dcrat | f4ab048f183a7269468b0cb8509668831e3d8f816e1be3162a0734c83c488c97

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05-07-2024 01:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4ab048f183a7269468b0cb8509668831e3d8f816e1be3162a0734c83c488c97.exe
Size

1.1MB
MD5

829cab70d17eaedeabe77c32154d11f2
SHA1

196c898abee483229f61342ac1f8248677f833da
SHA256

f4ab048f183a7269468b0cb8509668831e3d8f816e1be3162a0734c83c488c97
SHA512

9d7ce634639d86cf020d1ce1a85e7c7d113feed2d0fc98f1f5ebb233ba77129e133b92636864bdbf105ec5599143f84835219203173bcf63ce047a7d40a7f4c3
SSDEEP

24576:Y2G/nvxW3W4kqExbb2uM2bowf751JKeqkTsRPns:YbA34qQUwf75bz

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat 37 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exef4ab048f183a7269468b0cb8509668831e3d8f816e1be3162a0734c83c488c97.exe

pid	process
2480	schtasks.exe
2056	schtasks.exe
4860	schtasks.exe
1924	schtasks.exe
224	schtasks.exe
2240	schtasks.exe
3892	schtasks.exe
2280	schtasks.exe
2728	schtasks.exe
3104	schtasks.exe
4468	schtasks.exe
2180	schtasks.exe
876	schtasks.exe
4548	schtasks.exe
2304	schtasks.exe
1052	schtasks.exe
4524	schtasks.exe
4668	schtasks.exe
992	schtasks.exe
2892	schtasks.exe
1644	schtasks.exe
2116	schtasks.exe
2264	schtasks.exe
1584	schtasks.exe
3532	schtasks.exe
1532	schtasks.exe
1300	schtasks.exe
3852	schtasks.exe
1488	schtasks.exe
1748	schtasks.exe
3264	schtasks.exe
2700	schtasks.exe
4012	schtasks.exe
1692	schtasks.exe
1864	schtasks.exe
2968	schtasks.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	f4ab048f183a7269468b0cb8509668831e3d8f816e1be3162a0734c83c488c97.exe

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

componentfontnet.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\fontdrvhost.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\fontdrvhost.exe\", \"C:\\intobroker\\cmd.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\fontdrvhost.exe\", \"C:\\intobroker\\cmd.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\csrss.exe\", \"C:\\Users\\Default User\\System.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\fontdrvhost.exe\", \"C:\\intobroker\\cmd.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\csrss.exe\", \"C:\\Users\\Default User\\System.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\fontdrvhost.exe\", \"C:\\intobroker\\cmd.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\csrss.exe\", \"C:\\Users\\Default User\\System.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\conhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\ja-JP\\cmd.exe\", \"C:\\Users\\Admin\\Pictures\\Saved Pictures\\taskhostw.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\fontdrvhost.exe\", \"C:\\intobroker\\cmd.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\csrss.exe\", \"C:\\Users\\Default User\\System.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\conhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\ja-JP\\cmd.exe\", \"C:\\Users\\Admin\\Pictures\\Saved Pictures\\taskhostw.exe\", \"C:\\intobroker\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Mail\\dwm.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\fontdrvhost.exe\", \"C:\\intobroker\\cmd.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\csrss.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\fontdrvhost.exe\", \"C:\\intobroker\\cmd.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\csrss.exe\", \"C:\\Users\\Default User\\System.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\conhost.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\fontdrvhost.exe\", \"C:\\intobroker\\cmd.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\csrss.exe\", \"C:\\Users\\Default User\\System.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\conhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\ja-JP\\cmd.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\fontdrvhost.exe\", \"C:\\intobroker\\cmd.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\csrss.exe\", \"C:\\Users\\Default User\\System.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\conhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\ja-JP\\cmd.exe\", \"C:\\Users\\Admin\\Pictures\\Saved Pictures\\taskhostw.exe\", \"C:\\intobroker\\OfficeClickToRun.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\fontdrvhost.exe\", \"C:\\intobroker\\cmd.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\csrss.exe\", \"C:\\Users\\Default User\\System.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\conhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\ja-JP\\cmd.exe\", \"C:\\Users\\Admin\\Pictures\\Saved Pictures\\taskhostw.exe\", \"C:\\intobroker\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Mail\\dwm.exe\", \"C:\\intobroker\\Idle.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\fontdrvhost.exe\", \"C:\\intobroker\\cmd.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\csrss.exe\", \"C:\\Users\\Default User\\System.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\conhost.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\ja-JP\\cmd.exe\", \"C:\\Users\\Admin\\Pictures\\Saved Pictures\\taskhostw.exe\", \"C:\\intobroker\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Mail\\dwm.exe\", \"C:\\intobroker\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\Idle.exe\""	componentfontnet.exe

