dcrat | 3d79293d371d3393d83f0d6205c35263baa3618a6f3ccba4fcefbee999d4a714

Resubmissions

14/01/2025, 04:24

250114-e1k7payngl10

14/01/2025, 03:04

250114-dkkesaxmar10

Analysis

max time kernel
842s
max time network
843s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/01/2025, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3d79293d371d3393d83f0d6205c35263baa3618a6f3ccba4fcefbee999d4a714.exe
Size 16.0MB
Sample250114-e1k7payngl
SHA256 3d79293d371d3393d83f0d6205c35263baa3618a6f3ccba4fcefbee999d4a714
MD5 5aa236eabe65a1e444f1eb31fb330eba
SHA1 b6a8d5362991511526ea5a2b86ad70f05e70652c
SHA512 0ab8e56f1f8a09491d96416bdc2798874ff153ef56c6476cd9eda9fe0744e77f56132073524f1a2719a75d5dea8dcd5706ee1497867f8b3e62c9a52641afc0be
SSDEEP 98304:mjHzjFPB6n2gC9U851tTRIXDNgn+ojsSw9y4Q1vL3NPt:yHHFPgns9BvpyNgnNW4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat discovery evasion execution infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32Local\\DriverbrokerCrtDhcp.exe\""	DriverbrokerCrtDhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32Local\\DriverbrokerCrtDhcp.exe\", \"C:\\portBrokerDll\\DriverbrokerCrtDhcp.exe\""	DriverbrokerCrtDhcp.exe

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3528	3488	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3552	3488	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3584	3488	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3780	3488	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3808	3488	schtasks.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3840	3488	schtasks.exe	40

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2132	powershell.exe

Disables Task Manager via registry modification
evasion

Executes dropped EXE 5 IoCs

pid	Process
1712	XenoSetup(1).exe
2828	Xeno.exe
2460	DriverbrokerCrtDhcp.exe
3956	DriverbrokerCrtDhcp.exe
3452	DriverbrokerCrtDhcp.exe

