dcrat | e7cf9ae73751f92a53dbbc41b4939510e23352bf3a942e86b269c72b80cdb63c

Analysis

max time kernel
101s
max time network
106s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
08/10/2025, 21:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EB71BD542C88DEE476937C64F685729E.exe
Size 3.4MB
Sample251008-1p5b3seq8w
SHA256 e7cf9ae73751f92a53dbbc41b4939510e23352bf3a942e86b269c72b80cdb63c
MD5 eb71bd542c88dee476937c64f685729e
SHA1 9c5264de5006a051cf949d749173211af5f71086
SHA512 1b58ae7989d54093eccd0b06e07440b6e0769ed85aa149f12796bbc0a29553eebd70f764edd9d3ad40e0e592100d0887f565c8fddd072729a51b003821c6330e
SSDEEP 49152:mSWEezum6cP6UWecaJtx1Y2QUoB70+xfiXkRSMxUoMK4U7gqo:PWim6cC5eBxCB5Bxfg0dmo3M
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat trojan

Malware Config

Signatures

DcRat 55 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		EB71BD542C88DEE476937C64F685729E.exe
		5016	schtasks.exe
		3392	schtasks.exe
		3912	schtasks.exe
		5112	schtasks.exe
		3668	schtasks.exe
		2920	schtasks.exe
		3140	schtasks.exe
		4796	schtasks.exe
		3364	schtasks.exe
		468	schtasks.exe
		1544	schtasks.exe
		2076	schtasks.exe
		3904	schtasks.exe
		1916	schtasks.exe
		4652	schtasks.exe
		840	schtasks.exe
		2256	schtasks.exe
		3012	schtasks.exe
		4668	schtasks.exe
		1108	schtasks.exe
		1260	schtasks.exe
		400	schtasks.exe
		2160	schtasks.exe
		1280	schtasks.exe
		2948	schtasks.exe
		3328	schtasks.exe
		2812	schtasks.exe
		1308	schtasks.exe
		5008	schtasks.exe
		4680	schtasks.exe
		2160	schtasks.exe
		4176	schtasks.exe
		4920	schtasks.exe
		2376	schtasks.exe
		3036	schtasks.exe
		4320	schtasks.exe
		568	schtasks.exe
		3332	schtasks.exe
		3200	schtasks.exe
		3104	schtasks.exe
		1604	schtasks.exe
		4764	schtasks.exe
		568	schtasks.exe
		4364	schtasks.exe
		3516	schtasks.exe
		3132	schtasks.exe
		3120	schtasks.exe
		1004	schtasks.exe
		4704	schtasks.exe
		3912	schtasks.exe
		2556	schtasks.exe
		3876	schtasks.exe
		1764	schtasks.exe
		3328	schtasks.exe

Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 18 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\smss.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\SearchHost.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.WindowsDesktop.App\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\dllhost.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\sihost.exe\", \"C:\\Program Files\\Uninstall Information\\Idle.exe\", \"C:\\4b80bbab5d33ff56af49c139\\dllhost.exe\", \"C:\\Windows\\schemas\\Provisioning\\services.exe\", \"C:\\Windows\\SystemResources\\ShellComponents\\pris\\StartMenuExperienceHost.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\smss.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\SearchHost.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.WindowsDesktop.App\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\dllhost.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\sihost.exe\", \"C:\\Program Files\\Uninstall Information\\Idle.exe\", \"C:\\4b80bbab5d33ff56af49c139\\dllhost.exe\", \"C:\\Windows\\schemas\\Provisioning\\services.exe\", \"C:\\Windows\\SystemResources\\ShellComponents\\pris\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\ja-JP\\unsecapp.exe\", \"C:\\Users\\Admin\\Cookies\\explorer.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\smss.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\SearchHost.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.WindowsDesktop.App\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\dllhost.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\sihost.exe\", \"C:\\Program Files\\Uninstall Information\\Idle.exe\", \"C:\\4b80bbab5d33ff56af49c139\\dllhost.exe\", \"C:\\Windows\\schemas\\Provisioning\\services.exe\", \"C:\\Windows\\SystemResources\\ShellComponents\\pris\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\ja-JP\\unsecapp.exe\", \"C:\\Users\\Admin\\Cookies\\explorer.exe\", \"C:\\Windows\\BrowserCore\\fontdrvhost.exe\", \"C:\\Program Files\\Mozilla Firefox\\browser\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\dwm.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\smss.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\SearchHost.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\smss.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\SearchHost.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.WindowsDesktop.App\\lsass.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\smss.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\SearchHost.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.WindowsDesktop.App\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\dllhost.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\sihost.exe\", \"C:\\Program Files\\Uninstall Information\\Idle.exe\", \"C:\\4b80bbab5d33ff56af49c139\\dllhost.exe\", \"C:\\Windows\\schemas\\Provisioning\\services.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\smss.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\SearchHost.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.WindowsDesktop.App\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\dllhost.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\sihost.exe\", \"C:\\Program Files\\Uninstall Information\\Idle.exe\", \"C:\\4b80bbab5d33ff56af49c139\\dllhost.exe\", \"C:\\Windows\\schemas\\Provisioning\\services.exe\", \"C:\\Windows\\SystemResources\\ShellComponents\\pris\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\ja-JP\\unsecapp.exe\", \"C:\\Users\\Admin\\Cookies\\explorer.exe\", \"C:\\Windows\\BrowserCore\\fontdrvhost.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\smss.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\SearchHost.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.WindowsDesktop.App\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\dllhost.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\sihost.exe\", \"C:\\Program Files\\Uninstall Information\\Idle.exe\", \"C:\\4b80bbab5d33ff56af49c139\\dllhost.exe\", \"C:\\Windows\\schemas\\Provisioning\\services.exe\", \"C:\\Windows\\SystemResources\\ShellComponents\\pris\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\ja-JP\\unsecapp.exe\", \"C:\\Users\\Admin\\Cookies\\explorer.exe\", \"C:\\Windows\\BrowserCore\\fontdrvhost.exe\", \"C:\\Program Files\\Mozilla Firefox\\browser\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\smss.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\SearchHost.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.WindowsDesktop.App\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\dllhost.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\sihost.exe\", \"C:\\Program Files\\Uninstall Information\\Idle.exe\", \"C:\\4b80bbab5d33ff56af49c139\\dllhost.exe\", \"C:\\Windows\\schemas\\Provisioning\\services.exe\", \"C:\\Windows\\SystemResources\\ShellComponents\\pris\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\ja-JP\\unsecapp.exe\", \"C:\\Users\\Admin\\Cookies\\explorer.exe\", \"C:\\Windows\\BrowserCore\\fontdrvhost.exe\", \"C:\\Program Files\\Mozilla Firefox\\browser\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\dwm.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\csrss.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\smss.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\SearchHost.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.WindowsDesktop.App\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\dllhost.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\sihost.exe\", \"C:\\Program Files\\Uninstall Information\\Idle.exe\", \"C:\\4b80bbab5d33ff56af49c139\\dllhost.exe\", \"C:\\Windows\\schemas\\Provisioning\\services.exe\", \"C:\\Windows\\SystemResources\\ShellComponents\\pris\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\ja-JP\\unsecapp.exe\", \"C:\\Users\\Admin\\Cookies\\explorer.exe\", \"C:\\Windows\\BrowserCore\\fontdrvhost.exe\", \"C:\\Program Files\\Mozilla Firefox\\browser\\lsass.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\services.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\smss.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\SearchHost.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\RuntimeBroker.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\smss.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\SearchHost.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.WindowsDesktop.App\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\dllhost.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\smss.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\SearchHost.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.WindowsDesktop.App\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\dllhost.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\sihost.exe\", \"C:\\Program Files\\Uninstall Information\\Idle.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\smss.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\SearchHost.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.WindowsDesktop.App\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\dllhost.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\sihost.exe\", \"C:\\Program Files\\Uninstall Information\\Idle.exe\", \"C:\\4b80bbab5d33ff56af49c139\\dllhost.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\smss.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\SearchHost.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.WindowsDesktop.App\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\dllhost.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\sihost.exe\", \"C:\\Program Files\\Uninstall Information\\Idle.exe\", \"C:\\4b80bbab5d33ff56af49c139\\dllhost.exe\", \"C:\\Windows\\schemas\\Provisioning\\services.exe\", \"C:\\Windows\\SystemResources\\ShellComponents\\pris\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\ja-JP\\unsecapp.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\smss.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\smss.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\SearchHost.exe\", \"C:\\ecd7b64386840f62c0ab2e4490\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.WindowsDesktop.App\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\dllhost.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\sihost.exe\""	EB71BD542C88DEE476937C64F685729E.exe

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	568	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5016	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4796	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3912	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3140	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2920	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1108	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	400	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3876	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1260	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4320	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3328	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3200	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3104	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5112	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4668	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3392	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3120	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4176	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	568	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1280	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3668	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4364	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3332	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3328	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3904	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3516	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3912	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3364	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4680	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3132	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	840	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	468	4264	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	4264	schtasks.exe	79

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	EB71BD542C88DEE476937C64F685729E.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	EB71BD542C88DEE476937C64F685729E.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	EB71BD542C88DEE476937C64F685729E.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2720-0-0x0000000000720000-0x0000000000A8A000-memory.dmp	dcrat
behavioral2/files/0x001b00000002aeba-47.dat	dcrat

Executes dropped EXE 19 IoCs

pid	Process
3600	services.exe
4080	smss.exe
668	SearchHost.exe
912	RuntimeBroker.exe
2908	lsass.exe
2080	dllhost.exe
4472	sihost.exe
4848	Idle.exe
4920	dllhost.exe
2164	services.exe
4108	StartMenuExperienceHost.exe
4228	explorer.exe
4764	unsecapp.exe
2480	lsass.exe
872	fontdrvhost.exe
3484	RuntimeBroker.exe
468	dwm.exe
5168	csrss.exe
5312	dwm.exe

Adds Run key to start application 2 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-625765727-1271952295-745797415-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\dotnet\\shared\\Microsoft.WindowsDesktop.App\\lsass.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\4b80bbab5d33ff56af49c139\\dllhost.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-625765727-1271952295-745797415-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\schemas\\Provisioning\\services.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-625765727-1271952295-745797415-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\Mozilla Firefox\\browser\\lsass.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Users\\Admin\\Cookies\\explorer.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-625765727-1271952295-745797415-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\Uninstall Information\\Idle.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\Uninstall Information\\Idle.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\Mozilla Firefox\\browser\\lsass.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-625765727-1271952295-745797415-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\WindowsRE\\services.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\dllhost.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-625765727-1271952295-745797415-1000\Software\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\sihost.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-625765727-1271952295-745797415-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-625765727-1271952295-745797415-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Default User\\dwm.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Default User\\dwm.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\ecd7b64386840f62c0ab2e4490\\csrss.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\smss.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-625765727-1271952295-745797415-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\ecd7b64386840f62c0ab2e4490\\RuntimeBroker.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\ecd7b64386840f62c0ab2e4490\\RuntimeBroker.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\dotnet\\shared\\Microsoft.WindowsDesktop.App\\lsass.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-625765727-1271952295-745797415-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\4b80bbab5d33ff56af49c139\\dllhost.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-625765727-1271952295-745797415-1000\Software\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\SystemResources\\ShellComponents\\pris\\StartMenuExperienceHost.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-625765727-1271952295-745797415-1000\Software\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Program Files (x86)\\Windows NT\\Accessories\\ja-JP\\unsecapp.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Program Files (x86)\\Windows NT\\Accessories\\ja-JP\\unsecapp.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-625765727-1271952295-745797415-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Windows Defender\\ja-JP\\dllhost.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\schemas\\Provisioning\\services.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-625765727-1271952295-745797415-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Users\\Admin\\Cookies\\explorer.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-625765727-1271952295-745797415-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\ecd7b64386840f62c0ab2e4490\\csrss.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchHost = "\"C:\\ecd7b64386840f62c0ab2e4490\\SearchHost.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\sihost.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\SystemResources\\ShellComponents\\pris\\StartMenuExperienceHost.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-625765727-1271952295-745797415-1000\Software\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\BrowserCore\\fontdrvhost.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\BrowserCore\\fontdrvhost.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\WindowsRE\\services.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-625765727-1271952295-745797415-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\smss.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-625765727-1271952295-745797415-1000\Software\Microsoft\Windows\CurrentVersion\Run\SearchHost = "\"C:\\ecd7b64386840f62c0ab2e4490\\SearchHost.exe\""	EB71BD542C88DEE476937C64F685729E.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	EB71BD542C88DEE476937C64F685729E.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	EB71BD542C88DEE476937C64F685729E.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

SmartAssembly .NET packer 9 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/2720-8-0x0000000002D70000-0x0000000002D80000-memory.dmp	SmartAssembly
behavioral2/memory/2720-15-0x000000001CE30000-0x000000001CE3A000-memory.dmp	SmartAssembly
behavioral2/memory/2720-24-0x000000001D620000-0x000000001D62C000-memory.dmp	SmartAssembly
behavioral2/memory/2720-23-0x000000001D610000-0x000000001D61C000-memory.dmp	SmartAssembly
behavioral2/memory/2720-27-0x000000001D650000-0x000000001D65C000-memory.dmp	SmartAssembly
behavioral2/memory/2720-29-0x000000001D870000-0x000000001D87C000-memory.dmp	SmartAssembly
behavioral2/memory/2720-30-0x000000001D880000-0x000000001D88A000-memory.dmp	SmartAssembly
behavioral2/memory/2720-35-0x000000001D8D0000-0x000000001D8DC000-memory.dmp	SmartAssembly
behavioral2/memory/2720-37-0x000000001D8F0000-0x000000001D8FA000-memory.dmp	SmartAssembly

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files\Uninstall Information\6ccacd8608530f	EB71BD542C88DEE476937C64F685729E.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\ja-JP\29c1c3cc0f7685	EB71BD542C88DEE476937C64F685729E.exe
File created	C:\Program Files\ModifiableWindowsApps\spoolsv.exe	EB71BD542C88DEE476937C64F685729E.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\69ddcba757bf72	EB71BD542C88DEE476937C64F685729E.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\Idle.exe	EB71BD542C88DEE476937C64F685729E.exe
File created	C:\Program Files\Mozilla Firefox\browser\lsass.exe	EB71BD542C88DEE476937C64F685729E.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\lsass.exe	EB71BD542C88DEE476937C64F685729E.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\sihost.exe	EB71BD542C88DEE476937C64F685729E.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\smss.exe	EB71BD542C88DEE476937C64F685729E.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6203df4a6bafc7	EB71BD542C88DEE476937C64F685729E.exe
File created	C:\Program Files\Uninstall Information\Idle.exe	EB71BD542C88DEE476937C64F685729E.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\ja-JP\unsecapp.exe	EB71BD542C88DEE476937C64F685729E.exe
File created	C:\Program Files\Mozilla Firefox\browser\6203df4a6bafc7	EB71BD542C88DEE476937C64F685729E.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\sppsvc.exe	EB71BD542C88DEE476937C64F685729E.exe
File created	C:\Program Files (x86)\Windows Defender\ja-JP\dllhost.exe	EB71BD542C88DEE476937C64F685729E.exe
File created	C:\Program Files (x86)\Windows Defender\ja-JP\5940a34987c991	EB71BD542C88DEE476937C64F685729E.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\66fc9ff0ee96c2	EB71BD542C88DEE476937C64F685729E.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\schemas\Provisioning\services.exe	EB71BD542C88DEE476937C64F685729E.exe
File created	C:\Windows\schemas\Provisioning\c5b4cb5e9653cc	EB71BD542C88DEE476937C64F685729E.exe
File created	C:\Windows\SystemResources\ShellComponents\pris\StartMenuExperienceHost.exe	EB71BD542C88DEE476937C64F685729E.exe
File created	C:\Windows\SystemResources\ShellComponents\pris\55b276f4edf653	EB71BD542C88DEE476937C64F685729E.exe
File created	C:\Windows\BrowserCore\fontdrvhost.exe	EB71BD542C88DEE476937C64F685729E.exe
File created	C:\Windows\BrowserCore\5b884080fd4f94	EB71BD542C88DEE476937C64F685729E.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-625765727-1271952295-745797415-1000_Classes\Local Settings	EB71BD542C88DEE476937C64F685729E.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1544	schtasks.exe
4920	schtasks.exe
3036	schtasks.exe
1280	schtasks.exe
3668	schtasks.exe
3332	schtasks.exe
3904	schtasks.exe
1604	schtasks.exe
2812	schtasks.exe
4796	schtasks.exe
3012	schtasks.exe
400	schtasks.exe
3328	schtasks.exe
4764	schtasks.exe
4176	schtasks.exe
3140	schtasks.exe
1764	schtasks.exe
2076	schtasks.exe
1004	schtasks.exe
3328	schtasks.exe
840	schtasks.exe
468	schtasks.exe
2160	schtasks.exe
3912	schtasks.exe
2948	schtasks.exe
2376	schtasks.exe
3876	schtasks.exe
5008	schtasks.exe
3200	schtasks.exe
5112	schtasks.exe
5016	schtasks.exe
3104	schtasks.exe
2160	schtasks.exe
3912	schtasks.exe
2920	schtasks.exe
2556	schtasks.exe
1260	schtasks.exe
4320	schtasks.exe
568	schtasks.exe
1308	schtasks.exe
3132	schtasks.exe
1108	schtasks.exe
1916	schtasks.exe
2256	schtasks.exe
3516	schtasks.exe
3364	schtasks.exe
568	schtasks.exe
4704	schtasks.exe
4668	schtasks.exe
3392	schtasks.exe
3120	schtasks.exe
4364	schtasks.exe
4652	schtasks.exe
4680	schtasks.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe
2720	EB71BD542C88DEE476937C64F685729E.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2720	EB71BD542C88DEE476937C64F685729E.exe
Token: SeDebugPrivilege	3600	services.exe
Token: SeDebugPrivilege	4080	smss.exe
Token: SeDebugPrivilege	668	SearchHost.exe
Token: SeDebugPrivilege	912	RuntimeBroker.exe
Token: SeDebugPrivilege	2908	lsass.exe
Token: SeDebugPrivilege	2080	dllhost.exe
Token: SeDebugPrivilege	4472	sihost.exe
Token: SeDebugPrivilege	4848	Idle.exe
Token: SeDebugPrivilege	4920	dllhost.exe
Token: SeDebugPrivilege	2164	services.exe
Token: SeDebugPrivilege	4108	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	4228	explorer.exe
Token: SeDebugPrivilege	4764	unsecapp.exe
Token: SeDebugPrivilege	2480	lsass.exe
Token: SeDebugPrivilege	872	fontdrvhost.exe
Token: SeDebugPrivilege	3484	RuntimeBroker.exe
Token: SeDebugPrivilege	468	dwm.exe
Token: SeDebugPrivilege	5168	csrss.exe
Token: SeDebugPrivilege	5312	dwm.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 3600	2808	cmd.exe	91
PID 2808 wrote to memory of 3600	2808	cmd.exe	91
PID 1428 wrote to memory of 4080	1428	cmd.exe	97
PID 1428 wrote to memory of 4080	1428	cmd.exe	97
PID 3252 wrote to memory of 668	3252	cmd.exe	104
PID 3252 wrote to memory of 668	3252	cmd.exe	104
PID 1692 wrote to memory of 912	1692	cmd.exe	110
PID 1692 wrote to memory of 912	1692	cmd.exe	110
PID 3732 wrote to memory of 2908	3732	cmd.exe	115
PID 3732 wrote to memory of 2908	3732	cmd.exe	115
PID 1320 wrote to memory of 2080	1320	cmd.exe	128
PID 1320 wrote to memory of 2080	1320	cmd.exe	128
PID 4556 wrote to memory of 4472	4556	cmd.exe	133
PID 4556 wrote to memory of 4472	4556	cmd.exe	133
PID 2996 wrote to memory of 4848	2996	cmd.exe	138
PID 2996 wrote to memory of 4848	2996	cmd.exe	138
PID 4564 wrote to memory of 4920	4564	cmd.exe	153
PID 4564 wrote to memory of 4920	4564	cmd.exe	153
PID 4636 wrote to memory of 2164	4636	cmd.exe	157
PID 4636 wrote to memory of 2164	4636	cmd.exe	157
PID 416 wrote to memory of 4108	416	cmd.exe	162
PID 416 wrote to memory of 4108	416	cmd.exe	162
PID 4580 wrote to memory of 4228	4580	cmd.exe	166
PID 4580 wrote to memory of 4228	4580	cmd.exe	166
PID 2976 wrote to memory of 4764	2976	cmd.exe	168
PID 2976 wrote to memory of 4764	2976	cmd.exe	168
PID 3084 wrote to memory of 2480	3084	cmd.exe	173
PID 3084 wrote to memory of 2480	3084	cmd.exe	173
PID 900 wrote to memory of 872	900	cmd.exe	181
PID 900 wrote to memory of 872	900	cmd.exe	181
PID 4068 wrote to memory of 3484	4068	cmd.exe	184
PID 4068 wrote to memory of 3484	4068	cmd.exe	184
PID 2692 wrote to memory of 468	2692	cmd.exe	186
PID 2692 wrote to memory of 468	2692	cmd.exe	186
PID 2720 wrote to memory of 4064	2720	EB71BD542C88DEE476937C64F685729E.exe	187
PID 2720 wrote to memory of 4064	2720	EB71BD542C88DEE476937C64F685729E.exe	187
PID 2576 wrote to memory of 5168	2576	cmd.exe	189
PID 2576 wrote to memory of 5168	2576	cmd.exe	189
PID 4064 wrote to memory of 5248	4064	cmd.exe	190
PID 4064 wrote to memory of 5248	4064	cmd.exe	190
PID 4064 wrote to memory of 5312	4064	cmd.exe	191
PID 4064 wrote to memory of 5312	4064	cmd.exe	191

