dcrat | c809df9e2d9115ddeb5e4f6c82ca7ee85753b78cd2396dbda6f951ef1b2e81af

Analysis

max time kernel
103s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2025, 05:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-04_f7b4c0fad8ea1c80f5384bb45ad18b64_black-basta_cova_luca-stealer.exe
Size

2.1MB
MD5

f7b4c0fad8ea1c80f5384bb45ad18b64
SHA1

c68097749d0fced63ab1c22e4328e02b54df37ee
SHA256

c809df9e2d9115ddeb5e4f6c82ca7ee85753b78cd2396dbda6f951ef1b2e81af
SHA512

03ca9474fb9d03e920a0c755c3c2d8461d0446f10da7d72f15058b54ef063541004c821a0d46730c768e8d1e9823ec8710764e06bd5c441271e2da26ae9b46b9
SSDEEP

24576:2TbBv5rUyXVBlZLSBKYazsX35mwgHMB6uscrW/P0scp7WqNFcUpFwiCxRNuwujkJ:IBJBq5DS1cs+cUpFejgioKgOLaLVZm

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Documents\\My Pictures\\cmd.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Documents\\My Pictures\\cmd.exe\", \"C:\\Windows\\Media\\Cityscape\\winlogon.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Documents\\My Pictures\\cmd.exe\", \"C:\\Windows\\Media\\Cityscape\\winlogon.exe\", \"C:\\Users\\All Users\\sysmon.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Documents\\My Pictures\\cmd.exe\", \"C:\\Windows\\Media\\Cityscape\\winlogon.exe\", \"C:\\Users\\All Users\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Documents\\My Pictures\\cmd.exe\", \"C:\\Windows\\Media\\Cityscape\\winlogon.exe\", \"C:\\Users\\All Users\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\4d7dcf6448637544ea7e961be1ad\\spoolsv.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Documents\\My Pictures\\cmd.exe\", \"C:\\Windows\\Media\\Cityscape\\winlogon.exe\", \"C:\\Users\\All Users\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\4d7dcf6448637544ea7e961be1ad\\spoolsv.exe\", \"C:\\PortFontBrokerPerf\\BlockSavesMonitorDll.exe\""	BlockSavesMonitorDll.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5720	4884	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5680	4884	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	428	4884	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5048	4884	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1228	4884	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	4884	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	880	4884	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4748	4884	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4020	4884	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5316	4884	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	684	4884	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	4884	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	4884	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4332	4884	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5084	4884	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1548	4884	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	4884	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5184	4884	schtasks.exe	94

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	2025-04-04_f7b4c0fad8ea1c80f5384bb45ad18b64_black-basta_cova_luca-stealer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	BlockSavesMonitorDll.exe

Executes dropped EXE 14 IoCs

pid	Process
3232	BlockSavesMonitorDll.exe
64	cmd.exe
716	cmd.exe
4940	winlogon.exe
6136	winlogon.exe
1904	sysmon.exe
5964	sysmon.exe
5548	explorer.exe
5664	explorer.exe
3588	spoolsv.exe
5920	spoolsv.exe
5004	BlockSavesMonitorDll.exe
1048	BlockSavesMonitorDll.exe
1948	explorer.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Users\\Public\\Documents\\My Pictures\\cmd.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Users\\All Users\\sysmon.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\4d7dcf6448637544ea7e961be1ad\\spoolsv.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BlockSavesMonitorDll = "\"C:\\PortFontBrokerPerf\\BlockSavesMonitorDll.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BlockSavesMonitorDll = "\"C:\\PortFontBrokerPerf\\BlockSavesMonitorDll.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Users\\Public\\Documents\\My Pictures\\cmd.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\Media\\Cityscape\\winlogon.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\Media\\Cityscape\\winlogon.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Users\\All Users\\sysmon.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\WindowsRE\\explorer.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\WindowsRE\\explorer.exe\""	BlockSavesMonitorDll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\4d7dcf6448637544ea7e961be1ad\\spoolsv.exe\""	BlockSavesMonitorDll.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCACCEF99DAEC6453381405FAE9F326E1.TMP	csc.exe
File created	\??\c:\Windows\System32\tybfgy.exe	csc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\CSCCB927F24FA094A94A58EA177A34AF4CD.TMP	csc.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	csc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Media\Cityscape\winlogon.exe	BlockSavesMonitorDll.exe
File created	C:\Windows\Media\Cityscape\cc11b995f2a76d	BlockSavesMonitorDll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-04_f7b4c0fad8ea1c80f5384bb45ad18b64_black-basta_cova_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	2025-04-04_f7b4c0fad8ea1c80f5384bb45ad18b64_black-basta_cova_luca-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	BlockSavesMonitorDll.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4784	schtasks.exe
4332	schtasks.exe
5680	schtasks.exe
4748	schtasks.exe
5084	schtasks.exe
5184	schtasks.exe
1228	schtasks.exe
2580	schtasks.exe
1548	schtasks.exe
428	schtasks.exe
5048	schtasks.exe
880	schtasks.exe
4020	schtasks.exe
5316	schtasks.exe
684	schtasks.exe
5720	schtasks.exe
2840	schtasks.exe
1864	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe
3232	BlockSavesMonitorDll.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	3232	BlockSavesMonitorDll.exe
Token: SeDebugPrivilege	64	cmd.exe
Token: SeDebugPrivilege	716	cmd.exe
Token: SeDebugPrivilege	4940	winlogon.exe
Token: SeDebugPrivilege	6136	winlogon.exe
Token: SeDebugPrivilege	1904	sysmon.exe
Token: SeDebugPrivilege	5964	sysmon.exe
Token: SeDebugPrivilege	5664	explorer.exe
Token: SeDebugPrivilege	5548	explorer.exe
Token: SeDebugPrivilege	3588	spoolsv.exe
Token: SeDebugPrivilege	5920	spoolsv.exe
Token: SeDebugPrivilege	1048	BlockSavesMonitorDll.exe
Token: SeDebugPrivilege	5004	BlockSavesMonitorDll.exe
Token: SeDebugPrivilege	1948	explorer.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 5540 wrote to memory of 5224	5540	2025-04-04_f7b4c0fad8ea1c80f5384bb45ad18b64_black-basta_cova_luca-stealer.exe	89
PID 5540 wrote to memory of 5224	5540	2025-04-04_f7b4c0fad8ea1c80f5384bb45ad18b64_black-basta_cova_luca-stealer.exe	89
PID 5540 wrote to memory of 5224	5540	2025-04-04_f7b4c0fad8ea1c80f5384bb45ad18b64_black-basta_cova_luca-stealer.exe	89
PID 5224 wrote to memory of 3844	5224	WScript.exe	98
PID 5224 wrote to memory of 3844	5224	WScript.exe	98
PID 5224 wrote to memory of 3844	5224	WScript.exe	98
PID 3844 wrote to memory of 3232	3844	cmd.exe	100
PID 3844 wrote to memory of 3232	3844	cmd.exe	100
PID 3232 wrote to memory of 5688	3232	BlockSavesMonitorDll.exe	104
PID 3232 wrote to memory of 5688	3232	BlockSavesMonitorDll.exe	104
PID 5688 wrote to memory of 3932	5688	csc.exe	106
PID 5688 wrote to memory of 3932	5688	csc.exe	106
PID 3232 wrote to memory of 5836	3232	BlockSavesMonitorDll.exe	107
PID 3232 wrote to memory of 5836	3232	BlockSavesMonitorDll.exe	107
PID 5836 wrote to memory of 1720	5836	csc.exe	109
PID 5836 wrote to memory of 1720	5836	csc.exe	109
PID 548 wrote to memory of 64	548	cmd.exe	119
PID 548 wrote to memory of 64	548	cmd.exe	119
PID 4764 wrote to memory of 716	4764	cmd.exe	122
PID 4764 wrote to memory of 716	4764	cmd.exe	122
PID 2648 wrote to memory of 4940	2648	cmd.exe	125
PID 2648 wrote to memory of 4940	2648	cmd.exe	125
PID 5236 wrote to memory of 6136	5236	cmd.exe	131
PID 5236 wrote to memory of 6136	5236	cmd.exe	131
PID 3216 wrote to memory of 1904	3216	cmd.exe	137
PID 3216 wrote to memory of 1904	3216	cmd.exe	137
PID 460 wrote to memory of 5964	460	cmd.exe	140
PID 460 wrote to memory of 5964	460	cmd.exe	140
PID 5896 wrote to memory of 5548	5896	cmd.exe	147
PID 5896 wrote to memory of 5548	5896	cmd.exe	147
PID 2940 wrote to memory of 5664	2940	cmd.exe	149
PID 2940 wrote to memory of 5664	2940	cmd.exe	149
PID 1400 wrote to memory of 3588	1400	cmd.exe	151
PID 1400 wrote to memory of 3588	1400	cmd.exe	151
PID 4400 wrote to memory of 5920	4400	cmd.exe	153
PID 4400 wrote to memory of 5920	4400	cmd.exe	153
PID 3232 wrote to memory of 4484	3232	BlockSavesMonitorDll.exe	159
PID 3232 wrote to memory of 4484	3232	BlockSavesMonitorDll.exe	159
PID 1788 wrote to memory of 5004	1788	cmd.exe	161
PID 1788 wrote to memory of 5004	1788	cmd.exe	161
PID 4484 wrote to memory of 5352	4484	cmd.exe	162
PID 4484 wrote to memory of 5352	4484	cmd.exe	162
PID 3264 wrote to memory of 1048	3264	cmd.exe	163
PID 3264 wrote to memory of 1048	3264	cmd.exe	163
PID 4484 wrote to memory of 3100	4484	cmd.exe	164
PID 4484 wrote to memory of 3100	4484	cmd.exe	164
PID 4484 wrote to memory of 1948	4484	cmd.exe	165
PID 4484 wrote to memory of 1948	4484	cmd.exe	165