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	992	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3892	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	876	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1052	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3104	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4012	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1692	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1300	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4524	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3852	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4468	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4548	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4860	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3264	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4668	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	224	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3532	932	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	932	schtasks.exe

DCRat payload 2 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
rat

Processes:

resource yara_rule

C:\intobroker\componentfontnet.exe dcrat
behavioral2/memory/1112-13-0x0000000000050000-0x0000000000126000-memory.dmp dcrat

resource	yara_rule
C:\intobroker\componentfontnet.exe	dcrat
behavioral2/memory/1112-13-0x0000000000050000-0x0000000000126000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f4ab048f183a7269468b0cb8509668831e3d8f816e1be3162a0734c83c488c97.exeWScript.execomponentfontnet.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	f4ab048f183a7269468b0cb8509668831e3d8f816e1be3162a0734c83c488c97.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	componentfontnet.exe

Executes dropped EXE 2 IoCs

Processes:

componentfontnet.exeSystem.exe

pid process

1112 componentfontnet.exe
4556 System.exe

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

componentfontnet.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\conhost.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files (x86)\\Internet Explorer\\ja-JP\\cmd.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Users\\Admin\\Pictures\\Saved Pictures\\taskhostw.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\csrss.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Default User\\System.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Default User\\System.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows Mail\\dwm.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows Mail\\dwm.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\intobroker\\Idle.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\intobroker\\Idle.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\Idle.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\Idle.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\fontdrvhost.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SetupMetrics\\csrss.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files (x86)\\Internet Explorer\\ja-JP\\cmd.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\intobroker\\cmd.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\conhost.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\intobroker\\OfficeClickToRun.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\intobroker\\OfficeClickToRun.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\fontdrvhost.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\intobroker\\cmd.exe\""	componentfontnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Users\\Admin\\Pictures\\Saved Pictures\\taskhostw.exe\""	componentfontnet.exe

Drops file in Program Files directory 12 IoCs

Processes:

componentfontnet.exe

description	ioc	process
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\088424020bedd6	componentfontnet.exe
File created	C:\Program Files (x86)\Internet Explorer\ja-JP\ebf1f9fa8afd6d	componentfontnet.exe
File created	C:\Program Files (x86)\Windows Mail\dwm.exe	componentfontnet.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\Idle.exe	componentfontnet.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\886983d96e3d3e	componentfontnet.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe	componentfontnet.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\conhost.exe	componentfontnet.exe
File created	C:\Program Files (x86)\Windows Mail\6cb0b6c459d5d3	componentfontnet.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\6ccacd8608530f	componentfontnet.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\csrss.exe	componentfontnet.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\9e8d7a4ca61bd9	componentfontnet.exe
File created	C:\Program Files (x86)\Internet Explorer\ja-JP\cmd.exe	componentfontnet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

f4ab048f183a7269468b0cb8509668831e3d8f816e1be3162a0734c83c488c97.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings f4ab048f183a7269468b0cb8509668831e3d8f816e1be3162a0734c83c488c97.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	f4ab048f183a7269468b0cb8509668831e3d8f816e1be3162a0734c83c488c97.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	process
2180	schtasks.exe
3104	schtasks.exe
2700	schtasks.exe
3852	schtasks.exe
4548	schtasks.exe
1584	schtasks.exe
1864	schtasks.exe
2892	schtasks.exe
2280	schtasks.exe
3892	schtasks.exe
1052	schtasks.exe
2056	schtasks.exe
4468	schtasks.exe
4668	schtasks.exe
1300	schtasks.exe
4860	schtasks.exe
3532	schtasks.exe
2240	schtasks.exe
2304	schtasks.exe
2116	schtasks.exe
4012	schtasks.exe
3264	schtasks.exe
1692	schtasks.exe
4524	schtasks.exe
1748	schtasks.exe
1644	schtasks.exe
992	schtasks.exe
2728	schtasks.exe
876	schtasks.exe
2968	schtasks.exe
1924	schtasks.exe
1488	schtasks.exe
2480	schtasks.exe
1532	schtasks.exe
2264	schtasks.exe
224	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

componentfontnet.exeSystem.exe

pid	process
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
1112	componentfontnet.exe
4556	System.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

