dcrat | ee930b7c7d01783de8fb24c9f40924a4e9da49033951a450c63d046f2a2ce3ee

Analysis

max time kernel
118s
max time network
154s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
16/01/2025, 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DCRatBuild.exe
Size

1.2MB
MD5

1c4d40bb27938ee8ccbe1b09a8a76ba6
SHA1

dc2266dc5b7b265221c7c9315267067c8fe76d92
SHA256

ee930b7c7d01783de8fb24c9f40924a4e9da49033951a450c63d046f2a2ce3ee
SHA512

7cb63784b5eeaf73941c2f425d3bcdea4200510929f2e9ba4ff4e6c3983e61fc4514d3a66a5405b8b1c052d07a8cd9784693a4ed26a0656c7d6b7b80121d1daa
SSDEEP

24576:GTbBv5rU8/38TnIPZKN9OJMA+53iE0n3g6s:4BtMTnIPkNomA+53KO

Score

10^/10

dcrat discovery evasion infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Program Files (x86)\\Windows NT\\dwm.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Program Files (x86)\\Windows NT\\dwm.exe\", \"C:\\PortSession\\services.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Program Files (x86)\\Windows NT\\dwm.exe\", \"C:\\PortSession\\services.exe\", \"C:\\MSOCache\\All Users\\winlogon.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Program Files (x86)\\Windows NT\\dwm.exe\", \"C:\\PortSession\\services.exe\", \"C:\\MSOCache\\All Users\\winlogon.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\winlogon.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Program Files (x86)\\Windows NT\\dwm.exe\", \"C:\\PortSession\\services.exe\", \"C:\\MSOCache\\All Users\\winlogon.exe\", \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\winlogon.exe\", \"C:\\PortSession\\MshyperwinSaves.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\dwm.exe\""	MshyperwinSaves.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	1920	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	1920	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	1920	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	1920	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	1920	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	1920	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	1920	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	1920	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	1920	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	764	1920	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2452	1920	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	1920	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	1920	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	1920	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	1920	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	1920	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	1920	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	1920	schtasks.exe	35

DCRat payload 3 IoCs

rat

resource	yara_rule
behavioral1/files/0x00090000000162e9-9.dat	family_dcrat_v2
behavioral1/memory/2656-13-0x0000000000370000-0x0000000000436000-memory.dmp	family_dcrat_v2
behavioral1/memory/1340-52-0x0000000000040000-0x0000000000106000-memory.dmp	family_dcrat_v2