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2025-04-04_f7b4c0fad8ea1c80f5384bb45ad18b64_black-basta_cova_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-04_f7b4c0fad8ea1c80f5384bb45ad18b64_black-basta_cova_luca-stealer.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5540
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\PortFontBrokerPerf\Y4EiKOdPrb8Z.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5224
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\PortFontBrokerPerf\Rtn7cpFGR9lldPKi6lSKrpTABHrWJw3F.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3844
  - - C:\PortFontBrokerPerf\BlockSavesMonitorDll.exe
      "C:\PortFontBrokerPerf/BlockSavesMonitorDll.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3232
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wh132nkq\wh132nkq.cmdline"
        5⤵
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:5688
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD234.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSCCB927F24FA094A94A58EA177A34AF4CD.TMP"
        6⤵
        
        PID:3932
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2izynudl\2izynudl.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5836
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD2A2.tmp" "c:\Windows\System32\CSCACCEF99DAEC6453381405FAE9F326E1.TMP"
        6⤵
        
        PID:1720
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VYORqcMpOp.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4484
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:5352
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3100
      - C:\Recovery\WindowsRE\explorer.exe
        
        "C:\Recovery\WindowsRE\explorer.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Documents\My Pictures\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Pictures\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Documents\My Pictures\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Public\Documents\My Pictures\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Users\Public\Documents\My Pictures\cmd.exe
  "C:\Users\Public\Documents\My Pictures\cmd.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:716

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Public\Documents\My Pictures\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:548
- C:\Users\Public\Documents\My Pictures\cmd.exe
  "C:\Users\Public\Documents\My Pictures\cmd.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:64

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Windows\Media\Cityscape\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\Media\Cityscape\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Windows\Media\Cityscape\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\Media\Cityscape\winlogon.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5236
- C:\Windows\Media\Cityscape\winlogon.exe
  C:\Windows\Media\Cityscape\winlogon.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\Media\Cityscape\winlogon.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\Media\Cityscape\winlogon.exe
  C:\Windows\Media\Cityscape\winlogon.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\All Users\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\All Users\sysmon.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:460
- C:\Users\All Users\sysmon.exe
  "C:\Users\All Users\sysmon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\All Users\sysmon.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Users\All Users\sysmon.exe
  "C:\Users\All Users\sysmon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Recovery\WindowsRE\explorer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Recovery\WindowsRE\explorer.exe
  C:\Recovery\WindowsRE\explorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Recovery\WindowsRE\explorer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5896
- C:\Recovery\WindowsRE\explorer.exe
  C:\Recovery\WindowsRE\explorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\4d7dcf6448637544ea7e961be1ad\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\4d7dcf6448637544ea7e961be1ad\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\4d7dcf6448637544ea7e961be1ad\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\4d7dcf6448637544ea7e961be1ad\spoolsv.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\4d7dcf6448637544ea7e961be1ad\spoolsv.exe
  C:\4d7dcf6448637544ea7e961be1ad\spoolsv.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\4d7dcf6448637544ea7e961be1ad\spoolsv.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4400
- C:\4d7dcf6448637544ea7e961be1ad\spoolsv.exe
  C:\4d7dcf6448637544ea7e961be1ad\spoolsv.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BlockSavesMonitorDllB" /sc MINUTE /mo 8 /tr "'C:\PortFontBrokerPerf\BlockSavesMonitorDll.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BlockSavesMonitorDll" /sc ONLOGON /tr "'C:\PortFontBrokerPerf\BlockSavesMonitorDll.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BlockSavesMonitorDllB" /sc MINUTE /mo 11 /tr "'C:\PortFontBrokerPerf\BlockSavesMonitorDll.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5184

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\PortFontBrokerPerf\BlockSavesMonitorDll.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\PortFontBrokerPerf\BlockSavesMonitorDll.exe
  C:\PortFontBrokerPerf\BlockSavesMonitorDll.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\PortFontBrokerPerf\BlockSavesMonitorDll.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3264
- C:\PortFontBrokerPerf\BlockSavesMonitorDll.exe
  C:\PortFontBrokerPerf\BlockSavesMonitorDll.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PortFontBrokerPerf\BlockSavesMonitorDll.exe

Filesize
1.8MB

MD5
f40a7dce8cf4fd30130b0c66820dd038

SHA1
e6c85384db6fb3e9beb37979763de78977c772ef

SHA256
ed8be6cca60868cc3902b49d1920cb8668a1a3c3f99a4bf55ee8c091e45c074f

SHA512
e0000cfdebbd83edcc0dd0daa8f813f0848d4c0a7e7b2624d0358439921e92fbb69921fd8934b203a0fb4119445d9c04b60f4d37760a92babff8e95fc9c2dbdc

Download Submit
C:\PortFontBrokerPerf\Rtn7cpFGR9lldPKi6lSKrpTABHrWJw3F.bat

Filesize
104B

MD5
94fb8c242f1a075c7019b39500983b1a

SHA1
10781254369495e918bf0923ac2b567185c1337b

SHA256
fca2097f81ff4ab35ec60d7dfc82c3f672f6dd181f21c414567a53b950382106

SHA512
0e7863c5f038e0d68ddcca088b6dbaeca60cfb97fda916a530af774c37f0727f008a229815a0f940a156fba7c5cb3d89afb70c4d3e37d1077090b770d475893c

Download Submit
C:\PortFontBrokerPerf\Y4EiKOdPrb8Z.vbe

Filesize
229B

MD5
17687d6af43eed1b71b06021c50da290

SHA1
c5b4f3de7003745ead126f88c02cac3bd4d25d5b

SHA256
05ce8f3660c24152cc12d63d3f14e36d893279ef2797bcfde76b8cc91474bc00

SHA512
209d79c140ea933763fde399267b6c1a128ca352cae282bdeaa38dd24ec72d023de35cc88c2e5cdbd2bf4583cfb900ae7fbce3429b2a5fce1ecee5e6b366673b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\BlockSavesMonitorDll.exe.log

Filesize
1KB

MD5
af6acd95d59de87c04642509c30e81c1

SHA1
f9549ae93fdb0a5861a79a08f60aa81c4b32377b

SHA256
7521ee2d065a78efcab55a194fbd78492f84b70595f139263875f4ea92b194d6

SHA512
93ab99bcf588fde553de3240e0d2b0cbd4e4bc5ef5e99d53f45a267d7ff30103a80b5a7aa1c52d6eff1e070af0ec82d2c0b8aafb7099742aa16810edc1815c3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\cmd.exe.log

Filesize
847B

MD5
66a0a4aa01208ed3d53a5e131a8d030a

SHA1
ef5312ba2b46b51a4d04b574ca1789ac4ff4a6b1

SHA256
f0ab05c32d6af3c2b559dbce4dec025ce3e730655a2430ade520e89a557cace8

SHA512
626f0dcf0c6bcdc0fef25dc7da058003cf929fd9a39a9f447b79fb139a417532a46f8bca1ff2dbde09abfcd70f5fb4f8d059b1fe91977c377df2f5f751c84c5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESD234.tmp

Filesize
1KB

MD5
12bbc804547b3a23fc5dd743a7785f32

SHA1
7e57e70a189699ddf4950ad6bc6c69abfbde9ac9

SHA256
0647eaecb7afddb093f4836e4fb56844b16eee9b2011e66fbc55c835e5e4daf0

SHA512
0730410f4728874a342f3d3e6a553adbda1f8b475312b881538a9fce62dbab080c63407639aa4e5f039017a43edf2864cb328fd880b7393cee53fd84885f1ac5

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESD2A2.tmp

Filesize
1KB

MD5
15b89b4d6fcd57041a4e0a550ca6c71d

SHA1
d3e2c0c885f9b64424f38842819441f1b449cf2f

SHA256
31b04d85370a4b4b960559f874357ba3c09e32d8cb071f90d8801a6b70c34076

SHA512
d5704008bada9e8a845fe9741a51a4c516a11b67a05beb688547e64bbc42c14dc1551eb01a050d22d82751e087daaf8a62ba2d7865dd4b8405f45a784a50eb31

Download Submit
C:\Users\Admin\AppData\Local\Temp\VYORqcMpOp.bat

Filesize
210B

MD5
5cf43330d2a652d127c1628e0d4623ac

SHA1
fe11dcbc02815a5b31e6ed9d88ae199d29e65452

SHA256
a3f8f3257094f3b8ce8978cc202621881b0d852b70987b1c2aeccb782004e94d

SHA512
f5c3a2b03aba6a51c419c68b3ee2c7983d4bf69ab03c9c1c26eb758d8c73632314914c08f76fe34a96b94dc4305c624b60a7bfdb8ab1e40adf4b40fab5873375

Download Submit
\??\c:\Program Files (x86)\Microsoft\Edge\Application\CSCCB927F24FA094A94A58EA177A34AF4CD.TMP

Filesize
1KB

MD5
b5189fb271be514bec128e0d0809c04e

SHA1
5dd625d27ed30fca234ec097ad66f6c13a7edcbe

SHA256
e1984ba1e3ff8b071f7a320a6f1f18e1d5f4f337d31dc30d5bdfb021df39060f

SHA512
f0fcb8f97279579beb59f58ea89527ee0d86a64c9de28300f14460bec6c32dda72f0e6466573b6654a1e992421d6fe81ae7cce50f27059f54cf9fdca6953602e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\2izynudl\2izynudl.0.cs

Filesize
377B

MD5
0c71fc160a8cdcdd18a8c36881079bb5

SHA1
a2d1a7b71cf6e96a69e99a3afa25e898f771fdbe

SHA256
730dfc632e29e230d01ed8950983fa0e8595af5aefb34ad5ab0f1f32a9d75844

SHA512
f86dea353944bb5a8c7af1ed605880d76127ae597b5cedbad0370efe536fd9dfdad1ffdea2620a7713bc65d3581983b0cb6fa95b792dc963b0da2f05d6145ee6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\2izynudl\2izynudl.cmdline

Filesize
235B

MD5
52c96e0abbcb47d9485ec90c58a93f90

SHA1
f3583235fba82bd862662e649b53ec9c09c087b2

SHA256
014841d0c23d687edc95029d7792e054fa61a5fa4d6b2c80348827b363b37a06

SHA512
2e5a0392c77ebf8c3728dc96ef53eac870f81c41972b64e86efea13d00dcf10382459818655f189a06239f3fcc34e6488ebf8d724986a1d0f4eaa8da53ce712f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wh132nkq\wh132nkq.0.cs

Filesize
407B

MD5
753b5193f238560a54136145d1b3198a

SHA1
4f7ab71a8a3b56e34c356c871c6812f8e7bf8d93

SHA256
c274607d66f3b86097705db1452fd79bf28501416a2601deac761a7da02aa7f0

SHA512
0d0699486b180963981dc590ac57104f3d409e3a919538fdf5b87522ae4cc3b9d5695ee604fccd832ac592cb4b1bb01b89abe3da66a8d2539da1413afe98baa7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wh132nkq\wh132nkq.cmdline

Filesize
265B

MD5
98017e842793004b45fc8d0aeb4d8d70

SHA1
c50e8ba79f4e5bae5d734ccb6d28a1295b47200f

SHA256
41447179f117b6e104d543efd79b27b04c8e63678f0adc09814c6cd532c02f44

SHA512
bf71f08e620f418eac3c86f62c541231fa1fbdee84870c48730b5500548fbbccf780f5ea4ca73db12edfba026e86849fe5e476ec2492574dc0083db6dcee8fdd

Download Submit
\??\c:\Windows\System32\CSCACCEF99DAEC6453381405FAE9F326E1.TMP

Filesize
1KB

MD5
47c2c093d947e0ac02da7b691bc6fce5

SHA1
cea2d7ae6980b07a96341527b162067d0382f07a

SHA256
ed7a05f9a0b94b9625377eecd69e9741bb3c59a03f1acc19c488349da4fb391e

SHA512
eaaa26d251e9d622168daf15ee1c881e5b9a7817251411d0c0e2badad42739e4cfdd62befed0298bf8f8c65850d343c4485b89853d7124cb086949a2d04f02e5

Download Submit
memory/3232-22-0x0000000002E30000-0x0000000002E3C000-memory.dmp

Filesize
48KB

Download
memory/3232-20-0x000000001B7B0000-0x000000001B7C8000-memory.dmp

Filesize
96KB

Download
memory/3232-18-0x000000001B800000-0x000000001B850000-memory.dmp

Filesize
320KB

Download
memory/3232-17-0x000000001B790000-0x000000001B7AC000-memory.dmp

Filesize
112KB

Download
memory/3232-15-0x0000000001430000-0x000000000143E000-memory.dmp

Filesize
56KB

Download
memory/3232-13-0x0000000000A90000-0x0000000000C6A000-memory.dmp

Filesize
1.9MB

Download
memory/3232-12-0x00007FFE57E73000-0x00007FFE57E75000-memory.dmp

Filesize
8KB

Download