dcrat | 524eadc0b5758167ac92dbfbf5b6119abefe8648eaf3c1171ab8a227d3720611

General

Target

0f9e8c0ca92989e50a62c5ea1e47eb74.exe
Size

2.7MB
MD5

0f9e8c0ca92989e50a62c5ea1e47eb74
SHA1

6076489eb7df53fe1116b3dfd0ff5d87cdfeb3d6
SHA256

524eadc0b5758167ac92dbfbf5b6119abefe8648eaf3c1171ab8a227d3720611
SHA512

8819dc1e48e2343d29ee0420a598ee4e062a19b36190af80a204f08a28cde1e3cbe097d438566d1b12cf3d37f1afb889060fb9b141840de1d005be5087302970
SSDEEP

49152:yqyJUSQelMhlk1w19BlUobhENGZXxRWi0UAuqYqqnc:PyJlQgGk1wPko1oO30UA7Yqq

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 21 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3688	3228	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	3228	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	3228	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4712	3228	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	3228	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	3228	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4208	3228	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	684	3228	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	3228	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3404	3228	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	3228	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	3228	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	3228	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	3228	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	3228	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3172	3228	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3808	3228	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1808	3228	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4008	3228	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3464	3228	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	3228	schtasks.exe	83

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0f9e8c0ca92989e50a62c5ea1e47eb74.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3396-1-0x00000000004E0000-0x0000000000794000-memory.dmp	dcrat
behavioral2/files/0x000a000000023b6e-30.dat	dcrat
behavioral2/files/0x0010000000023b79-97.dat	dcrat
behavioral2/files/0x000b000000023b70-119.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	0f9e8c0ca92989e50a62c5ea1e47eb74.exe

Executes dropped EXE 1 IoCs

pid	Process
3372	StartMenuExperienceHost.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	StartMenuExperienceHost.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\RCX90C1.tmp	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX8EBC.tmp	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\121e5b5079f7c0	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX8EAB.tmp	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\RCX913F.tmp	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
File created	C:\Program Files\Java\jdk-1.8\bin\6203df4a6bafc7	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
File created	C:\Program Files\Java\jdk-1.8\sppsvc.exe	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\en-US\RCX95D6.tmp	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\en-US\RCX9654.tmp	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
File created	C:\Program Files\WindowsApps\sysmon.exe	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\sppsvc.exe	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\lsass.exe	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
File created	C:\Program Files\Java\jdk-1.8\bin\lsass.exe	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
File created	C:\Program Files\Java\jdk-1.8\0a1fd5f707cd16	0f9e8c0ca92989e50a62c5ea1e47eb74.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\Downloaded Program Files\sysmon.exe	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
File opened for modification	C:\Windows\Downloaded Program Files\sysmon.exe	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
File opened for modification	C:\Windows\Downloaded Program Files\RCX884D.tmp	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
File created	C:\Windows\ja-JP\ea1d8f6d871115	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
File opened for modification	C:\Windows\ja-JP\upfc.exe	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
File opened for modification	C:\Windows\Containers\serviced\RCX8C87.tmp	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
File opened for modification	C:\Windows\Containers\serviced\StartMenuExperienceHost.exe	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
File created	C:\Windows\ja-JP\upfc.exe	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
File created	C:\Windows\Containers\serviced\StartMenuExperienceHost.exe	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
File opened for modification	C:\Windows\Downloaded Program Files\RCX884C.tmp	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
File opened for modification	C:\Windows\ja-JP\RCX8A62.tmp	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
File opened for modification	C:\Windows\ja-JP\RCX8A72.tmp	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
File opened for modification	C:\Windows\Containers\serviced\RCX8CA7.tmp	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
File created	C:\Windows\Downloaded Program Files\121e5b5079f7c0	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
File created	C:\Windows\Containers\serviced\55b276f4edf653	0f9e8c0ca92989e50a62c5ea1e47eb74.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	0f9e8c0ca92989e50a62c5ea1e47eb74.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1552	schtasks.exe
3464	schtasks.exe
2040	schtasks.exe
4712	schtasks.exe
2316	schtasks.exe
4208	schtasks.exe
684	schtasks.exe
4764	schtasks.exe
1892	schtasks.exe
2864	schtasks.exe
1808	schtasks.exe
1612	schtasks.exe
3688	schtasks.exe
1556	schtasks.exe
3404	schtasks.exe
4648	schtasks.exe
3172	schtasks.exe
1564	schtasks.exe
1312	schtasks.exe
3808	schtasks.exe
4008	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3396	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
3396	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
3396	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
3372	StartMenuExperienceHost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3396	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
Token: SeDebugPrivilege	3372	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 532	3396	0f9e8c0ca92989e50a62c5ea1e47eb74.exe	106
PID 3396 wrote to memory of 532	3396	0f9e8c0ca92989e50a62c5ea1e47eb74.exe	106
PID 532 wrote to memory of 4440	532	cmd.exe	108
PID 532 wrote to memory of 4440	532	cmd.exe	108
PID 532 wrote to memory of 3372	532	cmd.exe	117
PID 532 wrote to memory of 3372	532	cmd.exe	117