Loads dropped DLL 3 IoCs

pid	Process
1036	3d79293d371d3393d83f0d6205c35263baa3618a6f3ccba4fcefbee999d4a714.exe
2764	cmd.exe
2764	cmd.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DriverbrokerCrtDhcp = "\"C:\\portBrokerDll\\DriverbrokerCrtDhcp.exe\""	DriverbrokerCrtDhcp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\XenoSetup(1) = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XenoSetup(1).exe"	3d79293d371d3393d83f0d6205c35263baa3618a6f3ccba4fcefbee999d4a714.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\DriverbrokerCrtDhcp = "\"C:\\Windows\\System32Local\\DriverbrokerCrtDhcp.exe\""	DriverbrokerCrtDhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DriverbrokerCrtDhcp = "\"C:\\Windows\\System32Local\\DriverbrokerCrtDhcp.exe\""	DriverbrokerCrtDhcp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\DriverbrokerCrtDhcp = "\"C:\\portBrokerDll\\DriverbrokerCrtDhcp.exe\""	DriverbrokerCrtDhcp.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC46B410E6D9884E0E9FA253EEDF3B0B6.TMP	csc.exe
File created	\??\c:\Windows\System32\wa0wg5.exe	csc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System32Local\a05c1cd25e80d0	DriverbrokerCrtDhcp.exe
File created	C:\Windows\System32Local\DriverbrokerCrtDhcp.exe	DriverbrokerCrtDhcp.exe
File opened for modification	C:\Windows\System32Local\DriverbrokerCrtDhcp.exe	DriverbrokerCrtDhcp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XenoSetup(1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2868	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3528	schtasks.exe
3552	schtasks.exe
3584	schtasks.exe
3780	schtasks.exe
3808	schtasks.exe
3840	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2132	powershell.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe
2460	DriverbrokerCrtDhcp.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2132	powershell.exe
Token: SeDebugPrivilege	2460	DriverbrokerCrtDhcp.exe
Token: SeDebugPrivilege	3956	DriverbrokerCrtDhcp.exe
Token: SeDebugPrivilege	3452	DriverbrokerCrtDhcp.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 2132	1036	3d79293d371d3393d83f0d6205c35263baa3618a6f3ccba4fcefbee999d4a714.exe	30
PID 1036 wrote to memory of 2132	1036	3d79293d371d3393d83f0d6205c35263baa3618a6f3ccba4fcefbee999d4a714.exe	30
PID 1036 wrote to memory of 2132	1036	3d79293d371d3393d83f0d6205c35263baa3618a6f3ccba4fcefbee999d4a714.exe	30
PID 1036 wrote to memory of 1712	1036	3d79293d371d3393d83f0d6205c35263baa3618a6f3ccba4fcefbee999d4a714.exe	32
PID 1036 wrote to memory of 1712	1036	3d79293d371d3393d83f0d6205c35263baa3618a6f3ccba4fcefbee999d4a714.exe	32
PID 1036 wrote to memory of 1712	1036	3d79293d371d3393d83f0d6205c35263baa3618a6f3ccba4fcefbee999d4a714.exe	32
PID 1036 wrote to memory of 1712	1036	3d79293d371d3393d83f0d6205c35263baa3618a6f3ccba4fcefbee999d4a714.exe	32
PID 1036 wrote to memory of 1712	1036	3d79293d371d3393d83f0d6205c35263baa3618a6f3ccba4fcefbee999d4a714.exe	32
PID 1036 wrote to memory of 1712	1036	3d79293d371d3393d83f0d6205c35263baa3618a6f3ccba4fcefbee999d4a714.exe	32
PID 1036 wrote to memory of 1712	1036	3d79293d371d3393d83f0d6205c35263baa3618a6f3ccba4fcefbee999d4a714.exe	32
PID 1036 wrote to memory of 2828	1036	3d79293d371d3393d83f0d6205c35263baa3618a6f3ccba4fcefbee999d4a714.exe	33
PID 1036 wrote to memory of 2828	1036	3d79293d371d3393d83f0d6205c35263baa3618a6f3ccba4fcefbee999d4a714.exe	33
PID 1036 wrote to memory of 2828	1036	3d79293d371d3393d83f0d6205c35263baa3618a6f3ccba4fcefbee999d4a714.exe	33
PID 1712 wrote to memory of 2804	1712	XenoSetup(1).exe	34
PID 1712 wrote to memory of 2804	1712	XenoSetup(1).exe	34
PID 1712 wrote to memory of 2804	1712	XenoSetup(1).exe	34
PID 1712 wrote to memory of 2804	1712	XenoSetup(1).exe	34
PID 2804 wrote to memory of 2764	2804	WScript.exe	36
PID 2804 wrote to memory of 2764	2804	WScript.exe	36
PID 2804 wrote to memory of 2764	2804	WScript.exe	36
PID 2804 wrote to memory of 2764	2804	WScript.exe	36
PID 2764 wrote to memory of 2868	2764	cmd.exe	38
PID 2764 wrote to memory of 2868	2764	cmd.exe	38
PID 2764 wrote to memory of 2868	2764	cmd.exe	38
PID 2764 wrote to memory of 2868	2764	cmd.exe	38
PID 2764 wrote to memory of 2460	2764	cmd.exe	39
PID 2764 wrote to memory of 2460	2764	cmd.exe	39
PID 2764 wrote to memory of 2460	2764	cmd.exe	39
PID 2764 wrote to memory of 2460	2764	cmd.exe	39
PID 2460 wrote to memory of 3608	2460	DriverbrokerCrtDhcp.exe	44
PID 2460 wrote to memory of 3608	2460	DriverbrokerCrtDhcp.exe	44
PID 2460 wrote to memory of 3608	2460	DriverbrokerCrtDhcp.exe	44
PID 3608 wrote to memory of 3652	3608	csc.exe	46
PID 3608 wrote to memory of 3652	3608	csc.exe	46
PID 3608 wrote to memory of 3652	3608	csc.exe	46
PID 2460 wrote to memory of 3692	2460	DriverbrokerCrtDhcp.exe	47
PID 2460 wrote to memory of 3692	2460	DriverbrokerCrtDhcp.exe	47
PID 2460 wrote to memory of 3692	2460	DriverbrokerCrtDhcp.exe	47
PID 3692 wrote to memory of 3736	3692	csc.exe	49
PID 3692 wrote to memory of 3736	3692	csc.exe	49
PID 3692 wrote to memory of 3736	3692	csc.exe	49
PID 2460 wrote to memory of 3880	2460	DriverbrokerCrtDhcp.exe	53
PID 2460 wrote to memory of 3880	2460	DriverbrokerCrtDhcp.exe	53
PID 2460 wrote to memory of 3880	2460	DriverbrokerCrtDhcp.exe	53
PID 3880 wrote to memory of 3916	3880	cmd.exe	55
PID 3880 wrote to memory of 3916	3880	cmd.exe	55
PID 3880 wrote to memory of 3916	3880	cmd.exe	55
PID 3880 wrote to memory of 3924	3880	cmd.exe	56
PID 3880 wrote to memory of 3924	3880	cmd.exe	56
PID 3880 wrote to memory of 3924	3880	cmd.exe	56
PID 3880 wrote to memory of 3956	3880	cmd.exe	57
PID 3880 wrote to memory of 3956	3880	cmd.exe	57
PID 3880 wrote to memory of 3956	3880	cmd.exe	57
PID 3500 wrote to memory of 3452	3500	taskeng.exe	59
PID 3500 wrote to memory of 3452	3500	taskeng.exe	59
PID 3500 wrote to memory of 3452	3500	taskeng.exe	59

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3d79293d371d3393d83f0d6205c35263baa3618a6f3ccba4fcefbee999d4a714.exe
C:\Users\Admin\AppData\Local\Temp\3d79293d371d3393d83f0d6205c35263baa3618a6f3ccba4fcefbee999d4a714.exe cmd /c %SIGILL% "SIGTERM|DELETE|SIGKILL"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XenoSetup(1).exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2132
- C:\Users\Admin\AppData\Local\Temp\XenoSetup(1).exe
  "C:\Users\Admin\AppData\Local\Temp\XenoSetup(1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\portBrokerDll\2jfojLJgRy.vbe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\portBrokerDll\Ac4k16M5JuZ3cBUzCeuZfRwt20LYrImECkDEo2qhe7JRV.bat" "
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2764
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2868
    - - C:\portBrokerDll\DriverbrokerCrtDhcp.exe
        
        "C:\portBrokerDll/DriverbrokerCrtDhcp.exe"
        5⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2460
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mqbbmfx1\mqbbmfx1.cmdline"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3608
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES963.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE9408DD6A80E4D5798A24B5A32BDF4BF.TMP"
        7⤵
        
        PID:3652
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\blhe3l4a\blhe3l4a.cmdline"
        6⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3692
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9D0.tmp" "c:\Windows\System32\CSC46B410E6D9884E0E9FA253EEDF3B0B6.TMP"
        7⤵
        
        PID:3736
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WzFg7tpK1X.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3880
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3916
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:3924
        
        C:\Windows\System32Local\DriverbrokerCrtDhcp.exe
        
        "C:\Windows\System32Local\DriverbrokerCrtDhcp.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3956
- C:\Users\Admin\AppData\Local\Temp\Xeno.exe
  "C:\Users\Admin\AppData\Local\Temp\Xeno.exe"
  2⤵
  - Executes dropped EXE
  PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DriverbrokerCrtDhcpD" /sc MINUTE /mo 14 /tr "'C:\Windows\System32Local\DriverbrokerCrtDhcp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DriverbrokerCrtDhcp" /sc ONLOGON /tr "'C:\Windows\System32Local\DriverbrokerCrtDhcp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DriverbrokerCrtDhcpD" /sc MINUTE /mo 9 /tr "'C:\Windows\System32Local\DriverbrokerCrtDhcp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DriverbrokerCrtDhcpD" /sc MINUTE /mo 11 /tr "'C:\portBrokerDll\DriverbrokerCrtDhcp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DriverbrokerCrtDhcp" /sc ONLOGON /tr "'C:\portBrokerDll\DriverbrokerCrtDhcp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DriverbrokerCrtDhcpD" /sc MINUTE /mo 13 /tr "'C:\portBrokerDll\DriverbrokerCrtDhcp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3840

C:\Windows\system32\taskeng.exe
taskeng.exe {CACA4264-DE3C-4D27-AF56-1418A37C293F} S-1-5-21-3533259084-2542256011-65585152-1000:XPAJOTIY\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:3500
- C:\portBrokerDll\DriverbrokerCrtDhcp.exe
  C:\portBrokerDll\DriverbrokerCrtDhcp.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES963.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES963.tmp
Size 1KB
SHA256 8c2dd2dbf005a9e045bd86d61a391cc0b51623bb69397cafceaf1b84f3fad7e2
MD5 123e93f1a46cb26798ada8ecc147a585
SHA1 66f10400c0af79c79bb2b19c6f55a1ac02353ca4
SHA512 70ceaf5767a3975c353190982fc3a0c5a5423b802939af4ed6b387d9c7613b62d44acab4e5ba03eba0249c1b9e41bb15c61d56fa1a933dd3db33e2e70f4d8864
MD5 SHA1 SHA512

Submit Download

RES9D0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9D0.tmp
Size 1KB
SHA256 f6e699f83d56b40e870af4f4f9595adfecbfba20e5936c1c9c80af890ff1de86
MD5 dfee87b147b406c590d76db4adbc6cd6
SHA1 d0d1fdfe432fd175cf5e474014c567790566ef0e
SHA512 c13f2fd7a6ca0f6c877d74ba8ecffca37c8a359fbd019bb70ae2cfcfc245c06973aa2a17978ad39bb5bdedde8740be9a2d41ba7cc91667e1c3630252b8fea5c2
MD5 SHA1 SHA512

Submit Download

WzFg7tpK1X.bat

Path C:\Users\Admin\AppData\Local\Temp\WzFg7tpK1X.bat
Size 224B
SHA256 e89166148c4c29420b29c9c3dd3221646e261e59ee748b0a42ec3a2d8d55059c
MD5 f8a1f8893ab1d1c65b4788c4309f2380
SHA1 31f913354dee07ff4533d20a55b01ecfa994bdba
SHA512 a761d5b77206098b961570282a5b5d5ea8e99acf2cbd38554a9670b0a5c40d4ae501be114117c606e08af1cca020302276435b9a1e772121b6230804e9aafc72
MD5 SHA1 SHA512

Submit Download

Xeno.exe

Path C:\Users\Admin\AppData\Local\Temp\Xeno.exe
Size 3.5MB
SHA256 4d3b4ef0ec929ebd649637f55aabd856954e3d6424ac337a17ee4bb65ec2e8f3
MD5 056586e6a4d9b97c77fd606b2a63f604
SHA1 b13e10949df28f3944c68b950617a641ea20491b
SHA512 da2c4066a7975ede5c1645d6cd82f0499b452a021d18aa86ad64130efc9f1da2270be30a7af89b4cce97b0eb13c27f55f37c70db5f2f6aa4a2b5a54dcae72cc0
SSDEEP 3072:rjK4UGDHXrQ8hy7qgpHulWD9ZvZ5Pf3Ca10xuZ04ntfOUhBu7R:rjK4TDUqgpqWDLZ5H+xuZ04nhA
MD5 SHA1 SHA512 SSDEEP

Submit Download

XenoSetup(1).exe

Path C:\Users\Admin\AppData\Local\Temp\XenoSetup(1).exe
Size 3.5MB
SHA256 eae94b757fe5e150f8f1039140feebc969788bd2c0ef7fe2d4675a81f6dc9898
MD5 bcf49847a74e554a807294d4f5adfa62
SHA1 c6f105b28ac3bc7dd2e4a444cf96edbcdc45febf
SHA512 489cf5844853a4ba7489386a545d0369e1eca835a70053aa6e408aed7f42eaa26684859ddf50b874c643c53ae050dcd3d1a27e887e413c8db8636818ba7dcdcf
SSDEEP 98304:iYZazh3piA6B85AR1lznmf/50X4ajKeSHqCwvHJ7pP2P:azh3pgBzHZs50X5YMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

2jfojLJgRy.vbe

Path C:\portBrokerDll\2jfojLJgRy.vbe
Size 237B
SHA256 5d612089c06bbe2b32de8bfcc3e0ba1e0ef2155cd6cde83b280797c6061ca269
MD5 851d51cdee60a57d4aef51ea7f466436
SHA1 34a13967e69d21091850d4f0dffb2bce88c80e0c
SHA512 7fed60da3ed3ff2a26b8b4cadf0cf6cd3e28259a4a7ec7e3ba97509fa47b7ca75753ca49edf2f218ae323830977c2ecdfb2f05b6fa5de303038c31012926e953
MD5 SHA1 SHA512