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	EB71BD542C88DEE476937C64F685729E.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	EB71BD542C88DEE476937C64F685729E.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	EB71BD542C88DEE476937C64F685729E.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\EB71BD542C88DEE476937C64F685729E.exe
"C:\Users\Admin\AppData\Local\Temp\EB71BD542C88DEE476937C64F685729E.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FgiekywRJn.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:5248
- - C:\Users\Default User\dwm.exe
    "C:\Users\Default User\dwm.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1604

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Recovery\WindowsRE\services.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Recovery\WindowsRE\services.exe
  C:\Recovery\WindowsRE\services.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4796

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Adobe\Acrobat Reader DC\smss.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\smss.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\smss.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 7 /tr "'C:\ecd7b64386840f62c0ab2e4490\SearchHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHost" /sc ONLOGON /tr "'C:\ecd7b64386840f62c0ab2e4490\SearchHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 12 /tr "'C:\ecd7b64386840f62c0ab2e4490\SearchHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\ecd7b64386840f62c0ab2e4490\SearchHost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3252
- C:\ecd7b64386840f62c0ab2e4490\SearchHost.exe
  C:\ecd7b64386840f62c0ab2e4490\SearchHost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\ecd7b64386840f62c0ab2e4490\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\ecd7b64386840f62c0ab2e4490\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\ecd7b64386840f62c0ab2e4490\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2920

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\ecd7b64386840f62c0ab2e4490\RuntimeBroker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\ecd7b64386840f62c0ab2e4490\RuntimeBroker.exe
  C:\ecd7b64386840f62c0ab2e4490\RuntimeBroker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\lsass.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\lsass.exe
  "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\lsass.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Windows Defender\ja-JP\dllhost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Program Files (x86)\Windows Defender\ja-JP\dllhost.exe
  "C:\Program Files (x86)\Windows Defender\ja-JP\dllhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\sihost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Mozilla Maintenance Service\sihost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Program Files (x86)\Mozilla Maintenance Service\sihost.exe
  "C:\Program Files (x86)\Mozilla Maintenance Service\sihost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files\Uninstall Information\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files\Uninstall Information\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\4b80bbab5d33ff56af49c139\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files\Uninstall Information\Idle.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Program Files\Uninstall Information\Idle.exe
  "C:\Program Files\Uninstall Information\Idle.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\4b80bbab5d33ff56af49c139\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\4b80bbab5d33ff56af49c139\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2160

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\4b80bbab5d33ff56af49c139\dllhost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4564
- C:\4b80bbab5d33ff56af49c139\dllhost.exe
  C:\4b80bbab5d33ff56af49c139\dllhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Windows\schemas\Provisioning\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\schemas\Provisioning\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Windows\schemas\Provisioning\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4668

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\schemas\Provisioning\services.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\schemas\Provisioning\services.exe
  C:\Windows\schemas\Provisioning\services.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Windows\SystemResources\ShellComponents\pris\StartMenuExperienceHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\SystemResources\ShellComponents\pris\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Windows\SystemResources\ShellComponents\pris\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows NT\Accessories\ja-JP\unsecapp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\SystemResources\ShellComponents\pris\StartMenuExperienceHost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:416
- C:\Windows\SystemResources\ShellComponents\pris\StartMenuExperienceHost.exe
  C:\Windows\SystemResources\ShellComponents\pris\StartMenuExperienceHost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\ja-JP\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\Accessories\ja-JP\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Windows NT\Accessories\ja-JP\unsecapp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Program Files (x86)\Windows NT\Accessories\ja-JP\unsecapp.exe
  "C:\Program Files (x86)\Windows NT\Accessories\ja-JP\unsecapp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Cookies\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Admin\Cookies\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Cookies\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3668

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Cookies\explorer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Users\Admin\Cookies\explorer.exe
  C:\Users\Admin\Cookies\explorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Windows\BrowserCore\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\BrowserCore\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Windows\BrowserCore\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4364

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\BrowserCore\fontdrvhost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\BrowserCore\fontdrvhost.exe
  C:\Windows\BrowserCore\fontdrvhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files\Mozilla Firefox\browser\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\browser\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files\Mozilla Firefox\browser\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files\Mozilla Firefox\browser\lsass.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Program Files\Mozilla Firefox\browser\lsass.exe
  "C:\Program Files\Mozilla Firefox\browser\lsass.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Recovery\WindowsRE\RuntimeBroker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Recovery\WindowsRE\RuntimeBroker.exe
  C:\Recovery\WindowsRE\RuntimeBroker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default User\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\ecd7b64386840f62c0ab2e4490\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Default User\dwm.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Users\Default User\dwm.exe
  "C:\Users\Default User\dwm.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\ecd7b64386840f62c0ab2e4490\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\ecd7b64386840f62c0ab2e4490\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2160

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\ecd7b64386840f62c0ab2e4490\csrss.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2576
- C:\ecd7b64386840f62c0ab2e4490\csrss.exe
  C:\ecd7b64386840f62c0ab2e4490\csrss.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

services.exe

Path C:\Recovery\WindowsRE\services.exe
Size 3.4MB
SHA256 e7cf9ae73751f92a53dbbc41b4939510e23352bf3a942e86b269c72b80cdb63c
MD5 eb71bd542c88dee476937c64f685729e
SHA1 9c5264de5006a051cf949d749173211af5f71086
SHA512 1b58ae7989d54093eccd0b06e07440b6e0769ed85aa149f12796bbc0a29553eebd70f764edd9d3ad40e0e592100d0887f565c8fddd072729a51b003821c6330e
SSDEEP 49152:mSWEezum6cP6UWecaJtx1Y2QUoB70+xfiXkRSMxUoMK4U7gqo:PWim6cC5eBxCB5Bxfg0dmo3M
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\lsass.exe.log
Size 1KB
SHA256 5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
MD5 b4e91d2e5f40d5e2586a86cf3bb4df24
SHA1 31920b3a41aa4400d4a0230a7622848789b38672
SHA512 968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319
MD5 SHA1 SHA512

Submit Download

FgiekywRJn.bat

Path C:\Users\Admin\AppData\Local\Temp\FgiekywRJn.bat
Size 194B
SHA256 73a32212281e98be4e7d060764c3be5ceb2bd715bbe4706d04db6bfa5dbdf899
MD5 488a5bba9dd7251a61578750b55bb0b4
SHA1 7aee681c3f3898dddad70573125244787ea5a5de
SHA512 ab8d981ddd569552d04620b3695553070d5e7ce5ab3cc81be4ed0b62d2292cd906e19fde7c1a1653dd571047ebcd9a52d2f8a4742870e6d474cac6a96e44c671
MD5 SHA1 SHA512

