dcrat | c890d39d06a7d437d44a92b4a3f98e55c9cfb112b9ae8955d098dd5e1b93cd9c

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2025 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DCRatBuild.exe
Size

811KB
MD5

2e4246ce82069e5e1f389e556634d683
SHA1

2beb8cbe24d8775df79abaeb38fae72e96719d08
SHA256

c890d39d06a7d437d44a92b4a3f98e55c9cfb112b9ae8955d098dd5e1b93cd9c
SHA512

db52a5460d82bd1d8a250b2de68e3f0b55e7dbb044ccaf034484782cc2a7bc8e5c546954d3b6587b65be63181bf5f8c0603619d8438fb1c14744438fe78e66a8
SSDEEP

12288:kKIIhtQY47i/eIFdRgbE1ooBQdpW3Ari4VVyZC0+1cXOoxPRq/6:kCaY4gFdRgbiooBQd3iE0n/xa6

Score

10^/10

dcrat execution infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\ssh\\Registry.exe\", \"C:\\Program Files\\7-Zip\\lsass.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\sihost.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\System.exe\""	DCRatBuild.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\ssh\\Registry.exe\", \"C:\\Program Files\\7-Zip\\lsass.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\sihost.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\System.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\""	DCRatBuild.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\ssh\\Registry.exe\", \"C:\\Program Files\\7-Zip\\lsass.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\sihost.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\System.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\DCRatBuild.exe\""	DCRatBuild.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\ssh\\Registry.exe\""	DCRatBuild.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\ssh\\Registry.exe\", \"C:\\Program Files\\7-Zip\\lsass.exe\""	DCRatBuild.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\ssh\\Registry.exe\", \"C:\\Program Files\\7-Zip\\lsass.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\sihost.exe\""	DCRatBuild.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1152	3880	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	3880	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	3880	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	3880	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	772	3880	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3576	3880	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3936	3880	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	3880	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1416	3880	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	3880	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4340	3880	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	3880	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2032	3880	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	3880	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	3880	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4804	3880	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	3880	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3632	3880	schtasks.exe	82

DCRat payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/1124-1-0x0000000000850000-0x0000000000922000-memory.dmp	family_dcrat_v2
behavioral2/files/0x0007000000023cb5-24.dat	family_dcrat_v2

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2276	powershell.exe
3764	powershell.exe
2360	powershell.exe
3408	powershell.exe
3756	powershell.exe
1624	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	DCRatBuild.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\7-Zip\\lsass.exe\""	DCRatBuild.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\7-Zip\\lsass.exe\""	DCRatBuild.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\All Users\\SoftwareDistribution\\sihost.exe\""	DCRatBuild.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\All Users\\SoftwareDistribution\\sihost.exe\""	DCRatBuild.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files\\Common Files\\DESIGNER\\System.exe\""	DCRatBuild.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DCRatBuild = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\DCRatBuild.exe\""	DCRatBuild.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\All Users\\ssh\\Registry.exe\""	DCRatBuild.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\All Users\\ssh\\Registry.exe\""	DCRatBuild.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files\\Common Files\\DESIGNER\\System.exe\""	DCRatBuild.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\WindowsRE\\wininit.exe\""	DCRatBuild.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\WindowsRE\\wininit.exe\""	DCRatBuild.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DCRatBuild = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\DCRatBuild.exe\""	DCRatBuild.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCF7FCEC73D1443886DCEBEBE59C5AD9.TMP	csc.exe
File created	\??\c:\Windows\System32\enb1sa.exe	csc.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\DESIGNER\System.exe	DCRatBuild.exe
File created	C:\Program Files\Common Files\DESIGNER\27d1bcfc3c54e0	DCRatBuild.exe
File created	C:\Program Files\7-Zip\lsass.exe	DCRatBuild.exe
File created	C:\Program Files\7-Zip\6203df4a6bafc7	DCRatBuild.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	DCRatBuild.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2712	schtasks.exe
3576	schtasks.exe
3936	schtasks.exe
4340	schtasks.exe
2956	schtasks.exe
1152	schtasks.exe
1776	schtasks.exe
1416	schtasks.exe
2032	schtasks.exe
2208	schtasks.exe
4804	schtasks.exe
1060	schtasks.exe
3632	schtasks.exe
2108	schtasks.exe
2292	schtasks.exe
772	schtasks.exe
2948	schtasks.exe
1804	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe
1124	DCRatBuild.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1124	DCRatBuild.exe
Token: SeDebugPrivilege	3756	powershell.exe
Token: SeDebugPrivilege	2276	powershell.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	3764	powershell.exe
Token: SeDebugPrivilege	3408	powershell.exe
Token: SeDebugPrivilege	2984	DCRatBuild.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 4860	1124	DCRatBuild.exe	86
PID 1124 wrote to memory of 4860	1124	DCRatBuild.exe	86
PID 4860 wrote to memory of 540	4860	csc.exe	88
PID 4860 wrote to memory of 540	4860	csc.exe	88
PID 1124 wrote to memory of 3408	1124	DCRatBuild.exe	104
PID 1124 wrote to memory of 3408	1124	DCRatBuild.exe	104
PID 1124 wrote to memory of 2360	1124	DCRatBuild.exe	105
PID 1124 wrote to memory of 2360	1124	DCRatBuild.exe	105
PID 1124 wrote to memory of 3764	1124	DCRatBuild.exe	106
PID 1124 wrote to memory of 3764	1124	DCRatBuild.exe	106
PID 1124 wrote to memory of 3756	1124	DCRatBuild.exe	107
PID 1124 wrote to memory of 3756	1124	DCRatBuild.exe	107
PID 1124 wrote to memory of 1624	1124	DCRatBuild.exe	108
PID 1124 wrote to memory of 1624	1124	DCRatBuild.exe	108
PID 1124 wrote to memory of 2276	1124	DCRatBuild.exe	109
PID 1124 wrote to memory of 2276	1124	DCRatBuild.exe	109
PID 1124 wrote to memory of 4432	1124	DCRatBuild.exe	116
PID 1124 wrote to memory of 4432	1124	DCRatBuild.exe	116
PID 4432 wrote to memory of 1516	4432	cmd.exe	118
PID 4432 wrote to memory of 1516	4432	cmd.exe	118
PID 4432 wrote to memory of 3112	4432	cmd.exe	119
PID 4432 wrote to memory of 3112	4432	cmd.exe	119
PID 4432 wrote to memory of 2984	4432	cmd.exe	120
PID 4432 wrote to memory of 2984	4432	cmd.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
"C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\znaksocf\znaksocf.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES83D6.tmp" "c:\Windows\System32\CSCF7FCEC73D1443886DCEBEBE59C5AD9.TMP"
    3⤵
    PID:540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\ssh\Registry.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\SoftwareDistribution\sihost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\DESIGNER\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2276
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ijqDdIQKja.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1516
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3112
- - C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
    "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\ssh\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\All Users\ssh\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\ssh\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files\7-Zip\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\7-Zip\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files\7-Zip\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\SoftwareDistribution\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\All Users\SoftwareDistribution\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\SoftwareDistribution\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\DESIGNER\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Common Files\DESIGNER\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Common Files\DESIGNER\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DCRatBuildD" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DCRatBuild" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DCRatBuildD" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ssh\Registry.exe

Filesize
811KB

MD5
2e4246ce82069e5e1f389e556634d683

SHA1
2beb8cbe24d8775df79abaeb38fae72e96719d08

SHA256
c890d39d06a7d437d44a92b4a3f98e55c9cfb112b9ae8955d098dd5e1b93cd9c

SHA512
db52a5460d82bd1d8a250b2de68e3f0b55e7dbb044ccaf034484782cc2a7bc8e5c546954d3b6587b65be63181bf5f8c0603619d8438fb1c14744438fe78e66a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DCRatBuild.exe.log

Filesize
1KB

MD5
23e95ec462ffa2c6ca8cab1cb8724ab1

SHA1
ee3f5e815831cf925c4f00195cc8f336b6112862

SHA256
c6ed38229b96cfb59e61de06854a1a99a9d6c3285a6b8511a7b60d64caa6979c

SHA512
b92242ea8d3dbcd3de11725995c22f0a747b820cfff7cf44217589289621bdc2a25bb4db0e1f385bd6bc84c15d893fa5dad544e6bab89f072ccb822cd8bd08dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES83D6.tmp

Filesize
1KB

MD5
58f22c361fc4fa825970289a8e225d93

SHA1
5b4371b3a3e8161880e0eb62fe6de70072e8af06

SHA256
57c16348278e5739908f5a1e2a695174d5d3c951dcb7a07b5f5e8ec91c2c9c30

SHA512
5f225936fa893e60cd624ca0cdd8818a0fc25a96a3f1e4329564b4e14c083fd7a4efc4a74a6f6d082a0bbd67a0b3554f45e0793edca0f17d60d47f91092870c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qirxdwnm.qia.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ijqDdIQKja.bat

Filesize
224B

MD5
9d5b7786cd11ad82f6638fc668433d60

SHA1
31a0ac692243b13c856652a5d0376d77409f0b01

SHA256
bef6a0677753408b2fb9f0abb35e51882eb43cd239b3e3cdc4952d664f47bcfc

SHA512
e1d1cd61a1c08e2ed24fe5e8e625387d84e984516b8309eaa8fd5be8eea935d15ff66f83390a38bca2ce84f702ddf5191563071358a841e2f4abbb6130a58ad1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\znaksocf\znaksocf.0.cs

Filesize
367B

MD5
810ddcb0aaff10d1c2f9e90148b21426

SHA1
454228df13ec891adee83963302ac52d240e9f6b

SHA256
36452f588652b98d548595f6b5e3b62a4e8f8ec63be94fd9270783e80dd712b6

SHA512
322911bd0ef61fb830e27a25c044db19503201d16d076a4d79efc9557755ac476c04b689111c60267113209677c651d2af5b40f704aa75a1cc2a66b277e16428

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\znaksocf\znaksocf.cmdline

Filesize
235B

MD5
928c8bd0ea66c01ebb7ad6205bf08782

SHA1
e01dd5234dd941b4a1612d7ee69217b294d103f2

SHA256
31e41406984c84b7d276f2a3e4b445b93104dacfb8fb21dba065a1d5778f16ab

SHA512
e4389b4a0832b3f2abe762c45f4af0ce84ef2f015cf466c8d9319b33d4e6266db1c9082e7188e06df18389b7ff557921446c260f3ff5cfe778938befd24e4f20

Download Submit
\??\c:\Windows\System32\CSCF7FCEC73D1443886DCEBEBE59C5AD9.TMP

Filesize
1KB

MD5
5984679060d0fc54eba47cead995f65a

SHA1
f72bbbba060ac80ac6abedc7b8679e8963f63ebf

SHA256
4104fdf5499f0aa7dd161568257acae002620ec385f2ede2072d4f550ecff433

SHA512
bc8aadfabe5dbb4e3ea5e07a5ccbddd363400005675acda3e9cb414dc75fb0ba74f41b4a6baf34d42f85a9ae0af7d2418420c78b0c643f7243fe93a49b8140b5

Download Submit
memory/1124-7-0x00007FFBF6CA0000-0x00007FFBF7761000-memory.dmp

Filesize
10.8MB

Download
memory/1124-0-0x00007FFBF6CA3000-0x00007FFBF6CA5000-memory.dmp

Filesize
8KB

Download
memory/1124-27-0x00007FFBF6CA0000-0x00007FFBF7761000-memory.dmp

Filesize
10.8MB

Download
memory/1124-26-0x00007FFBF6CA0000-0x00007FFBF7761000-memory.dmp

Filesize
10.8MB

Download
memory/1124-34-0x00007FFBF6CA0000-0x00007FFBF7761000-memory.dmp

Filesize
10.8MB

Download
memory/1124-14-0x00000000029B0000-0x00000000029BC000-memory.dmp

Filesize
48KB

Download
memory/1124-12-0x00000000029A0000-0x00000000029AE000-memory.dmp

Filesize
56KB

Download
memory/1124-28-0x00007FFBF6CA0000-0x00007FFBF7761000-memory.dmp

Filesize
10.8MB

Download
memory/1124-1-0x0000000000850000-0x0000000000922000-memory.dmp

Filesize
840KB

Download
memory/1124-66-0x00007FFBF6CA0000-0x00007FFBF7761000-memory.dmp

Filesize
10.8MB

Download
memory/1124-10-0x000000001B4F0000-0x000000001B508000-memory.dmp

Filesize
96KB

Download
memory/1124-8-0x000000001B850000-0x000000001B8A0000-memory.dmp

Filesize
320KB

Download
memory/1124-6-0x000000001B4D0000-0x000000001B4EC000-memory.dmp

Filesize
112KB

Download
memory/1124-4-0x0000000002990000-0x000000000299E000-memory.dmp

Filesize
56KB

Download
memory/1124-2-0x00007FFBF6CA0000-0x00007FFBF7761000-memory.dmp

Filesize
10.8MB

Download
memory/3756-51-0x000001A828570000-0x000001A828592000-memory.dmp

Filesize
136KB

Download