Submit Download

Ac4k16M5JuZ3cBUzCeuZfRwt20LYrImECkDEo2qhe7JRV.bat

Path C:\portBrokerDll\Ac4k16M5JuZ3cBUzCeuZfRwt20LYrImECkDEo2qhe7JRV.bat
Size 194B
SHA256 3041cc5e5c4251ea1eddccaa5d145446719d6e86dcfd3bc40bc23c80b3102ec2
MD5 69c0edf85b6d3ab82c42e82ef04f50f7
SHA1 7acb4d2454d9e04db488c2ee4352cfece1b8ae58
SHA512 04877f967609e6efb4a8c4f99c4130b3894eb223f390d32c6e2248abaf1bdff71f539f122635f18fa432648b927cc597dd7bdaa52284824f8c57c7909f7dca21
MD5 SHA1 SHA512

Submit Download

CSCE9408DD6A80E4D5798A24B5A32BDF4BF.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCE9408DD6A80E4D5798A24B5A32BDF4BF.TMP
Size 1KB
SHA256 37aac241c050fb90090b36441ae1f198d11a0da4ee5f30e3332673f3c6ecf40a
MD5 dc289c30c143fd2f8e608119ae4846a0
SHA1 2f0d6888b80d26d9ff52b5decdd63963255e5113
SHA512 68bffd2b69ee9d5857fc9d5b2a71561a985738b5fe0768fc7dd23a753c976529158042f2a239ffe74ed99b5bd4b469fd2220a990d20a742935f5560a55f2d6fd
MD5 SHA1 SHA512

Submit Download

blhe3l4a.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\blhe3l4a\blhe3l4a.0.cs
Size 380B
SHA256 92d93c096ad4de2727ebffc66c014bf6265e46fdb1e39d4580de58a62ed9eec9
MD5 35cfd5bdf6acecc29104bda98cdf67b3
SHA1 1fbec3b88c55d864d2e9906cf4c67146d6d0078c
SHA512 465332c7685806c9b6c9f9c69467531de188668aedc329454ea924c36bd051c4f8a16fd91d5937c8f209f81dcf760b9974ddf164857219024be1d1d7d28e689c
MD5 SHA1 SHA512

Submit Download

blhe3l4a.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\blhe3l4a\blhe3l4a.cmdline
Size 235B
SHA256 be0783d69beb690113df0573d4cc3d5527cfbedc08f51a1e418f1c3941ff4fcf
MD5 b15565c380be0455f3ab19d01aad6e0e
SHA1 a478a3ce23a6a700316e185a3154a621220db9dc
SHA512 27a58804a827a236673c345769f6697fe470f1c576c1614b7dbf7688f98f305e24ba271cbeceb78f75946da166374e01ea3be12d418028d189c731884a48212f
MD5 SHA1 SHA512

Submit Download

mqbbmfx1.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\mqbbmfx1\mqbbmfx1.0.cs
Size 400B
SHA256 6172b66f8bdc0665cac7021aa87ec14bd45852f3e74eb059c639272770aeca02
MD5 2a084a896790ecd402e12b082d66e5cf
SHA1 ba0847e0b631024328088529fa479ba627ca9597
SHA512 4c17204c80ec768b6f3825f92ffaf6e32fa8c5f718e583bceb184b499e6158cac2bb82a750f1e9dcb8828dc5894c6b1855df523612b388e4b09aae3ca26a89f2
MD5 SHA1 SHA512

Submit Download

mqbbmfx1.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\mqbbmfx1\mqbbmfx1.cmdline
Size 255B
SHA256 7092cbc7ed1915e57159c971eb3f264b5bf54f31c7ecb4cd5768ec4470793436
MD5 ed51228ebf4129520d8569f809eec3d7
SHA1 c7bc848e7da4d04cad991c3f585fe1ececd72ce6
SHA512 2f49a919a4febc7128269505b490875ad289228fd69312ba32957249384b7bdd965b1318c5fd983d06544f6f783c5de9eeba618cdc11e5bdaf4dc4a831010bab
MD5 SHA1 SHA512

Submit Download

CSC46B410E6D9884E0E9FA253EEDF3B0B6.TMP

Path \??\c:\Windows\System32\CSC46B410E6D9884E0E9FA253EEDF3B0B6.TMP
Size 1KB
SHA256 5fdff2a34cc18e36619ff327b292a8255286dc102d85074b7fc625ccbdbe1858
MD5 b74f131aab310dc6e37b43e729c24199
SHA1 bade4cf35d7e80e79880396c1fdd518d9ab78bdf
SHA512 733cb12c94d0a8bedc9a38c073dff2fc46553854d7e835767aaa749b4754beef77fa3bc8232eab21c92bc808c08b150cafe5c035bb33d82292fbf76fec55d885
MD5 SHA1 SHA512

