dcrat | c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f

General

Target

c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Size

783KB
MD5

39a2fdd9e735620442931db84dbc5d80
SHA1

5891b2f85b69d1da5818f71318190201a41b4441
SHA256

c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f
SHA512

c96df05444a24876453208de6ff0601f96781a1862d582e7cbc2ddaad8355a856fd9fae30a3ac95c88beb5c6d1622bb0d0303ee1eabc7092ba684923c73d148b
SSDEEP

12288:GqnOYxdAgpoNeF91rg5iFdr0yQ9gYx+EIpakCYJRU7Q9bWoFzqK:G+OQbpbgsFdAyQvzSqaq8q

Score

10^/10

dcrat defense_evasion discovery infostealer persistence rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	1344	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4432	1344	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	848	1344	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1208	1344	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4252	1344	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	1344	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3332	1344	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	1344	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3912	1344	schtasks.exe	87

UAC bypass 3 TTPs 6 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3864-1-0x0000000000270000-0x000000000033A000-memory.dmp	dcrat
behavioral2/files/0x0007000000023e2f-33.dat	dcrat
behavioral2/files/0x0009000000023e22-57.dat	dcrat
behavioral2/files/0x000a000000023e25-75.dat	dcrat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
22	2316	Process not Found

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\Control Panel\International\Geo\Nation	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\Control Panel\International\Geo\Nation	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe

Executes dropped EXE 2 IoCs

pid	Process
916	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
3564	dllhost.exe

Adds Run key to start application 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\System32\\AarSvc\\winlogon.exe\""	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\PerfLogs\\csrss.exe\""	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\rasdiag\\RuntimeBroker.exe\""	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Windows\\hh\\sysmon.exe\""	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Windows\\WindowsUpdate\\sysmon.exe\""	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\dimsjob\\RuntimeBroker.exe\""	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\Registration\\RuntimeBroker.exe\""	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\BlbEvents\\RuntimeBroker.exe\""	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\ProgramData\\Start Menu\\Idle.exe\""	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\Downloaded Program Files\\dllhost.exe\""	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Public\\Downloads\\smss.exe\""	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\WofTasks\\RuntimeBroker.exe\""	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\WindowsRE\\services.exe\""	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\Vss\\Writers\\Application\\RuntimeBroker.exe\""	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\System32\\comdlg32\\taskhostw.exe\""	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpdate = "\"C:\\Program Files (x86)\\MSBuild\\MicrosoftEdgeUpdate.exe\""	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Windows\\System32\\Windows.Gaming.XboxLive.Storage\\sihost.exe\""	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Default User\\winlogon.exe\""	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe

Drops file in System32 directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\comdlg32\RCXF583.tmp	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File opened for modification	C:\Windows\System32\comdlg32\taskhostw.exe	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File created	C:\Windows\System32\BlbEvents\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File opened for modification	C:\Windows\System32\AarSvc\winlogon.exe	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File created	C:\Windows\System32\WofTasks\RuntimeBroker.exe	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File created	C:\Windows\System32\comdlg32\taskhostw.exe	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File opened for modification	C:\Windows\System32\WofTasks\RCXEA62.tmp	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File opened for modification	C:\Windows\System32\WofTasks\RuntimeBroker.exe	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File created	C:\Windows\System32\comdlg32\ea9f0e6c9e2dcd4dfacdaf29ba21541fb815a988	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File opened for modification	C:\Windows\System32\Windows.Gaming.XboxLive.Storage\sihost.exe	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File created	C:\Windows\System32\dimsjob\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File opened for modification	C:\Windows\System32\BlbEvents\RuntimeBroker.exe	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File created	C:\Windows\System32\dimsjob\RuntimeBroker.exe	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File created	C:\Windows\System32\rasdiag\RuntimeBroker.exe	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File created	C:\Windows\System32\rasdiag\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File created	C:\Windows\System32\AarSvc\winlogon.exe	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File created	C:\Windows\System32\Windows.Gaming.XboxLive.Storage\sihost.exe	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File created	C:\Windows\System32\Windows.Gaming.XboxLive.Storage\66fc9ff0ee96c2b21f0cfded48750ae9e3032bf3	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File opened for modification	C:\Windows\System32\AarSvc\RCXE7F0.tmp	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File opened for modification	C:\Windows\System32\Windows.Gaming.XboxLive.Storage\RCXECD4.tmp	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File opened for modification	C:\Windows\System32\rasdiag\RuntimeBroker.exe	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File created	C:\Windows\System32\AarSvc\cc11b995f2a76da408ea6a601e682e64743153ad	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File created	C:\Windows\System32\WofTasks\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File created	C:\Windows\System32\BlbEvents\RuntimeBroker.exe	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File opened for modification	C:\Windows\System32\dimsjob\RuntimeBroker.exe	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MSBuild\MicrosoftEdgeUpdate.exe	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File created	C:\Program Files (x86)\MSBuild\cab239ce0bfa3ad7f85b2a6335602e3260075169	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File opened for modification	C:\Program Files (x86)\MSBuild\RCXF804.tmp	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File opened for modification	C:\Program Files (x86)\MSBuild\MicrosoftEdgeUpdate.exe	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Downloaded Program Files\dllhost.exe	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File opened for modification	C:\Windows\hh\sysmon.exe	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File opened for modification	C:\Windows\Vss\Writers\Application\RuntimeBroker.exe	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File opened for modification	C:\Windows\Registration\RuntimeBroker.exe	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File created	C:\Windows\hh\sysmon.exe	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File opened for modification	C:\Windows\WindowsUpdate\RCXFA09.tmp	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File created	C:\Windows\Registration\RuntimeBroker.exe	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File created	C:\Windows\WindowsUpdate\121e5b5079f7c0e46d90f99b3864022518bbbda9	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File opened for modification	C:\Windows\WindowsUpdate\sysmon.exe	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File created	C:\Windows\Registration\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File created	C:\Windows\Vss\Writers\Application\RuntimeBroker.exe	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File created	C:\Windows\Vss\Writers\Application\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File created	C:\Windows\Downloaded Program Files\dllhost.exe	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File created	C:\Windows\Downloaded Program Files\5940a34987c99120d96dace90a3f93f329dcad63	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File created	C:\Windows\hh\121e5b5079f7c0e46d90f99b3864022518bbbda9	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File created	C:\Windows\WindowsUpdate\sysmon.exe	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
File opened for modification	C:\Windows\Vss\Writers\Application\RCXF311.tmp	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4032	MicrosoftEdgeUpdate.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000_Classes\Local Settings	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3592	schtasks.exe
1208	schtasks.exe
3912	schtasks.exe
2316	schtasks.exe
1136	schtasks.exe
3984	schtasks.exe
4892	schtasks.exe
2296	schtasks.exe
4432	schtasks.exe
4252	schtasks.exe
4988	schtasks.exe
4084	schtasks.exe
2152	schtasks.exe
4576	schtasks.exe
3332	schtasks.exe
4820	schtasks.exe
3420	schtasks.exe
848	schtasks.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
3864	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
3864	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
3864	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
3864	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
3864	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
3864	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
3864	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
3864	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
3864	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
3864	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
3864	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
3864	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
3864	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
3864	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
3864	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
3864	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
3864	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
3864	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
3864	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
3864	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
3864	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
916	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
916	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
916	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
916	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
916	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
916	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
916	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
916	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
916	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
916	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
916	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
916	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
916	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
916	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
916	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
916	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
916	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
916	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3864	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Token: SeDebugPrivilege	916	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Token: SeDebugPrivilege	3564	dllhost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 3700	3864	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe	99
PID 3864 wrote to memory of 3700	3864	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe	99
PID 3700 wrote to memory of 1340	3700	cmd.exe	101
PID 3700 wrote to memory of 1340	3700	cmd.exe	101
PID 3700 wrote to memory of 916	3700	cmd.exe	102
PID 3700 wrote to memory of 916	3700	cmd.exe	102
PID 916 wrote to memory of 3564	916	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe	112
PID 916 wrote to memory of 3564	916	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe	112

System policy modification 1 TTPs 6 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
"C:\Users\Admin\AppData\Local\Temp\c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7SfpPwHVJc.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1340
- - C:\Users\Admin\AppData\Local\Temp\c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe
    "C:\Users\Admin\AppData\Local\Temp\c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:916
  - - C:\Windows\Downloaded Program Files\dllhost.exe
      "C:\Windows\Downloaded Program Files\dllhost.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\AarSvc\winlogon.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\WofTasks\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:4988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\System32\Windows.Gaming.XboxLive.Storage\sihost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\Application\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\System32\comdlg32\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MicrosoftEdgeUpdate" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\MicrosoftEdgeUpdate.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\WindowsUpdate\sysmon.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:4084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\PerfLogs\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\dimsjob\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Registration\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\ProgramData\Start Menu\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Downloaded Program Files\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\BlbEvents\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Public\Downloads\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\rasdiag\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\hh\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1208

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTg2QTMxQjItRTQzNy00ODkwLUE5REMtN0ZENTQzMDYxRUI0fSIgdXNlcmlkPSJ7NkE4MTY1NTMtNzA4Qi00ODk3LUI4Q0UtNzdEMkUyNzY2N0EyfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7ODM3RjM2NkYtOUJDQS00OTI1LUFFOUItNUVEQUExQzIxRUU0fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDY4ODkiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxOTM2NTgwOTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTk3NTczMDEzIi8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:4032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f.exe.log

Filesize
1KB

MD5
b7c0c43fc7804baaa7dc87152cdc9554

SHA1
1bab62bd56af745678d4e967d91e1ccfdeed4038

SHA256
46386a61f3aaf1b1c2e6efc9fc7e9e9ff16cd13ae58b8d856835771fedb6d457

SHA512
9fda3dd00a3406137e0113f13f78e77b20a76512b35820d38df696842cbbf2e2ebabfb99a3846c9637ecb54af858ec1551521187e379872973006426a253f769

Download Submit
C:\Users\Admin\AppData\Local\Temp\7SfpPwHVJc.bat

Filesize
266B

MD5
575b9d466cc254a2cfeb4eaabd45950a

SHA1
1c5871df26fb1f7887380167d9fbb2d6edd54291

SHA256
f1f09e8aacf783dc18e0634290854da6c74f6a271369be9ead534fdb909691ef

SHA512
91b9d766809fd629c9e7610bb59b519d10a8e4567fa0db94ee5b14a0d017df87cf249613f9d05e5545d580df3cc525a8afe734d14f84e60a06f0ca4bfb852418

Download Submit
C:\Users\Default\RCXF10C.tmp

Filesize
783KB

MD5
a1ae0144be5cf6650b500cd14cf667a6

SHA1
aa504b1f87ada07d989968c09c070bf34eeebfa1

SHA256
d37ae91d24eabd5edfa1bf41d1429e942e1c83a0711491496b0fdcd9d91bf27e

SHA512
6150abd46e1767b0a473f3b7cbdedac4725e8b0181c2fe72770170694c31483bf5958e216b7f884bb72f00ce63b785cdba041c5457bff407f4b845347f6da059

Download Submit
C:\Users\Default\winlogon.exe

Filesize
783KB

MD5
39a2fdd9e735620442931db84dbc5d80

SHA1
5891b2f85b69d1da5818f71318190201a41b4441

SHA256
c0380ef3862562bca9ab4a8442fb19b5886e3688cdaef858feb9277ad893351f

SHA512
c96df05444a24876453208de6ff0601f96781a1862d582e7cbc2ddaad8355a856fd9fae30a3ac95c88beb5c6d1622bb0d0303ee1eabc7092ba684923c73d148b

Download Submit
C:\Windows\System32\WofTasks\RuntimeBroker.exe

Filesize
783KB

MD5
e03dc7f89cd468f3c2995c2866e6a949

SHA1
607a2f13a926836cd9f8a87be3cd4dc55c135d70

SHA256
fdd944d8664e7831af5edb8fd168b1c10bde8922a67379cb5bdbb42176acfc46

SHA512
e2a7ec68e3e18f287c5afaf88a9fca62355c14853ced6271e5f37e3acd8a0bb819619fde3400e8a468c806ace7273109f49e41c5c6b51eb8942bdefe573d52d7

Download Submit
memory/3864-14-0x0000000002650000-0x0000000002658000-memory.dmp

Filesize
32KB

Download
memory/3864-12-0x00000000024B0000-0x00000000024B8000-memory.dmp

Filesize
32KB

Download
memory/3864-26-0x00007FFF45E40000-0x00007FFF46901000-memory.dmp

Filesize
10.8MB

Download
memory/3864-46-0x00007FFF45E40000-0x00007FFF46901000-memory.dmp

Filesize
10.8MB

Download
memory/3864-21-0x00000000026D0000-0x00000000026DC000-memory.dmp

Filesize
48KB

Download
memory/3864-20-0x00000000026C0000-0x00000000026C8000-memory.dmp

Filesize
32KB

Download
memory/3864-19-0x00000000026B0000-0x00000000026B8000-memory.dmp

Filesize
32KB

Download
memory/3864-18-0x0000000002670000-0x0000000002678000-memory.dmp

Filesize
32KB

Download
memory/3864-16-0x0000000002690000-0x0000000002698000-memory.dmp

Filesize
32KB

Download
memory/3864-17-0x00000000026A0000-0x00000000026A8000-memory.dmp

Filesize
32KB

Download
memory/3864-15-0x0000000002680000-0x0000000002688000-memory.dmp

Filesize
32KB

Download
memory/3864-0-0x00007FFF45E43000-0x00007FFF45E45000-memory.dmp

Filesize
8KB

Download
memory/3864-13-0x0000000002660000-0x0000000002668000-memory.dmp

Filesize
32KB

Download
memory/3864-25-0x00007FFF45E40000-0x00007FFF46901000-memory.dmp

Filesize
10.8MB

Download
memory/3864-10-0x0000000002630000-0x0000000002638000-memory.dmp

Filesize
32KB

Download
memory/3864-22-0x000000001AFB0000-0x000000001AFB8000-memory.dmp

Filesize
32KB

Download
memory/3864-9-0x0000000002640000-0x000000000264A000-memory.dmp

Filesize
40KB

Download
memory/3864-8-0x00000000024E0000-0x00000000024EA000-memory.dmp

Filesize
40KB

Download
memory/3864-7-0x0000000002620000-0x000000000262C000-memory.dmp

Filesize
48KB

Download
memory/3864-6-0x00000000024D0000-0x00000000024D8000-memory.dmp

Filesize
32KB

Download
memory/3864-5-0x00000000024A0000-0x00000000024B0000-memory.dmp

Filesize
64KB

Download
memory/3864-4-0x0000000002490000-0x0000000002498000-memory.dmp

Filesize
32KB

Download
memory/3864-3-0x0000000002480000-0x0000000002488000-memory.dmp

Filesize
32KB

Download
memory/3864-11-0x00000000024F0000-0x00000000024F8000-memory.dmp

Filesize
32KB

Download
memory/3864-2-0x00007FFF45E40000-0x00007FFF46901000-memory.dmp

Filesize
10.8MB

Download
memory/3864-110-0x00007FFF45E43000-0x00007FFF45E45000-memory.dmp

Filesize
8KB

Download
memory/3864-112-0x00007FFF45E40000-0x00007FFF46901000-memory.dmp

Filesize
10.8MB

Download
memory/3864-1-0x0000000000270000-0x000000000033A000-memory.dmp

Filesize
808KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads