dcrat | e9275284ac3531a412f04ac246137c194439fa9e04000083a3a72aabc0cd3311

Analysis

max time kernel
158s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
10/07/2022, 10:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DCRatBuild.exe
Size 1.4MB
Sample220710-mz4lmsbbbk
SHA256 e9275284ac3531a412f04ac246137c194439fa9e04000083a3a72aabc0cd3311
MD5 f6c035b040d47bc7c32a09e6526fb3c2
SHA1 8d1eca9fcaad88e5e08e9d904ced8793aa2989a0
SHA512 7ea5344cec063f97d13bd658e8c2763a5128453d3a3421ce9f07144fce299785484cb10254b914807832b55913bf8bd23746caafad55ade5fedbd3ea19ce6d27
MD5 SHA1 SHA512

Score

10^/10

dcrat infostealer rat suricata

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3820	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4104	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5096	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4140	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4136	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3852	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3324	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3508	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4968	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5068	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3844	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4408	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4428	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	224	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3948	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3828	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1880	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3884	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4916	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4752	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4748	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4164	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4260	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4356	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3648	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4824	4992	schtasks.exe	65
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	716	4992	schtasks.exe	65

suricata: ET MALWARE DCRAT Activity (GET)
suricata: ET MALWARE DCRAT Activity (GET)
suricata

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0006000000023153-135.dat	dcrat
behavioral2/files/0x0006000000023153-136.dat	dcrat
behavioral2/memory/3388-137-0x0000000000530000-0x0000000000656000-memory.dmp	dcrat
behavioral2/files/0x0006000000023170-145.dat	dcrat
behavioral2/files/0x0006000000023170-146.dat	dcrat

Executes dropped EXE 2 IoCs

pid	Process
3388	bridgeAgent.exe
4284	spoolsv.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	DCRatBuild.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	bridgeAgent.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\SearchApp.exe	bridgeAgent.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\38384e6a620884	bridgeAgent.exe
File created	C:\Program Files\Uninstall Information\RuntimeBroker.exe	bridgeAgent.exe
File opened for modification	C:\Program Files\Uninstall Information\RuntimeBroker.exe	bridgeAgent.exe
File created	C:\Program Files\Uninstall Information\9e8d7a4ca61bd9	bridgeAgent.exe
File created	C:\Program Files\ModifiableWindowsApps\SppExtComObj.exe	bridgeAgent.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\es-ES\ebf1f9fa8afd6d	bridgeAgent.exe
File created	C:\Windows\Panther\setup.exe\StartMenuExperienceHost.exe	bridgeAgent.exe
File created	C:\Windows\Panther\setup.exe\55b276f4edf653	bridgeAgent.exe
File created	C:\Windows\ImmersiveControlPanel\SystemSettings\System.exe	bridgeAgent.exe
File created	C:\Windows\ImmersiveControlPanel\SystemSettings\27d1bcfc3c54e0	bridgeAgent.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management.A#\f8458c8de3d147a80d90bfeb1dbda24e\fontdrvhost.exe	bridgeAgent.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management.A#\f8458c8de3d147a80d90bfeb1dbda24e\5b884080fd4f94	bridgeAgent.exe
File created	C:\Windows\es-ES\cmd.exe	bridgeAgent.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4928	schtasks.exe
2148	schtasks.exe
3828	schtasks.exe
4260	schtasks.exe
4824	schtasks.exe
3324	schtasks.exe
4968	schtasks.exe
4428	schtasks.exe
1880	schtasks.exe
4164	schtasks.exe
548	schtasks.exe
4356	schtasks.exe
5020	schtasks.exe
2244	schtasks.exe
3852	schtasks.exe
3948	schtasks.exe
2464	schtasks.exe
716	schtasks.exe
2288	schtasks.exe
5096	schtasks.exe
1644	schtasks.exe
3508	schtasks.exe
2060	schtasks.exe
1948	schtasks.exe
1872	schtasks.exe
4748	schtasks.exe
2916	schtasks.exe
3820	schtasks.exe
4136	schtasks.exe
4408	schtasks.exe
4104	schtasks.exe
2276	schtasks.exe
3844	schtasks.exe
4996	schtasks.exe
4916	schtasks.exe
4752	schtasks.exe
3648	schtasks.exe
4140	schtasks.exe
5068	schtasks.exe
2352	schtasks.exe
224	schtasks.exe
3884	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings	DCRatBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings	bridgeAgent.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3388	bridgeAgent.exe
3388	bridgeAgent.exe
3388	bridgeAgent.exe
3388	bridgeAgent.exe
3388	bridgeAgent.exe
3388	bridgeAgent.exe
3388	bridgeAgent.exe
3388	bridgeAgent.exe
3388	bridgeAgent.exe
3388	bridgeAgent.exe
3388	bridgeAgent.exe
3388	bridgeAgent.exe
3388	bridgeAgent.exe
3388	bridgeAgent.exe
3388	bridgeAgent.exe
3388	bridgeAgent.exe
3388	bridgeAgent.exe
3388	bridgeAgent.exe
3388	bridgeAgent.exe
3388	bridgeAgent.exe
3388	bridgeAgent.exe
3388	bridgeAgent.exe
3388	bridgeAgent.exe
3388	bridgeAgent.exe
3388	bridgeAgent.exe
4284	spoolsv.exe
4284	spoolsv.exe
4284	spoolsv.exe
4284	spoolsv.exe
4284	spoolsv.exe
4284	spoolsv.exe
4284	spoolsv.exe
4284	spoolsv.exe
4284	spoolsv.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4284	spoolsv.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3388	bridgeAgent.exe
Token: SeDebugPrivilege	4284	spoolsv.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 924	3556	DCRatBuild.exe	79
PID 3556 wrote to memory of 924	3556	DCRatBuild.exe	79
PID 3556 wrote to memory of 924	3556	DCRatBuild.exe	79
PID 924 wrote to memory of 4212	924	WScript.exe	80
PID 924 wrote to memory of 4212	924	WScript.exe	80
PID 924 wrote to memory of 4212	924	WScript.exe	80
PID 4212 wrote to memory of 3388	4212	cmd.exe	82
PID 4212 wrote to memory of 3388	4212	cmd.exe	82
PID 3388 wrote to memory of 4348	3388	bridgeAgent.exe	125
PID 3388 wrote to memory of 4348	3388	bridgeAgent.exe	125
PID 4348 wrote to memory of 3396	4348	cmd.exe	127
PID 4348 wrote to memory of 3396	4348	cmd.exe	127
PID 4348 wrote to memory of 4284	4348	cmd.exe	129
PID 4348 wrote to memory of 4284	4348	cmd.exe	129

C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
"C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Comsvc\jb9NL.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Comsvc\W6MCHa5e022d0vCk17pRjLuo8Exgar.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4212
  - - C:\Comsvc\bridgeAgent.exe
      "C:\Comsvc\bridgeAgent.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3388
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gjqd2f84Li.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4348
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3396
      - C:\Recovery\WindowsRE\spoolsv.exe
        
        "C:\Recovery\WindowsRE\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:4284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Comsvc\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Comsvc\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Comsvc\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Windows\Panther\setup.exe\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\Panther\setup.exe\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Windows\Panther\setup.exe\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Comsvc\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Comsvc\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Comsvc\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\odt\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Windows\ImmersiveControlPanel\SystemSettings\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\ImmersiveControlPanel\SystemSettings\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Windows\ImmersiveControlPanel\SystemSettings\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management.A#\f8458c8de3d147a80d90bfeb1dbda24e\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management.A#\f8458c8de3d147a80d90bfeb1dbda24e\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management.A#\f8458c8de3d147a80d90bfeb1dbda24e\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Windows\es-ES\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\es-ES\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Windows\es-ES\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\odt\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\odt\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\odt\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

W6MCHa5e022d0vCk17pRjLuo8Exgar.bat

Path C:\Comsvc\W6MCHa5e022d0vCk17pRjLuo8Exgar.bat
Size 27B
SHA256 479e4052bee4a0ff377f81e537fcff8c92d5280247bfbcbbf9e25e11ea388627
MD5 4137c8892a77932327a72443ab42c0fe
SHA1 e413fdc8fc5f8405c29dc7819fa5b6599c8d097c
SHA512 85663c2301ad187b4166bdca5d061623f61e0edcd684e8233d641b60ae2b62271ff6cc9661669528c8466f0b9da87a3473edfadbfa4d679b00a0d0c741c3515b
MD5 SHA1 SHA512

Submit Download

bridgeAgent.exe

Path C:\Comsvc\bridgeAgent.exe
Size 1.1MB
SHA256 259ca593b867a67bae233e2969c7858b66d096c66c80699f5927468ddb0641a9
MD5 fa126f1dec092feabc0c66e6809b6970
SHA1 ff31a054a3a3e0b608ee41a7dac557510f05cc9b
SHA512 81799d16f049ecbb727433dc74ed35874cbf5a2d022b876965669b186eab37bb7940e3b25921bcc40408016537775364c136b01d8f71a559915144f67e724e23
SSDEEP 24576:WNx3Z0jGz6hn+CDdw6CUR05V6DMAO5jYQ4M/:AdZ0jGz6F+CEcDMBYQ4M
MD5 SHA1 SHA512 SSDEEP

Submit Download

bridgeAgent.exe

Path C:\Comsvc\bridgeAgent.exe
Size 1.1MB
SHA256 259ca593b867a67bae233e2969c7858b66d096c66c80699f5927468ddb0641a9
MD5 fa126f1dec092feabc0c66e6809b6970
SHA1 ff31a054a3a3e0b608ee41a7dac557510f05cc9b
SHA512 81799d16f049ecbb727433dc74ed35874cbf5a2d022b876965669b186eab37bb7940e3b25921bcc40408016537775364c136b01d8f71a559915144f67e724e23
SSDEEP 24576:WNx3Z0jGz6hn+CDdw6CUR05V6DMAO5jYQ4M/:AdZ0jGz6F+CEcDMBYQ4M
MD5 SHA1 SHA512 SSDEEP

Submit Download

jb9NL.vbe

Path C:\Comsvc\jb9NL.vbe
Size 214B
SHA256 ff5c8480f0fefba87c0e93319b72f7273c2c4f8724a8cc00bb6e63e3f6884607
MD5 aec04296469ed17b9e1188e8e9c68184
SHA1 823ec8a8a9ae5931f9fe055ee24e33ca6b2b17b3
SHA512 23dcd2d5c65a802aa4e95b75b638d43a6fa4d7716a3a205766b5221848a3d5e31948e4c2a63ab44b6b06ec36b99d89a1550f3ac2f754f954f0e8431b72b0e11c
MD5 SHA1 SHA512

Submit Download

spoolsv.exe

Path C:\Recovery\WindowsRE\spoolsv.exe
Size 1.1MB
SHA256 259ca593b867a67bae233e2969c7858b66d096c66c80699f5927468ddb0641a9
MD5 fa126f1dec092feabc0c66e6809b6970
SHA1 ff31a054a3a3e0b608ee41a7dac557510f05cc9b
SHA512 81799d16f049ecbb727433dc74ed35874cbf5a2d022b876965669b186eab37bb7940e3b25921bcc40408016537775364c136b01d8f71a559915144f67e724e23
SSDEEP 24576:WNx3Z0jGz6hn+CDdw6CUR05V6DMAO5jYQ4M/:AdZ0jGz6F+CEcDMBYQ4M
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Recovery\WindowsRE\spoolsv.exe
Size 1.1MB
SHA256 259ca593b867a67bae233e2969c7858b66d096c66c80699f5927468ddb0641a9
MD5 fa126f1dec092feabc0c66e6809b6970
SHA1 ff31a054a3a3e0b608ee41a7dac557510f05cc9b
SHA512 81799d16f049ecbb727433dc74ed35874cbf5a2d022b876965669b186eab37bb7940e3b25921bcc40408016537775364c136b01d8f71a559915144f67e724e23
SSDEEP 24576:WNx3Z0jGz6hn+CDdw6CUR05V6DMAO5jYQ4M/:AdZ0jGz6F+CEcDMBYQ4M
MD5 SHA1 SHA512 SSDEEP

Submit Download

gjqd2f84Li.bat

Path C:\Users\Admin\AppData\Local\Temp\gjqd2f84Li.bat
Size 198B
SHA256 c69dd5e8674ba535fadd8999d7ae22a960af896e65ea7c6f6f74f5648e15dac1
MD5 b74d86b5371b813d9c145f65d2413dad
SHA1 4fef6ae5c5e20c705dd073f53d9fba83b5d00528
SHA512 5fc44ed7f3744a8f42e40c2afc4f0cfe2b5858b2fdb213faa89364bc6cbaff28ef885600f3051e868883c5086a871f58774b5f0bcf56d2c8d58a51c442841457
MD5 SHA1 SHA512

Submit Download

memory/3388-138-0x000000001C510000-0x000000001C560000-memory.dmp

Download

memory/3388-139-0x00007FFC622F0000-0x00007FFC62DB1000-memory.dmp

Download

memory/3388-137-0x0000000000530000-0x0000000000656000-memory.dmp

Download

memory/3388-143-0x00007FFC622F0000-0x00007FFC62DB1000-memory.dmp

Download

memory/4284-147-0x00007FFC622F0000-0x00007FFC62DB1000-memory.dmp

Download

memory/4284-148-0x00007FFC622F0000-0x00007FFC62DB1000-memory.dmp

Download