Submit Download

memory/2720-20-0x000000001D5D0000-0x000000001D5D8000-memory.dmp

Download

memory/2720-19-0x000000001D5C0000-0x000000001D5CC000-memory.dmp

Download

memory/2720-5-0x0000000002D40000-0x0000000002D5C000-memory.dmp

Download

memory/2720-6-0x000000001CDD0000-0x000000001CE20000-memory.dmp

Download

memory/2720-7-0x0000000002D60000-0x0000000002D68000-memory.dmp

Download

memory/2720-8-0x0000000002D70000-0x0000000002D80000-memory.dmp

Download

memory/2720-9-0x0000000002D80000-0x0000000002D96000-memory.dmp

Download

memory/2720-10-0x000000001CD80000-0x000000001CD88000-memory.dmp

Download

memory/2720-11-0x000000001CDA0000-0x000000001CDB2000-memory.dmp

Download

memory/2720-12-0x000000001CDB0000-0x000000001CDBC000-memory.dmp

Download

memory/2720-13-0x000000001CD90000-0x000000001CD98000-memory.dmp

Download

memory/2720-14-0x000000001CDC0000-0x000000001CDD0000-memory.dmp

Download

memory/2720-15-0x000000001CE30000-0x000000001CE3A000-memory.dmp

Download

memory/2720-16-0x000000001D550000-0x000000001D5A6000-memory.dmp

Download

memory/2720-17-0x000000001D5A0000-0x000000001D5AC000-memory.dmp

Download

memory/2720-18-0x000000001D5B0000-0x000000001D5B8000-memory.dmp

Download

memory/2720-22-0x000000001DB40000-0x000000001E068000-memory.dmp

Download

memory/2720-0-0x0000000000720000-0x0000000000A8A000-memory.dmp

Download

memory/2720-4-0x0000000002D30000-0x0000000002D38000-memory.dmp

Download

memory/2720-21-0x000000001D5E0000-0x000000001D5F2000-memory.dmp

Download

memory/2720-23-0x000000001D610000-0x000000001D61C000-memory.dmp

Download

memory/2720-26-0x000000001D640000-0x000000001D64C000-memory.dmp

Download

memory/2720-25-0x000000001D630000-0x000000001D638000-memory.dmp

Download

memory/2720-24-0x000000001D620000-0x000000001D62C000-memory.dmp

Download

memory/2720-27-0x000000001D650000-0x000000001D65C000-memory.dmp

Download

memory/2720-28-0x000000001D860000-0x000000001D868000-memory.dmp

Download

memory/2720-29-0x000000001D870000-0x000000001D87C000-memory.dmp

Download

memory/2720-30-0x000000001D880000-0x000000001D88A000-memory.dmp

Download

memory/2720-33-0x000000001D8B0000-0x000000001D8BE000-memory.dmp

Download

memory/2720-32-0x000000001D8A0000-0x000000001D8A8000-memory.dmp

Download

memory/2720-31-0x000000001D890000-0x000000001D89E000-memory.dmp

Download

memory/2720-34-0x000000001D8C0000-0x000000001D8C8000-memory.dmp

Download

memory/2720-35-0x000000001D8D0000-0x000000001D8DC000-memory.dmp

Download

memory/2720-36-0x000000001D8E0000-0x000000001D8E8000-memory.dmp

Download

memory/2720-37-0x000000001D8F0000-0x000000001D8FA000-memory.dmp

Download

memory/2720-38-0x000000001D900000-0x000000001D90C000-memory.dmp

Download

memory/2720-3-0x0000000002D20000-0x0000000002D2E000-memory.dmp

Download

memory/2720-2-0x0000000002BC0000-0x0000000002BCE000-memory.dmp

Download

memory/2720-1-0x000000001CE20000-0x000000001CE30000-memory.dmp

Download