dcrat | f5fb3ae5ca25c16f178ca10c99aa7b4af70dc38fd806aef46d662c6ab40aab78

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MEGALOADER.exe
Size

1.7MB
MD5

ac4c9d6cd24a44a660c69bf7b55f17b0
SHA1

e41107db8aad88bb26d1879db7aed31e91942644
SHA256

f5fb3ae5ca25c16f178ca10c99aa7b4af70dc38fd806aef46d662c6ab40aab78
SHA512

0b1ee2a0c3a1c73d9ce53111df250c2c36d4dcc38ac9426bede09c8eb9a274aadb671e86018073c62abd7c09726ff878ccf1001240754e9bef3948e0a2130c4f
SSDEEP

24576:O2G/nvxW3Wir0g0bcg1vqd25Gl35KcbOwGqq+AZbPxtDSk5/FX5vDlIXNQdSR:ObA3dogGy/3dSnEYFJvxSN

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat 49 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.execontainerPerf.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1784	schtasks.exe
1792	schtasks.exe
2964	schtasks.exe
2004	schtasks.exe
708	schtasks.exe
1460	schtasks.exe
1716	schtasks.exe
992	schtasks.exe
1488	schtasks.exe
1472	schtasks.exe
2036	schtasks.exe
1416	schtasks.exe
292	schtasks.exe
2148	schtasks.exe
1128	schtasks.exe
540	schtasks.exe
1484	schtasks.exe
3048	schtasks.exe
1852	schtasks.exe
1928	schtasks.exe
1400	schtasks.exe
2144	schtasks.exe
3008	schtasks.exe
1588	schtasks.exe
2316	schtasks.exe
1008	schtasks.exe
2072	schtasks.exe
1888	schtasks.exe
1904	schtasks.exe
1692	schtasks.exe
2308	schtasks.exe
2120	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	containerPerf.exe
2732	schtasks.exe
2336	schtasks.exe
2796	schtasks.exe
1584	schtasks.exe
2852	schtasks.exe
692	schtasks.exe
2812	schtasks.exe
1528	schtasks.exe
356	schtasks.exe
568	schtasks.exe
2916	schtasks.exe
620	schtasks.exe
600	schtasks.exe
2108	schtasks.exe
348	schtasks.exe
1424	schtasks.exe

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1008	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	356	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2072	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1888	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2308	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2336	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	540	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	692	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	600	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1400	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	568	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1128	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	708	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1416	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	292	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	348	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1692	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1460	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	992	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1424	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	620	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	2376	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	2376	schtasks.exe

UAC bypass 3 TTPs 9 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

csrss.execontainerPerf.execsrss.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	containerPerf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	containerPerf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	containerPerf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\DriverSavessessionbroker\containerPerf.exe	dcrat
behavioral1/memory/2504-13-0x0000000000B50000-0x0000000000CA6000-memory.dmp	dcrat
behavioral1/memory/2976-143-0x0000000000120000-0x0000000000276000-memory.dmp	dcrat
behavioral1/memory/1648-159-0x0000000000900000-0x0000000000A56000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
2688	powershell.exe
3000	powershell.exe
2184	powershell.exe
2436	powershell.exe
2444	powershell.exe
2496	powershell.exe
2792	powershell.exe
2576	powershell.exe
2900	powershell.exe
2480	powershell.exe
2572	powershell.exe
2172	powershell.exe
2600	powershell.exe
2548	powershell.exe
2176	powershell.exe
2416	powershell.exe
2404	powershell.exe

Disables Task Manager via registry modification
evasion
Executes dropped EXE 6 IoCs

Processes:

containerPerf.execsrss.execsrss.execsrss.execsrss.execsrss.exe

pid process

2504 containerPerf.exe
2976 csrss.exe
1648 csrss.exe
588 csrss.exe
1972 csrss.exe
2900 csrss.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

2428 cmd.exe
2428 cmd.exe

pid	process
2428	cmd.exe
2428	cmd.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

containerPerf.execsrss.execsrss.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	containerPerf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	containerPerf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