componentfontnet.exeSystem.exe

description pid process

Token: SeDebugPrivilege 1112 componentfontnet.exe
Token: SeDebugPrivilege 4556 System.exe

description	pid	process
Token: SeDebugPrivilege	1112	componentfontnet.exe
Token: SeDebugPrivilege	4556	System.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

f4ab048f183a7269468b0cb8509668831e3d8f816e1be3162a0734c83c488c97.exeWScript.execmd.execomponentfontnet.exe

description	pid	process	target process
PID 2340 wrote to memory of 576	2340	f4ab048f183a7269468b0cb8509668831e3d8f816e1be3162a0734c83c488c97.exe	WScript.exe
PID 2340 wrote to memory of 576	2340	f4ab048f183a7269468b0cb8509668831e3d8f816e1be3162a0734c83c488c97.exe	WScript.exe
PID 2340 wrote to memory of 576	2340	f4ab048f183a7269468b0cb8509668831e3d8f816e1be3162a0734c83c488c97.exe	WScript.exe
PID 576 wrote to memory of 4224	576	WScript.exe	cmd.exe
PID 576 wrote to memory of 4224	576	WScript.exe	cmd.exe
PID 576 wrote to memory of 4224	576	WScript.exe	cmd.exe
PID 4224 wrote to memory of 1112	4224	cmd.exe	componentfontnet.exe
PID 4224 wrote to memory of 1112	4224	cmd.exe	componentfontnet.exe
PID 1112 wrote to memory of 4556	1112	componentfontnet.exe	System.exe
PID 1112 wrote to memory of 4556	1112	componentfontnet.exe	System.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\f4ab048f183a7269468b0cb8509668831e3d8f816e1be3162a0734c83c488c97.exe
"C:\Users\Admin\AppData\Local\Temp\f4ab048f183a7269468b0cb8509668831e3d8f816e1be3162a0734c83c488c97.exe"
1⤵
- DcRat
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2340

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\intobroker\osry78APVO.vbe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:576

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\intobroker\tDTHMvsh0leL386.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:4224

C:\intobroker\componentfontnet.exe
"C:\intobroker\componentfontnet.exe"
4⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112

C:\Users\Default User\System.exe
"C:\Users\Default User\System.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\intobroker\cmd.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\intobroker\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\intobroker\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\cmd.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Pictures\Saved Pictures\taskhostw.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\Admin\Pictures\Saved Pictures\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Pictures\Saved Pictures\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\intobroker\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\intobroker\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\intobroker\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\intobroker\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\intobroker\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\intobroker\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1864

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\intobroker\componentfontnet.exe
Filesize
829KB

MD5
0496185a6219652c72da3dc493b35853

SHA1
9060775977b6a917f8d513521ad1a327342d0eab

SHA256
32e448e205263af7253fdb66af9e2349e18a6054c9a1d27e8c5264840ba1559e

SHA512
8a36acae4bf2e966ef2913d24b2be6ed8c4d167868e98b94fdebc4892895a61f0c43a682a829a9f615a03aec953bca3f2cf1915b1368fa2cf1fd9be91f2da84f

Download Submit
C:\intobroker\osry78APVO.vbe
Filesize
203B

MD5
d9575ef3d39fa2d3f7cddfa06e37aed9

SHA1
96f3d4b152dd2b5367a6c6199c7c0cb8a7e55e48

SHA256
7620872ff0baa9a5acccdf52eda7568ac9e26968922835abab01703e25c6f8b5

SHA512
5f0bae0a68887a17b0d5cbac991a0657b83dc3e9bdfa0bfd62805d0cbaf4bad1d2354d63549743e46e11d6449f2a6d6bf7a1892ba5efa744abe7e1027234e742

Download Submit
C:\intobroker\tDTHMvsh0leL386.bat
Filesize
36B

MD5
eebb77f627130b420bf208f1efe0b460

SHA1
60fc9a9abee4f092453513424d3ad026d047b5fd

SHA256
8a5e709a08538e22d8491eaaf5aaf53b1468229a5721c072ea08c9467e0c3ef5

SHA512
030ddab47f04ddcfb8f1ec412621d0e31821f82fd38dde3fae07e63234613d14276bc2d378f20d9499fd1b9098cb042f5fefe7b49cb2aad5ef44635736e8b7ed

Download Submit
memory/1112-12-0x00007FFECB503000-0x00007FFECB505000-memory.dmp

Filesize
8KB

Download
memory/1112-13-0x0000000000050000-0x0000000000126000-memory.dmp

Filesize
856KB

Download