Overview

overview

10

Static

static

3

221ec8caee...7d.exe

windows7-x64

10

221ec8caee...7d.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14-01-2025 02:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    221ec8caee4804b4c9e4ced2e1f03be897bc1993d7898b2bdc00f90a093eb87d.exe

  • Size

    9.0MB

  • MD5

    35a0fbec2fc6d2a550a569719406d58d

  • SHA1

    bc73001a0600313803d3594dc51d3d0813dbdec1

  • SHA256

    221ec8caee4804b4c9e4ced2e1f03be897bc1993d7898b2bdc00f90a093eb87d

  • SHA512

    2f4d71eaa62dded749f82660fd7ee90da422048459d63faa79f518c3c10b7343c482e95cf81cea6bfb4710ef07f53d2d7f835dd3f191029da38da2e9a7beb00f

  • SSDEEP

    196608:uGk5oFaEPX2GgYCCUDQ4yA8/vWOCFidWo+QOovFFoJXz0Bt99OGvFLuyAjA9UCo:9k5/EP2Gac4yHndWo+bodFgXz29OGNps

Score
10/10
dcratorcusgamehackdiscoveryexecutioninfostealerpersistenceratspywarestealer

Malware Config

Extracted

Family

orcus

Botnet

GameHack

C2

31.44.184.52:25350

Mutex

sudo_06kkh814g4vz7sfklrh1emcow75dz383

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %appdata%\Windows\Defender\MpDefenderCoreProtion.exe

  • reconnect_delay

    10000

  • registry_keyname

    Sudik

  • taskscheduler_taskname

    sudik

  • watchdog_path

    AppData\aga.exe

Signatures

  • DcRat 31 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 10 IoCs
    persistence
  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Process spawned unexpected child process 30 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 5 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Orcurs Rat Executable 8 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 15 IoCs
  • Adds Run key to start application 2 TTPs 20 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\221ec8caee4804b4c9e4ced2e1f03be897bc1993d7898b2bdc00f90a093eb87d.exe
    "C:\Users\Admin\AppData\Local\Temp\221ec8caee4804b4c9e4ced2e1f03be897bc1993d7898b2bdc00f90a093eb87d.exe"
    1⤵
    • DcRat
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2496
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\VaCm6yonii0zLXLvCqreXRVqw1.vbe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1864
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\DaJttDh54LCmoatNZvevDoWyEmexKWgun1WAXP2cdZM0egnWJQQpZtVxW.bat" "
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2824
        • C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
          "C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor/runtimesvc.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1644
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qve4w4xb\qve4w4xb.cmdline"
            5⤵
              PID:2032
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC311.tmp" "c:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\CSC682ACEE1636E45D1B935829061461FE.TMP"
                6⤵
                  PID:600
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cibxvhjt\cibxvhjt.cmdline"
                5⤵
                • Drops file in System32 directory
                PID:2904
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC477.tmp" "c:\Windows\System32\CSC842B41524054433789E9C773241214.TMP"
                  6⤵
                    PID:2428
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe'
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1156
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Idle.exe'
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2856
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\WmiPrvSE.exe'
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1096
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\winlogon.exe'
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1904
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\System.exe'
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1848
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe'
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1472
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qowOLEDHcw.bat"
                  5⤵
                    PID:912
                    • C:\Windows\system32\chcp.com
                      chcp 65001
                      6⤵
                        PID:1500
                      • C:\Windows\system32\PING.EXE
                        ping -n 10 localhost
                        6⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Runs ping.exe
                        PID:1932
                      • C:\Users\Default User\WmiPrvSE.exe
                        "C:\Users\Default User\WmiPrvSE.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2668
              • C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe
                "C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe"
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2480
                • C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe
                  "C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe"
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2996
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1900
              • C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe
                "C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe"
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2712
                • C:\Windows\SysWOW64\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\chainReviewdhcp\mJEJ7PbY35CMaAu5227dvHv.vbe"
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3020
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c ""C:\Users\Admin\AppData\Roaming\chainReviewdhcp\LJrjU6BhAd6hMsY1uw5hl2I0p3Jh.bat" "
                    4⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2376
                    • C:\Users\Admin\AppData\Roaming\chainReviewdhcp\containerRuntime.exe
                      "C:\Users\Admin\AppData\Roaming\chainReviewdhcp\containerRuntime.exe"
                      5⤵
                      • Modifies WinLogon for persistence
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Drops file in Program Files directory
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:1208
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\chainReviewdhcp\containerRuntime.exe'
                        6⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2808
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\smss.exe'
                        6⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2796
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\audiodg.exe'
                        6⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2744
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\runtimesvc.exe'
                        6⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2196
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Cookies\lsass.exe'
                        6⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2172
                      • C:\Users\Default\Cookies\lsass.exe
                        "C:\Users\Default\Cookies\lsass.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2412
              • C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe
                "C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe"
                2⤵
                • Executes dropped EXE
                PID:2908
            • C:\Windows\system32\taskeng.exe
              taskeng.exe {A9CEB069-CE3B-4756-A35E-CC9C890DB11B} S-1-5-21-312935884-697965778-3955649944-1000:MXQFNXLT\Admin:Interactive:[1]
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:1728
              • C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe
                C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:1248
              • C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe
                C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:836
              • C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe
                C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:1156
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2100
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\smss.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:996
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\smss.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2868
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:892
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\smss.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3032
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1604
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Program Files\Common Files\audiodg.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2328
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\Common Files\audiodg.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2336
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Program Files\Common Files\audiodg.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2276
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "runtimesvcr" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\runtimesvc.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2380
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "runtimesvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\runtimesvc.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2812
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "runtimesvcr" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\runtimesvc.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2848
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Cookies\lsass.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2220
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default\Cookies\lsass.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2056
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Cookies\lsass.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2616
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Idle.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2264
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\All Users\Idle.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3036
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Idle.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:576
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\WmiPrvSE.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2100
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Default User\WmiPrvSE.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1800
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\WmiPrvSE.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2364
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\winlogon.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2368
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2712
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2564
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\System.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2480
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\System.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2872
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\System.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1956
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "runtimesvcr" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1616
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "runtimesvc" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1356
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "runtimesvcr" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1980

            Network

            MITRE ATT&CK Enterprise v15

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            1
            T1059

            PowerShell

            1
            T1059.001

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Persistence

            Boot or Logon Autostart Execution

            2
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Winlogon Helper DLL

            1
            T1547.004

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Privilege Escalation

            Boot or Logon Autostart Execution

            2
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Winlogon Helper DLL

            1
            T1547.004

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Defense Evasion

            Modify Registry

            2
            T1112

            Credential Access

            Discovery

            Query Registry

            1
            T1012

            Remote System Discovery

            1
            T1018

            System Information Discovery

            1
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Network Configuration Discovery

            1
            T1016

            Internet Connection Discovery

            1
            T1016.001

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\RESC311.tmp
              Filesize

              1KB

              MD5

              837aa56e06bd0a85791dddb333ea77b5

              SHA1

              dd950a9f0c3aff977720d9e1770a2b4f2c84c5e9

              SHA256

              4a6d5b0745a5faaa20edf412ddeee035979f3a357b7dc2c52d2d80610029b927

              SHA512

              c27d9de8e13c0a52ca50d48ee1e7ecea4ea3131be200d02da4b03f089a9a9236ff817df775835f3e8d7e1f96e0d7f53beb5f2c3883ac41e066218f09655e37c6

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\RESC477.tmp
              Filesize

              1KB

              MD5

              388cdc9e362ec83d1e31af87147f6175

              SHA1

              aeca3be28f64a148e5df4e3e5b45b74e0214a04a

              SHA256

              ab2d35fe2839482d16c03106df7439d1b1141cc3ef79548e25393b0607e3c434

              SHA512

              4e1b4147f1941dd921e972860422e820eb2a797183d91d7ae74941a89d48b8736c8a10153d06577cc5439666e205c1f013f2567a0fb2a1da487a6b05a6326212

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\qowOLEDHcw.bat
              Filesize

              162B

              MD5

              9426f0c15f72620a0e79092a4cc73ecc

              SHA1

              e534eda25af53544f4766d3daa7ac38f30c861e0

              SHA256

              961dc8f909403843f605829b1c1e4b22f6f66f58a003863e9e533386a20f67de

              SHA512

              114195c8ac941a8d2329b9793bca41acbe5b9737a4d8e0a8cca55461ca6eb2edd758e9882c5841ec07ff8edb9defcd2fb772ea42b17b987277cde86e2d997d83

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0RODQNOH5AO4BDMKK9D8.temp
              Filesize

              7KB

              MD5

              eb6019cb60f3b62525f81b8fcfbeeb77

              SHA1

              c5062bed5f7d1534696d3784629b7d1043768ea1

              SHA256

              2995cf7aeb9cfaa7c9f94fca5d11cb64a943cda9bdf4e894b2affedbb0faf66a

              SHA512

              dcbb2553170d4899f621c2cc33389fafe4a375f2bc328e8fbdfa32c9e107302cbe6e6dd6afe407e52082e6dd5be2c962d586bdd9c9e3add6726879f69def4782

              Download Submit

            • C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\DaJttDh54LCmoatNZvevDoWyEmexKWgun1WAXP2cdZM0egnWJQQpZtVxW.bat
              Filesize

              104B

              MD5

              fbef3b76368e503dca520965bb79565f

              SHA1

              9a1a27526b8b9bdaae81c5301cd23eb613ea62ba

              SHA256

              bcb2af67a4ea1e6aa341cf3141941dbe7b17f1911e7f20aba46552571f99c9f3

              SHA512

              2b99bc9a945b6d9a2c0d3206dce9221eb7f4a2040c5096909d60c3278254c52b39a28dd18dd4e005eff0ebd7e7cba6dd3a6a94ea8a7d7598da3001da174db3f5

              Download Submit

            • C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\VaCm6yonii0zLXLvCqreXRVqw1.vbe
              Filesize

              263B

              MD5

              a05e26d89c5be7e2c6408b09cd05cf74

              SHA1

              c24231c6301f499b35441615b63db6969a1762fd

              SHA256

              05628dfff22e15b219a711cf52a2c87521170853979f00fcd014cf164656418e

              SHA512

              8c8733f12dd71cfafd2edbfad487279d6ed971eb119b1cde92a905f4658a9b090f831f42ef2228a4f6c64071a1f54fb74708438b4361e317e36016897577913d

              Download Submit

            • C:\Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\runtimesvc.exe
              Filesize

              556KB

              MD5

              00c4245522082b7f87721f9a26e96ba4

              SHA1

              993a8aa88436b6c62b74bb399c09b8d45d9fb85b

              SHA256

              a728f531427d89c5b7691f989e886df57d46f90d934448e6dabf29d64d0662bf

              SHA512

              fdd8d2444b28883face793f6ea77913c2096a425e6101202536ea001c3df5e76a60a01673ee7a52eae827a12299b2727002895395315db190ec82ae11a68559f

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Windows\Defender\MpDefenderCoreProtion.exe.config
              Filesize

              357B

              MD5

              a2b76cea3a59fa9af5ea21ff68139c98

              SHA1

              35d76475e6a54c168f536e30206578babff58274

              SHA256

              f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

              SHA512

              b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

              Download Submit

            • C:\Users\Admin\AppData\Roaming\chainReviewdhcp\LJrjU6BhAd6hMsY1uw5hl2I0p3Jh.bat
              Filesize

              48B

              MD5

              2fa8decc3dafe6f196f6c28769192e7c

              SHA1

              69f4e0cf41b927634a38b77a8816ca58c0bfb2de

              SHA256

              7e40eb542d164397c0bf17a47c8f0db79e7028299e9f180d38505220fd2cfb30

              SHA512

              c9fb6c2ac2441ff14673ccaa3f1d5e703356c093353992d302d34df6c9e26a85aba6760c3b98f0cd0ada45183c55b2e5cabc09978ca084077dd71743ca9fdbc1

              Download Submit

            • C:\Users\Admin\AppData\Roaming\chainReviewdhcp\mJEJ7PbY35CMaAu5227dvHv.vbe
              Filesize

              227B

              MD5

              d47062c8738a534fc931c0f341a61773

              SHA1

              c1175037a0e96363da56bc9d8abdb726cddc74fc

              SHA256

              484cc22b88e1eaae619f948e96812ebf70275f9e6408e2e3dbd8af827ac5199a

              SHA512

              9de6dcf7944ec9f2ff44c8fdbe562a6755c2af9800028b01fb0969921e6ef969c1ecc6e2ab129f191ac5feeaa9aa30cf436489dfee8e94433d6678a9942ffe39

              Download Submit

            • \??\c:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\CSC682ACEE1636E45D1B935829061461FE.TMP
              Filesize

              1KB

              MD5

              70ebd87a449c83d0645ba22e10ab83e5

              SHA1

              5980251d5a46d81e6f48fe53ee04e87a28219015

              SHA256

              b4713f585dbd4185833afeb466a2fbaa5c9d17071f9de2a1f0dfeec01b346c01

              SHA512

              b44a0154a6c4b1f2af61046a0357b8018a5095262f0ec54e701f4bd46adcaad3e88bafe23567e49b845bd83578d0291bcff6a43351d6027ea02c9e1ead96ca66

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\cibxvhjt\cibxvhjt.0.cs
              Filesize

              390B

              MD5

              3893688590f0dd7daeda3267c927911e

              SHA1

              bb26a9b11885f6aa3cf3d047cd5da7b7a8e812d6

              SHA256

              4774d765e6d810568b2370efb980a1fe4d4907373e8eb7bf89d3ed07604fd97c

              SHA512

              59e20a44522754052b456f75ecaa74a83110a402c10b4953751909a653f6f4be577612f0624ea13bcf94f18b7f1bab0be1f99dd13b984cabf5f7e001be53414e

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\cibxvhjt\cibxvhjt.cmdline
              Filesize

              235B

              MD5

              41ed59b666be285ae98cfe4e515e09cf

              SHA1

              1ed94e467e9c1aacb167a4b657f34f8a5c360111

              SHA256

              ad2280a8e955377aca47671b135a6fed67309efa20cb5988466c28c1f7f05d49

              SHA512

              8eb395dacbda69ae3d672264950ff04486fdbbdea8448b498acd843e472f1fcbda353ae2da689713b2c4baf79b5acfa44c83bd037f586b03537c59d90fb8747e

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\qve4w4xb\qve4w4xb.0.cs
              Filesize

              417B

              MD5

              4e822b550486d4d709d1df2796309950

              SHA1

              76a5b84e932c38389389c5105b57fee148240073

              SHA256

              e8c90fddfdba981a92b5b8c28d70fda356a8f28f83c224e3b37492aeff3bbf61

              SHA512

              5c8407ac540582aa7d1b98262860d5de85da60d4bf2402e0a9b01e214ef027bf637cd53a83910bf2a660d38c3e998791f3954ec6071781600ec18a2fdd67a305

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\qve4w4xb\qve4w4xb.cmdline
              Filesize

              262B

              MD5

              47af0ffc52a6e7b8c13167ff8e451d10

              SHA1

              dbea4aa6846797d0a37414255581e2869b8c60ae

              SHA256

              b2797bada38f8f24720e7dcca4a413a9f2e31c2d3aed89e0c9c79304f8a90eaf

              SHA512

              b4593248d6b91477765d2ebd6f2caa3ff2bed7c20a8f83caf741d103df1c08a1b9a3217432fe4c63e2687774ab6b139333a3f03617397c7f6f208fd5bae2f49c

              Download Submit

            • \??\c:\Windows\System32\CSC842B41524054433789E9C773241214.TMP
              Filesize

              1KB

              MD5

              8c85ef91c6071d33745325a8fa351c3e

              SHA1

              e3311ceef28823eec99699cc35be27c94eca52d2

              SHA256

              8db3e3a5515da1933036688a9b1918cfc3339fc687008c5325461271904b2d41

              SHA512

              2bb89b07fe46b1c406ed6a560e88cb2b8402b1d61bb71e10887bad661751f64f1e5317fd6c1b301ea4766785b915da31b64e0475cfe36c1f950b32915b5dab7d

              Download Submit

            • \Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\GameHack.exe
              Filesize

              1.6MB

              MD5

              bc7804fca6dd09b4f16e86d80b8d28fa

              SHA1

              a04800b90db1f435dd1ac723c054b14d6dd16c8a

              SHA256

              1628864ab0bafe8afea2ad70956b653550dab3db7c4cdf6f405e93a6c2441dce

              SHA512

              7534ac0a215f02af85bdf2b414e23face0570943f8820e7bfe97ea274ccd1a01618556e93b7465c2d9fbb0bcde5e97fab9e9b6bddd366554277ef308cde3a83c

              Download Submit

            • \Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\MpDefenderProtector.exe
              Filesize

              3.0MB

              MD5

              10e817a4d5e216279a8de8ed71c91044

              SHA1

              97c6fb42791be24d12bd74819ef67fa8f3d21724

              SHA256

              c60f74f6e164049e683a5f01b8cfea24aa85cbf6c7b31b765cbad16d8ab0d7b2

              SHA512

              34421a517f5f1909afd694d24e22cafad9930725df964ba9c80666e9f0f2dcfdd2a254dcf6699e5797296ec3ae611593563779df05e3a617c7f8679a154dfd37

              Download Submit

            • \Users\Admin\AppData\Roaming\WinRuntimePerfMonitor\Solara.exe
              Filesize

              4.6MB

              MD5

              e8c32cc88db9fef57fd9e2bb6d20f70b

              SHA1

              e732b91cd8ac16fa4ce8ad9e639bf21d69f6bb45

              SHA256

              f787ce198538b1c0b2bfce8ce5297e34152cf6deebe559df6887f65c72a081a4

              SHA512

              077307d42438f2b72d62ce9e35c67c09e1375c2e203e6d6d455c6c8861c6442b3d82f1345b6c76940f5e8015fe93491158a59b102fabd139c742d75c2c42ba7a

              Download Submit

            • \Users\Admin\AppData\Roaming\chainReviewdhcp\containerRuntime.exe
              Filesize

              1.3MB

              MD5

              52c95032ff8b8c3d4dfd98e51d8f6f58

              SHA1

              e841a32cb07adaad4db35b1f87b5df6e019eb9af

              SHA256

              39b35293e7efaa4cb94028e59872013bef4065788fef9fe3cd3206a8aee711e4

              SHA512

              a1177740ffbb476fb11f8112d98cabe3012ee3d54f2f848bb22ea99b53bd3526bf59065951fb6ef29f29408ab2fd90c942de65fe16d66a098abce8ba5d7d4e00

              Download Submit

            • memory/1208-136-0x0000000000240000-0x000000000025C000-memory.dmp

              Filesize

              112KB

              Download

            • memory/1208-124-0x0000000000290000-0x00000000003EA000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/1208-138-0x0000000000280000-0x0000000000290000-memory.dmp

              Filesize

              64KB

              Download

            • memory/1208-137-0x0000000000260000-0x0000000000276000-memory.dmp

              Filesize

              88KB

              Download

            • memory/1208-140-0x0000000000610000-0x000000000061C000-memory.dmp

              Filesize

              48KB

              Download

            • memory/1208-139-0x0000000000600000-0x000000000060E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/1644-104-0x0000000000440000-0x0000000000458000-memory.dmp

              Filesize

              96KB

              Download

            • memory/1644-117-0x0000000000490000-0x000000000049E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/1644-98-0x000000001AEA0000-0x000000001AFA4000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/1644-100-0x0000000000340000-0x000000000034E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/1644-102-0x0000000000420000-0x000000000043C000-memory.dmp

              Filesize

              112KB

              Download

            • memory/1644-97-0x00000000012B0000-0x00000000012B8000-memory.dmp

              Filesize

              32KB

              Download

            • memory/1644-106-0x0000000000370000-0x000000000037E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/1644-108-0x0000000000410000-0x000000000041C000-memory.dmp

              Filesize

              48KB

              Download

            • memory/1644-119-0x00000000004A0000-0x00000000004AC000-memory.dmp

              Filesize

              48KB

              Download

            • memory/1644-111-0x0000000000460000-0x000000000046E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/1644-115-0x0000000000480000-0x000000000048C000-memory.dmp

              Filesize

              48KB

              Download

            • memory/1644-113-0x0000000000470000-0x000000000047C000-memory.dmp

              Filesize

              48KB

              Download

            • memory/1900-81-0x0000000000400000-0x00000000006FE000-memory.dmp

              Filesize

              3.0MB

              Download

            • memory/1900-90-0x00000000007A0000-0x00000000007B8000-memory.dmp

              Filesize

              96KB

              Download

            • memory/1900-80-0x0000000000400000-0x00000000006FE000-memory.dmp

              Filesize

              3.0MB

              Download

            • memory/1900-86-0x0000000000400000-0x00000000006FE000-memory.dmp

              Filesize

              3.0MB

              Download

            • memory/1900-87-0x0000000000400000-0x00000000006FE000-memory.dmp

              Filesize

              3.0MB

              Download

            • memory/1900-88-0x0000000000400000-0x00000000006FE000-memory.dmp

              Filesize

              3.0MB

              Download

            • memory/1900-85-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

              Filesize

              4KB

              Download

            • memory/1900-91-0x0000000000900000-0x0000000000910000-memory.dmp

              Filesize

              64KB

              Download

            • memory/1900-83-0x0000000000400000-0x00000000006FE000-memory.dmp

              Filesize

              3.0MB

              Download

            • memory/1900-77-0x0000000000400000-0x00000000006FE000-memory.dmp

              Filesize

              3.0MB

              Download

            • memory/1904-234-0x0000000002230000-0x0000000002238000-memory.dmp

              Filesize

              32KB

              Download

            • memory/2196-192-0x0000000001D00000-0x0000000001D08000-memory.dmp

              Filesize

              32KB

              Download

            • memory/2196-182-0x000000001B840000-0x000000001BB22000-memory.dmp

              Filesize

              2.9MB

              Download

            • memory/2412-171-0x0000000000BC0000-0x0000000000D1A000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/2480-63-0x00000000005B0000-0x00000000005C2000-memory.dmp

              Filesize

              72KB

              Download

            • memory/2480-61-0x0000000000880000-0x00000000008DC000-memory.dmp

              Filesize

              368KB

              Download

            • memory/2480-60-0x0000000000270000-0x000000000027E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/2480-57-0x0000000000900000-0x0000000000BFE000-memory.dmp

              Filesize

              3.0MB

              Download

            • memory/2496-47-0x0000000004790000-0x0000000005184000-memory.dmp

              Filesize

              10.0MB

              Download

            • memory/2668-247-0x0000000000AB0000-0x0000000000AB8000-memory.dmp

              Filesize

              32KB

              Download

            • memory/2856-223-0x000000001B570000-0x000000001B852000-memory.dmp

              Filesize

              2.9MB

              Download

            • memory/2908-62-0x0000000000400000-0x0000000000DF4000-memory.dmp

              Filesize

              10.0MB

              Download

            • memory/2908-48-0x0000000000400000-0x0000000000DF4000-memory.dmp

              Filesize

              10.0MB

              Download

            • memory/2996-74-0x00000000013B0000-0x00000000016AE000-memory.dmp

              Filesize

              3.0MB

              Download

            • memory/2996-75-0x00000000006F0000-0x0000000000702000-memory.dmp

              Filesize

              72KB

              Download

            • memory/2996-76-0x0000000000CC0000-0x0000000000D0E000-memory.dmp

              Filesize

              312KB

              Download