4 pastebin.com
5 pastebin.com
7 pastebin.com

flow	ioc
4	pastebin.com
5	pastebin.com
7	pastebin.com

Drops file in Program Files directory 10 IoCs

Processes:

containerPerf.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\Office14\1033\Idle.exe	containerPerf.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\6ccacd8608530f	containerPerf.exe
File created	C:\Program Files\Internet Explorer\it-IT\services.exe	containerPerf.exe
File created	C:\Program Files\Internet Explorer\it-IT\c5b4cb5e9653cc	containerPerf.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\it-IT\csrss.exe	containerPerf.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\lsass.exe	containerPerf.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\6203df4a6bafc7	containerPerf.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\taskhost.exe	containerPerf.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\b75386f1303e64	containerPerf.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\it-IT\886983d96e3d3e	containerPerf.exe

Drops file in Windows directory 4 IoCs

Processes:

containerPerf.exe

description	ioc	process
File created	C:\Windows\Resources\Ease of Access Themes\smss.exe	containerPerf.exe
File created	C:\Windows\Resources\Ease of Access Themes\69ddcba757bf72	containerPerf.exe
File created	C:\Windows\SchCache\conhost.exe	containerPerf.exe
File created	C:\Windows\SchCache\088424020bedd6	containerPerf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1996 reg.exe

pid	process
1996	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2316	schtasks.exe
2004	schtasks.exe
1784	schtasks.exe
2148	schtasks.exe
1424	schtasks.exe
1888	schtasks.exe
2852	schtasks.exe
1588	schtasks.exe
1488	schtasks.exe
356	schtasks.exe
1928	schtasks.exe
568	schtasks.exe
2144	schtasks.exe
1528	schtasks.exe
620	schtasks.exe
1008	schtasks.exe
692	schtasks.exe
1460	schtasks.exe
3048	schtasks.exe
2072	schtasks.exe
2036	schtasks.exe
2336	schtasks.exe
3008	schtasks.exe
292	schtasks.exe
348	schtasks.exe
1716	schtasks.exe
1472	schtasks.exe
2308	schtasks.exe
1904	schtasks.exe
600	schtasks.exe
1400	schtasks.exe
1128	schtasks.exe
2796	schtasks.exe
1792	schtasks.exe
2964	schtasks.exe
1852	schtasks.exe
2916	schtasks.exe
2120	schtasks.exe
540	schtasks.exe
1484	schtasks.exe
1692	schtasks.exe
992	schtasks.exe
2812	schtasks.exe
1584	schtasks.exe
2732	schtasks.exe
708	schtasks.exe
2108	schtasks.exe
1416	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

containerPerf.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.execsrss.exe

pid	process
2504	containerPerf.exe
3000	powershell.exe
2416	powershell.exe
2600	powershell.exe
2444	powershell.exe
2548	powershell.exe
2480	powershell.exe
2900	powershell.exe
2572	powershell.exe
2496	powershell.exe
2436	powershell.exe
2184	powershell.exe
2792	powershell.exe
2176	powershell.exe
2172	powershell.exe
2688	powershell.exe
2576	powershell.exe
2404	powershell.exe
2976	csrss.exe
1648	csrss.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

description	pid	process
Token: SeDebugPrivilege	2504	containerPerf.exe
Token: SeDebugPrivilege	3000	powershell.exe
Token: SeDebugPrivilege	2416	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	2444	powershell.exe
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	2480	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeDebugPrivilege	2436	powershell.exe
Token: SeDebugPrivilege	2184	powershell.exe
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	2176	powershell.exe
Token: SeDebugPrivilege	2172	powershell.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	2576	powershell.exe
Token: SeDebugPrivilege	2404	powershell.exe
Token: SeDebugPrivilege	2976	csrss.exe
Token: SeDebugPrivilege	1648	csrss.exe
Token: SeDebugPrivilege	588	csrss.exe
Token: SeDebugPrivilege	1972	csrss.exe
Token: SeDebugPrivilege	2900	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

MEGALOADER.exeWScript.execmd.execontainerPerf.exe

description	pid	process	target process
PID 2196 wrote to memory of 2576	2196	MEGALOADER.exe	WScript.exe
PID 2196 wrote to memory of 2576	2196	MEGALOADER.exe	WScript.exe
PID 2196 wrote to memory of 2576	2196	MEGALOADER.exe	WScript.exe
PID 2196 wrote to memory of 2576	2196	MEGALOADER.exe	WScript.exe
PID 2576 wrote to memory of 2428	2576	WScript.exe	cmd.exe
PID 2576 wrote to memory of 2428	2576	WScript.exe	cmd.exe
PID 2576 wrote to memory of 2428	2576	WScript.exe	cmd.exe
PID 2576 wrote to memory of 2428	2576	WScript.exe	cmd.exe
PID 2428 wrote to memory of 2504	2428	cmd.exe	containerPerf.exe
PID 2428 wrote to memory of 2504	2428	cmd.exe	containerPerf.exe
PID 2428 wrote to memory of 2504	2428	cmd.exe	containerPerf.exe
PID 2428 wrote to memory of 2504	2428	cmd.exe	containerPerf.exe
PID 2504 wrote to memory of 2792	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2792	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2792	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2548	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2548	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2548	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2600	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2600	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2600	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2496	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2496	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2496	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2176	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2176	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2176	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2184	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2184	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2184	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2900	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2900	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2900	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2172	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2172	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2172	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2572	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2572	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2572	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 3000	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 3000	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 3000	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2480	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2480	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2480	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2416	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2416	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2416	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2576	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2576	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2576	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2444	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2444	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2444	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2688	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2688	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2688	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2404	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2404	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2404	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2436	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2436	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2436	2504	containerPerf.exe	powershell.exe
PID 2504 wrote to memory of 2680	2504	containerPerf.exe	cmd.exe

System policy modification 1 TTPs 9 IoCs

evasion

Modify Registry

T1112

Processes:

csrss.execsrss.execontainerPerf.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	containerPerf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	containerPerf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	containerPerf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\MEGALOADER.exe
"C:\Users\Admin\AppData\Local\Temp\MEGALOADER.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2196

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\DriverSavessessionbroker\xFrhwR4IIWv.vbe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2576

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\DriverSavessessionbroker\BB4HCuNIVdx078g7AY04mw7MSmeo.bat" "
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2428

C:\DriverSavessessionbroker\containerPerf.exe
"C:\DriverSavessessionbroker\containerPerf.exe"
4⤵
- DcRat
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2504

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\DriverSavessessionbroker\containerPerf.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2792

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\explorer.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2548

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\Idle.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2600

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\taskhost.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2496

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\System.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2176

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\Idle.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2184

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\taskhost.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2900

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Office14\1033\Idle.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2172

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\it-IT\services.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2572

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3000

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Pictures\csrss.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2480

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\Accessories\it-IT\csrss.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2416

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\lsass.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2576

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Ease of Access Themes\smss.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2444

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\smss.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\csrss.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2404

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SchCache\conhost.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2436

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZMfeeX7n0I.bat"
5⤵
PID:2680

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
6⤵
PID:1368

C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\csrss.exe
"C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\csrss.exe"
6⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2976

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bde47bd6-5bbb-4922-af16-95304111cbfe.vbs"
7⤵
PID:2252

C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\csrss.exe
C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\csrss.exe
8⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1648

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6738b574-0476-4f90-bb4d-adf554e7bc55.vbs"
9⤵
PID:1460

C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\csrss.exe
C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\csrss.exe
10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1972

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8165c922-c289-484d-a63c-b975ce00a254.vbs"
9⤵
PID:1908

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Mw1PlbJmoj.bat"
9⤵
PID:1716

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
10⤵
PID:1396

C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\csrss.exe
"C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\csrss.exe"
10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2900

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e65c40c5-40f4-4508-953a-5443b23a3334.vbs"
7⤵
PID:2796

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0VN2lTwXPf.bat"
7⤵
PID:1588

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
8⤵
PID:2452

C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\csrss.exe
"C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\csrss.exe"
8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:588

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
4⤵
- Modifies registry key
PID:1996

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\taskhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Admin\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\taskhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\Office14\1033\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\1033\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office\Office14\1033\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files\Internet Explorer\it-IT\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\it-IT\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files\Internet Explorer\it-IT\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Pictures\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\Pictures\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Pictures\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\Accessories\it-IT\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\it-IT\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\Accessories\it-IT\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Windows\Resources\Ease of Access Themes\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Resources\Ease of Access Themes\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Windows\Resources\Ease of Access Themes\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Windows\SchCache\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\SchCache\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Windows\SchCache\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\DriverSavessessionbroker\BB4HCuNIVdx078g7AY04mw7MSmeo.bat
Filesize
159B

MD5
d55b68123f0af3b57b68ce8498b9a56c

SHA1
c78f936b3b86ba733a704494c95356f931b283ac

SHA256
2a265dc6e087fca3bb14db7a48fbc93e8b5d3b1a77ab2c39b316d6843b71af3c

SHA512
a2a2cda2032c010deef8e3addcdca6b6c3f2b1d81941724c45bd8d8d2f81d777e23dc7c4f59481f590cfc633167ed3161baf65f135e1154e1b767920cf34afde

Download Submit
C:\DriverSavessessionbroker\containerPerf.exe
Filesize
1.3MB

MD5
48c2137034bee9bdfc2c9df1e71e9e04

SHA1
573e8453bc08e2b4e8e65b8560d81b150a9acdd8

SHA256
54559193c7dc48fc6e2d0e2115eaaaf9ffd48b4aa40350673b6b93bdc6c92d88

SHA512
5c854bfa2b963039db83cf764ea0ddb513c612896c325acdd944bbb115858153cac15addbf18da208cf8753b60f774e7a61e0540fd82445f29f9d47a31c2b247

Download Submit
C:\DriverSavessessionbroker\xFrhwR4IIWv.vbe
Filesize
229B

MD5
dc6d3bc19c948df2fda4cf8dbfcf3733

SHA1
a7def52ce2b412ded4ec6d92f33017b39e32398c

SHA256
4f493dc39aaeb060106380100db44268cb35b7638bf345e4e31f0b62aca8d01c

SHA512
a0ceed57ffcee59907042323f37eda2e8d2382fdd6440e70f5ffa7fad969c0be79946b871004423e78e336299920927470858c9712eaf8e7fca31ebd01201cae

Download Submit
C:\Users\Admin\AppData\Local\Temp\0VN2lTwXPf.bat
Filesize
223B

MD5
6178f9881987c89f7abffef5fec58fdc

SHA1
dd87423c294390c31c30e169fdab4f45df2f4c2c

SHA256
bcb58541bae97896bd1dbc929f1c2aa2a7cfcfc42e0ccabb3b56350a710d504c

SHA512
4be1938916a4c5ac1a386c2eb8cb57c3338b444e667b3fb6ea8e438316acefbd0633ec6bd64fe775ee5ebb3d56c6349b4527c01739ce325acabeb833290206c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\6738b574-0476-4f90-bb4d-adf554e7bc55.vbs
Filesize
734B

MD5
69af1435cca2430cb8d6743fdc4580e7

SHA1
14344f08e34c2e2546d0ac769832f5dd7dce440f

SHA256
2505c743bb4301b4a1aa3900fe9455beb8b85c6a2a3200ae2ccccb24029a0a2d

SHA512
7b1e90db1ce4f1e2ceb6d06c8cbd6a42eb11898a922a393da73ee02bb21fe5f4150973d8efedf3d8fec10afb9058b28198f6b911a3c970adeaa121badf44842c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mw1PlbJmoj.bat
Filesize
223B

MD5
dd288b4c5cfaf249f6618f0244cd332f

SHA1
bef3746a8905a5e3fda1863dead590a8a51fb213

SHA256
e1362db3fb77f31b4d37f5ee833e6c6c1594d0dd7544fb10f27922832165f3ce

SHA512
63b848186d7ce74eda5e0789446efdd0b8d4da98f341babbdc0eb40b0430200ffcfc86719b313cdb8325d7e4f058ac21793215c4fb674bd2b20ef1e7db272181

