

SHA1
b7de68c9d60b668a1d92d32b61c676f99c605f8d

SHA256
6af8a46b462cb8d14dbd4d0fd0cb753341bbf1bd4eee84c97a87a6ef9e5ed739

SHA512
46a2eef31a505e43fb2f42b7901169ee04213da51a0e51b9004743cf04171d0727279ace095bf0e256a65c8ed27ff1438722079216a9b8f46ee95edaab78056c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\bz1hjqkh\bz1hjqkh.0.cs

Filesize
356B

MD5
554838302b7518fbb22cfcc617e88b78

SHA1
77fabd48280c8795066d89b94c8dbf09d2b9430d

SHA256
381656d19182cc049aed7ac333893f5d4c3def8ba7b5a64688590c934cf4ddf5

SHA512
ee7617c657b931056ac5f876475a224521e24a7b09f9a730ca33d69531d4fe12c35c251510dbfc1a2d82834a3b4b26d5d3c6850877155ab7844d809ca5a997c8

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\bz1hjqkh\bz1hjqkh.cmdline

Filesize
235B

MD5
89da911c5b342751a443d122f7dfdaf1

SHA1
904486f1a2b4a56201e0f737e5649d0178540417

SHA256
820d7e627d43db2801eb6123acac380e7f7873253e190a514abe8240c168591b

SHA512
2ae1628611c03b9b53ab40679e5fb75e337454572c81c5c66b008671fecf3e2bd0ae10a908dfa1870a51dc36c3baf164537c656b73ac1a4a2c75ac0f6f0fc7f9

Download Submit
\??\c:\Windows\System32\CSCE1599ACDB469417DBA2C25F9E4031E8.TMP

Filesize
1KB

MD5
634e281a00b7b9f516c3048badfa1530

SHA1
af6369715ce2fe9b99609e470d4f66698880a35a

SHA256
0d990336ae793f3f6903048004c8d707d7a7191927bd7df46b7fe887116506c8

SHA512
1cb35fa0759f5362c9c7eee5546710874121005a3924bcfec2cf33ac90a257a807ce7ec0db7bc84dcb327604d708009449c34f52560ed936b54eeba49be7d27b

Download Submit
memory/2716-48-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-36-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-76-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-74-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-70-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-68-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-64-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-62-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-66-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-60-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-58-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-56-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-54-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-52-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-72-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-46-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-44-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-42-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-40-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-78-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-34-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-32-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-30-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-29-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-24-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-22-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-16-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-50-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-20-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-18-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-15-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-3572-0x00000000028F0000-0x00000000028FE000-memory.dmp

Filesize
56KB

Download
memory/2716-3574-0x0000000002A10000-0x0000000002A1C000-memory.dmp

Filesize
48KB

Download
memory/2716-3580-0x00007FFF66033000-0x00007FFF66035000-memory.dmp

Filesize
8KB

Download
memory/2716-38-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-26-0x000000001B300000-0x000000001B4A5000-memory.dmp

Filesize
1.6MB

Download
memory/2716-14-0x000000001B300000-0x000000001B4AA000-memory.dmp

Filesize
1.7MB

Download
memory/2716-13-0x00000000007F0000-0x00000000007F8000-memory.dmp

Filesize
32KB

Download
memory/2716-12-0x00007FFF66033000-0x00007FFF66035000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.