Submit Download

DriverbrokerCrtDhcp.exe

Path \portBrokerDll\DriverbrokerCrtDhcp.exe
Size 3.3MB
SHA256 884de0ba4d113a1674b112f76b7d6af9bb11c562d6b58155e974e549694e0f58
MD5 c9d8bce0425ed81346b9a43f148d948b
SHA1 d3bcb8f02ef3732ffa70fc798cd4ad3d77bbbde6
SHA512 60e0d21db0518d66f4546dceb978b15d2eb87347cc1676b7420eb2a6c4c1c6fa947d31ae8cb70ce880b76f931702aaab51c46f559dd91a49c9a4bdc83b75368b
SSDEEP 98304:2azh3piA6B85AR1lznmf/50X4ajKeSHqCwvHJ7pP2U:hzh3pgBzHZs50X5YM9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1036-1-0x00000000011E0000-0x0000000001562000-memory.dmp

Download

memory/1036-0-0x000007FEF6003000-0x000007FEF6004000-memory.dmp

Download

memory/2132-8-0x00000000021D0000-0x00000000021D8000-memory.dmp

Download

memory/2132-7-0x000000001B630000-0x000000001B912000-memory.dmp

Download

memory/2132-6-0x0000000002AE0000-0x0000000002B60000-memory.dmp

Download

memory/2460-56-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-3596-0x0000000000500000-0x000000000051C000-memory.dmp

Download

memory/2460-40-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-42-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-98-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-96-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-92-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-90-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-88-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-86-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-84-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-82-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-80-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-78-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-76-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-72-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-70-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-68-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-66-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-64-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-60-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-75-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-52-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-48-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-46-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-45-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-3592-0x00000000004A0000-0x00000000004C6000-memory.dmp

Download

memory/2460-3594-0x0000000000300000-0x000000000030E000-memory.dmp

Download

memory/2460-3598-0x0000000000310000-0x0000000000320000-memory.dmp

Download

memory/2460-3602-0x00000000004D0000-0x00000000004E0000-memory.dmp

Download

memory/2460-3600-0x00000000005A0000-0x00000000005B8000-memory.dmp

Download

memory/2460-94-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-3604-0x00000000004E0000-0x00000000004F0000-memory.dmp

Download

memory/2460-3606-0x00000000005C0000-0x00000000005CE000-memory.dmp

Download

memory/2460-3608-0x00000000005D0000-0x00000000005DC000-memory.dmp

Download

memory/2460-3610-0x0000000000760000-0x000000000076E000-memory.dmp

Download

memory/2460-3612-0x0000000000790000-0x00000000007A2000-memory.dmp

Download

memory/2460-3614-0x0000000000770000-0x0000000000780000-memory.dmp

Download

memory/2460-3616-0x00000000008E0000-0x00000000008F6000-memory.dmp

Download

memory/2460-3618-0x0000000002150000-0x0000000002162000-memory.dmp

Download

memory/2460-3620-0x0000000000780000-0x000000000078E000-memory.dmp

Download

memory/2460-3622-0x00000000007B0000-0x00000000007C0000-memory.dmp

Download

memory/2460-3624-0x00000000007C0000-0x00000000007D0000-memory.dmp

Download

memory/2460-3626-0x000000001A930000-0x000000001A98A000-memory.dmp

Download

memory/2460-3628-0x0000000000900000-0x000000000090E000-memory.dmp

Download

memory/2460-3634-0x00000000021B0000-0x00000000021C8000-memory.dmp

Download

memory/2460-3632-0x0000000002180000-0x000000000218E000-memory.dmp

Download

memory/2460-3630-0x0000000002170000-0x0000000002180000-memory.dmp

Download

memory/2460-3638-0x000000001B9B0000-0x000000001B9FE000-memory.dmp

Download

memory/2460-3636-0x0000000002190000-0x000000000219C000-memory.dmp

Download

memory/2460-62-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-58-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-54-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-50-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-36-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-38-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-35-0x000000001AD70000-0x000000001B109000-memory.dmp

Download

memory/2460-34-0x000000001AD70000-0x000000001B110000-memory.dmp

Download

memory/2460-33-0x0000000000910000-0x0000000000918000-memory.dmp

Download

memory/3452-7255-0x0000000000970000-0x0000000000978000-memory.dmp

Download

memory/3956-3673-0x0000000000AD0000-0x0000000000AD8000-memory.dmp

Download