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZMfeeX7n0I.bat
Filesize
223B

MD5
4e6969513b4e9d305e2f1e6f5744e6fd

SHA1
2ba48f86cfaa2ebfa20a145c6e923cf53a627f17

SHA256
879dd1f93bba1fd1178f7e1cd04971ac74158cf066b0b6e42695bfccee561d54

SHA512
50df614b0ceb24af00f2763f5e6bba846937b5853063307934abbc3d3f95a6250544c5c68ad3b833fb7227156a01401c1540c0092944c92e5c6f88f8e8ff7e6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\bde47bd6-5bbb-4922-af16-95304111cbfe.vbs
Filesize
734B

MD5
f4a549bd2540f15effc45b7e4bc12ecb

SHA1
0493903af8bbd9b9acb9408bc5e0b86cee5bf977

SHA256
e6694055953d0e0f635044466aff860728d777af407be8297856dcb1d53477f5

SHA512
9ca6671f4c4452a3565d0f7824f6da5252a6723ac74275188d3cd45905ec931060f8515f3fbce77df6f36a4bf2d50b1be993a9057c7fb0f47cb9b93aa492a24a

Download Submit
C:\Users\Admin\AppData\Local\Temp\e65c40c5-40f4-4508-953a-5443b23a3334.vbs
Filesize
510B

MD5
56d57ecfa2d1deafe171c19ddd213ee4

SHA1
d23782dbd1c7b9f72235b1179031817356b8851f

SHA256
a1f43c10749ed3b0835a58859668d0f9b45007917fda5c22aac0ea04e0051a7f

SHA512
defd16c582df21a4177473943df280f6056ab81869e8656aa7b042af766a3ced76b1fe27194e868d347dda285a2835107980d227582e21d0dd8f30a2e382bc91

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
bbab1c873ab137cc89efb955b5ebd319

SHA1
22cc2847969be05bbb33893044451f3f9953341f

SHA256
69b4e1d4703b3e6ef0ab3845ef1c18260aef6ec210360df86148985046cbbfbe

SHA512
8917705b317c98bfbb22aabe6693e4f2d3572d31c5c5d79553881e100d60e41d8d3f02166f829cf72cdf4a8edd6cc620e9884b275f44926d896bddc6a4da3bff

Download Submit
memory/1648-159-0x0000000000900000-0x0000000000A56000-memory.dmp

Filesize
1.3MB

Download
memory/2504-16-0x00000000003A0000-0x00000000003AA000-memory.dmp

Filesize
40KB

Download
memory/2504-22-0x0000000000AA0000-0x0000000000AAC000-memory.dmp

Filesize
48KB

Download
memory/2504-21-0x0000000000560000-0x000000000056A000-memory.dmp

Filesize
40KB

Download
memory/2504-20-0x0000000000550000-0x000000000055E000-memory.dmp

Filesize
56KB

Download
memory/2504-19-0x0000000000450000-0x000000000045E000-memory.dmp

Filesize
56KB

Download
memory/2504-18-0x0000000000440000-0x000000000044A000-memory.dmp

Filesize
40KB

Download
memory/2504-17-0x00000000003B0000-0x00000000003BC000-memory.dmp

Filesize
48KB

Download
memory/2504-15-0x0000000000140000-0x0000000000148000-memory.dmp

Filesize
32KB

Download
memory/2504-14-0x0000000000370000-0x000000000038C000-memory.dmp

Filesize
112KB

Download
memory/2504-13-0x0000000000B50000-0x0000000000CA6000-memory.dmp

Filesize
1.3MB

Download
memory/2600-73-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/2976-143-0x0000000000120000-0x0000000000276000-memory.dmp

Filesize
1.3MB

Download
memory/3000-75-0x0000000001EC0000-0x0000000001EC8000-memory.dmp

Filesize
32KB

Download