Disables Task Manager via registry modification
evasion

Executes dropped EXE 2 IoCs

pid	Process
2656	MshyperwinSaves.exe
1340	dwm.exe

Loads dropped DLL 2 IoCs

pid	Process
2060	cmd.exe
2060	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\winlogon.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MshyperwinSaves = "\"C:\\PortSession\\MshyperwinSaves.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\dwm.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows NT\\dwm.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows NT\\dwm.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\PortSession\\services.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\PortSession\\services.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\winlogon.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\dwm.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\MSOCache\\All Users\\winlogon.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\MSOCache\\All Users\\winlogon.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\MshyperwinSaves = "\"C:\\PortSession\\MshyperwinSaves.exe\""	MshyperwinSaves.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCFCE2310CDEE54A67A1FA4CC5B7CDDAAD.TMP	csc.exe
File created	\??\c:\Windows\System32\hi5-9c.exe	csc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows NT\dwm.exe	MshyperwinSaves.exe
File created	C:\Program Files (x86)\Windows NT\6cb0b6c459d5d3	MshyperwinSaves.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DCRatBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2648	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2504	schtasks.exe
2080	schtasks.exe
2000	schtasks.exe
2356	schtasks.exe
2068	schtasks.exe
1680	schtasks.exe
2976	schtasks.exe
1668	schtasks.exe
1976	schtasks.exe
1964	schtasks.exe
2152	schtasks.exe
1360	schtasks.exe
1700	schtasks.exe
872	schtasks.exe
2892	schtasks.exe
2964	schtasks.exe
764	schtasks.exe
2452	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe
2656	MshyperwinSaves.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2656	MshyperwinSaves.exe
Token: SeDebugPrivilege	1340	dwm.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2780	2760	DCRatBuild.exe	30
PID 2760 wrote to memory of 2780	2760	DCRatBuild.exe	30
PID 2760 wrote to memory of 2780	2760	DCRatBuild.exe	30
PID 2760 wrote to memory of 2780	2760	DCRatBuild.exe	30
PID 2780 wrote to memory of 2060	2780	WScript.exe	31
PID 2780 wrote to memory of 2060	2780	WScript.exe	31
PID 2780 wrote to memory of 2060	2780	WScript.exe	31
PID 2780 wrote to memory of 2060	2780	WScript.exe	31
PID 2060 wrote to memory of 2648	2060	cmd.exe	33
PID 2060 wrote to memory of 2648	2060	cmd.exe	33
PID 2060 wrote to memory of 2648	2060	cmd.exe	33
PID 2060 wrote to memory of 2648	2060	cmd.exe	33
PID 2060 wrote to memory of 2656	2060	cmd.exe	34
PID 2060 wrote to memory of 2656	2060	cmd.exe	34
PID 2060 wrote to memory of 2656	2060	cmd.exe	34
PID 2060 wrote to memory of 2656	2060	cmd.exe	34
PID 2656 wrote to memory of 2088	2656	MshyperwinSaves.exe	39
PID 2656 wrote to memory of 2088	2656	MshyperwinSaves.exe	39
PID 2656 wrote to memory of 2088	2656	MshyperwinSaves.exe	39
PID 2088 wrote to memory of 2624	2088	csc.exe	41
PID 2088 wrote to memory of 2624	2088	csc.exe	41
PID 2088 wrote to memory of 2624	2088	csc.exe	41
PID 2656 wrote to memory of 952	2656	MshyperwinSaves.exe	57
PID 2656 wrote to memory of 952	2656	MshyperwinSaves.exe	57
PID 2656 wrote to memory of 952	2656	MshyperwinSaves.exe	57
PID 952 wrote to memory of 2428	952	cmd.exe	59
PID 952 wrote to memory of 2428	952	cmd.exe	59
PID 952 wrote to memory of 2428	952	cmd.exe	59
PID 952 wrote to memory of 2460	952	cmd.exe	60
PID 952 wrote to memory of 2460	952	cmd.exe	60
PID 952 wrote to memory of 2460	952	cmd.exe	60
PID 952 wrote to memory of 1340	952	cmd.exe	61
PID 952 wrote to memory of 1340	952	cmd.exe	61
PID 952 wrote to memory of 1340	952	cmd.exe	61

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
"C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\PortSession\xqpjHHWRGdTYQyx20.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\PortSession\XDYOLPKRHAKuDwHqW0UccJnByucTvFaFH95cpSWEjfuEIuyo.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2060
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2648
  - - C:\PortSession\MshyperwinSaves.exe
      "C:\PortSession/MshyperwinSaves.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2656
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wdoxlsly\wdoxlsly.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2088
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES93A8.tmp" "c:\Windows\System32\CSCFCE2310CDEE54A67A1FA4CC5B7CDDAAD.TMP"
        6⤵
        
        PID:2624
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eJ3v69q8iH.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:952
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2428
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2460
      - C:\Program Files (x86)\Windows NT\dwm.exe
        
        "C:\Program Files (x86)\Windows NT\dwm.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows NT\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\PortSession\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\PortSession\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\PortSession\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MshyperwinSavesM" /sc MINUTE /mo 12 /tr "'C:\PortSession\MshyperwinSaves.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MshyperwinSaves" /sc ONLOGON /tr "'C:\PortSession\MshyperwinSaves.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MshyperwinSavesM" /sc MINUTE /mo 14 /tr "'C:\PortSession\MshyperwinSaves.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PortSession\XDYOLPKRHAKuDwHqW0UccJnByucTvFaFH95cpSWEjfuEIuyo.bat

Filesize
185B

MD5
40eeacbd45b33b136564acdeef820b82

SHA1
88310d13eec561a6520301af8898d2ba2f48037e

SHA256
d823cda4ea7894f7826a6a35448d3595d62af25dcd29617cc9c1c34d6b7a2417

SHA512
b00458f55e952c0342d48fb9381fd59d652ce3314c65ac1472c93fc0c71c1b58231192d73b8df71b29aa947695529a75ffc2bdef74b15f42065ed5dcf9c4cf96

Download Submit
C:\PortSession\xqpjHHWRGdTYQyx20.vbe

Filesize
238B

MD5
7f993365424b1bdc372346ab3492e407

SHA1
c558488f2d0a827390c503611f7e780bd8f16847

SHA256
3552a0f16d69b1cd44fb195a06e8f3dd6a5677dd0ddb1b2417d41fce95065835

SHA512
43ea73d8d4224a7fd86735cf8a19c24ee5c167fadfe93ff3da4af20754d49ce9f7eca35f7286ffc1d821118c10891691769fc6da252b94808214462bc4e7c882

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES93A8.tmp

Filesize
1KB

MD5
32cc40d034aba39cd7a64f98737b4619

SHA1
0721586f1f7cdae016245c66a9703f4c154667ba

SHA256
bc9941df9869e40ac617f51dacbb21f6df63f6dcef14f9a9e0959b482589e8a5

SHA512
cc9b63a5183d7583fc43eac7db30d16731ce5eff2afadd23dd8e09237676c9315812c637ebcfd0e6452439073b629a006d6ba3bde3318968b1f766df69775b55

Download Submit
C:\Users\Admin\AppData\Local\Temp\eJ3v69q8iH.bat

Filesize
217B

MD5
8ff608e6bfabf69fa5ba4a25f9416c1e

SHA1
aa2086084f006bd488dd1e97c9d105f1af01ecae

SHA256
370985dcb271a884cafe2aa8a6e3e0909911aadffdabd7630b2d2f1a785a933e

SHA512
1d014ece103a04ff942c99a4fb6da8e5bb976ad9fbb4ffb71f3e6e94dfcded944b8e5f0bca515f9cb23ab94ceb82ef2b14a4026e0b1fb0ec1e20606f20d11442

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wdoxlsly\wdoxlsly.0.cs

Filesize
402B

MD5
6eed7233f67f0ca4b5246720fe01bb77

SHA1
37b596ff76158c6a601d7caff43a7c14e77ed745

SHA256
842c13736c7bfaabef85b0550a17fe29ed71a380df3b693b4b8fa87222ea042c

SHA512
18de31763a65d7f03f9d5aee88bddba164304a8930967c3a7a8b9e00cd307b984c6cf140ec1381873a555dfa13c5c41d50900f306a4e74660593e4e0f3ba3408

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wdoxlsly\wdoxlsly.cmdline

Filesize
235B

MD5
83fbc9b83335322c8f643175557e0737

SHA1
a82fa37901c70b5d8c1e8a67f6e14b5b8a45b785

SHA256
75a25375159278bcbd8f1362f4dce84a3c8cbfcce832d8f81065a16cba975ba8

SHA512
173e9e4b8636ceb3c6cc555571b62b6f6337dd9271a18c22227d55b3ed8a245768e47c47eaae6d836392ba33536c361fbd109be06d9cf4ade8811809a55c4641

Download Submit
\??\c:\Windows\System32\CSCFCE2310CDEE54A67A1FA4CC5B7CDDAAD.TMP

Filesize
1KB

MD5
60a1ebb8f840aad127346a607d80fc19

SHA1
c8b7e9ad601ac19ab90b3e36f811960e8badf354

SHA256
9d6a9d38b7a86cc88e551a0c1172a3fb387b1a5f928ac13993ec3387d39cc243

SHA512
44830cefb264bac520174b4b884312dd0393be33a193d4f0fee3cc3c14deb86ca39e43ef281232f9169fd204d19b22e8a7aad72fa448ca52d5cbc3ee1dbb18a4

Download Submit
\PortSession\MshyperwinSaves.exe

Filesize
769KB

MD5
48c98103b76113d37315de842cc11bdf

SHA1
5959ea78e7ea2a9dcff50b432e3686a4d92661d9

SHA256
71b5e69d1ab4582171d652798fba517dd42fac91d468307df032ca34a1b2bf9d

SHA512
b839a914a29d0b7494c95ef114bb755cf9d3c78a07b83a754203b8d1a3cd40bfa98b6d7b4306a74c75d9c3e52ff2ab9efa4048938b0635109650cd7cebd06ab9

Download Submit
memory/1340-52-0x0000000000040000-0x0000000000106000-memory.dmp

Filesize
792KB

Download
memory/2656-13-0x0000000000370000-0x0000000000436000-memory.dmp

Filesize
792KB

Download
memory/2656-21-0x00000000002E0000-0x00000000002EC000-memory.dmp

Filesize
48KB

Download
memory/2656-19-0x0000000000320000-0x0000000000338000-memory.dmp

Filesize
96KB

Download
memory/2656-17-0x0000000000300000-0x000000000031C000-memory.dmp

Filesize
112KB

Download
memory/2656-15-0x00000000002D0000-0x00000000002DE000-memory.dmp

Filesize
56KB

Download