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0f9e8c0ca92989e50a62c5ea1e47eb74.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0f9e8c0ca92989e50a62c5ea1e47eb74.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\0f9e8c0ca92989e50a62c5ea1e47eb74.exe
"C:\Users\Admin\AppData\Local\Temp\0f9e8c0ca92989e50a62c5ea1e47eb74.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Xsfud8LVuy.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:532
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4440
- - C:\Windows\Containers\serviced\StartMenuExperienceHost.exe
    "C:\Windows\Containers\serviced\StartMenuExperienceHost.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:3372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Windows\Downloaded Program Files\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\Downloaded Program Files\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Windows\Downloaded Program Files\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Windows\ja-JP\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\ja-JP\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Windows\ja-JP\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Windows\Containers\serviced\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\Containers\serviced\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Windows\Containers\serviced\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files\Java\jdk-1.8\bin\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Java\jdk-1.8\bin\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files\Java\jdk-1.8\bin\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Java\jdk-1.8\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Java\jdk-1.8\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Program Files\Java\jdk-1.8\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Downloads\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default\Downloads\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Downloads\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe

Filesize
2.7MB

MD5
80b32b9cee6269c5b10154bbbf7e7f87

SHA1
a51ebf8caa9ff961160b5ca9fdc84c7593d5b557

SHA256
af02e4a4c49d17f511fb1b52a14650448cc66861a018d28aba7d0216b7bf5527

SHA512
1affb108727b90f03d2dc41c0a620d97341b0727cb5df442adbb3671e449bdfc4d9cd6cf0545f3b9ee3937dc5b6f6c38ce1c7ed5738ee44c29ad6dffede65717

Download Submit
C:\Program Files\Java\jdk-1.8\sppsvc.exe

Filesize
2.7MB

MD5
0f9e8c0ca92989e50a62c5ea1e47eb74

SHA1
6076489eb7df53fe1116b3dfd0ff5d87cdfeb3d6

SHA256
524eadc0b5758167ac92dbfbf5b6119abefe8648eaf3c1171ab8a227d3720611

SHA512
8819dc1e48e2343d29ee0420a598ee4e062a19b36190af80a204f08a28cde1e3cbe097d438566d1b12cf3d37f1afb889060fb9b141840de1d005be5087302970

Download Submit
C:\Program Files\Java\jdk-1.8\sppsvc.exe

Filesize
2.7MB

MD5
6331ee6637268e8737e8fa5e2f5cae96

SHA1
d767d24beaf81bd9967ca0476b91951a35b3904c

SHA256
eb943cc4f4eb1db55b3a1a7c6340ccb283886652bc869ebc43d7749d8276e30d

SHA512
fe7493bd7cee0af2def03168b6438ec3dc6a0bd44d63a0df9ca66d2607345aa79f255093ff3841fcf92c45b00f51157eab8f3a6c13f7909aa4bf8e254d7991ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Xsfud8LVuy.bat

Filesize
223B

MD5
e7e4c06b245197ef9dc96373fef66f74

SHA1
25a60649e62978576bf06d3d44fc31e952ee7c62

SHA256
33e0d791760bc18f860dba8ac9456d19b00152f7423aa3dff270f2de5cf56b87

SHA512
6617a0870462595db1c1fd3bbd81831a6f93a3cea80f3e0da805f2ef405848de3b311bd9a6bd8927e5b6e36b029b9a812ce1494b756d296098775f43177da86e

Download Submit
memory/3396-12-0x000000001BA30000-0x000000001BA38000-memory.dmp

Filesize
32KB

Download
memory/3396-17-0x000000001BC40000-0x000000001BC4C000-memory.dmp

Filesize
48KB

Download
memory/3396-9-0x000000001BA20000-0x000000001BA28000-memory.dmp

Filesize
32KB

Download
memory/3396-8-0x000000001BA00000-0x000000001BA16000-memory.dmp

Filesize
88KB

Download
memory/3396-7-0x000000001B3A0000-0x000000001B3B0000-memory.dmp

Filesize
64KB

Download
memory/3396-10-0x000000001BA40000-0x000000001BA4A000-memory.dmp

Filesize
40KB

Download
memory/3396-6-0x00000000010E0000-0x00000000010E8000-memory.dmp

Filesize
32KB

Download
memory/3396-11-0x000000001BAA0000-0x000000001BAF6000-memory.dmp

Filesize
344KB

Download
memory/3396-0-0x00007FFD6F323000-0x00007FFD6F325000-memory.dmp

Filesize
8KB

Download
memory/3396-13-0x000000001BAF0000-0x000000001BB02000-memory.dmp

Filesize
72KB

Download
memory/3396-14-0x000000001C050000-0x000000001C578000-memory.dmp

Filesize
5.2MB

Download
memory/3396-5-0x000000001BA50000-0x000000001BAA0000-memory.dmp

Filesize
320KB

Download
memory/3396-16-0x000000001BB30000-0x000000001BB38000-memory.dmp

Filesize
32KB

Download
memory/3396-19-0x000000001BB50000-0x000000001BB5C000-memory.dmp

Filesize
48KB

Download
memory/3396-18-0x000000001BB40000-0x000000001BB4E000-memory.dmp

Filesize
56KB

Download
memory/3396-15-0x000000001BB20000-0x000000001BB28000-memory.dmp

Filesize
32KB

Download
memory/3396-20-0x000000001BB60000-0x000000001BB6A000-memory.dmp

Filesize
40KB

Download
memory/3396-21-0x000000001BB70000-0x000000001BB7C000-memory.dmp

Filesize
48KB

Download
memory/3396-4-0x000000001B380000-0x000000001B39C000-memory.dmp

Filesize
112KB

Download
memory/3396-3-0x00000000010D0000-0x00000000010DE000-memory.dmp

Filesize
56KB

Download
memory/3396-2-0x00007FFD6F320000-0x00007FFD6FDE1000-memory.dmp

Filesize
10.8MB

Download
memory/3396-128-0x00007FFD6F320000-0x00007FFD6FDE1000-memory.dmp

Filesize
10.8MB

Download
memory/3396-1-0x00000000004E0000-0x0000000000794000-memory.dmp

Filesize
2.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads