dcrat | 94809441241bafd86a3f771709e66b4e9b674f259f49e1793c78e414d678cc93

Analysis

max time kernel
149s
max time network
164s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
41806c88409d2cf704e9475b84b6e619.exe
Size 1.5MB
Sample221002-srbhsaccd8
SHA256 94809441241bafd86a3f771709e66b4e9b674f259f49e1793c78e414d678cc93
MD5 41806c88409d2cf704e9475b84b6e619
SHA1 2940625c7dddf336db7034419c9439603876edde
SHA512 e98a2bc3ea2c031ee426f4a33c61144f1b4d12eedee9d6cb94628957d82cc8588e306d0a390f41ab362ddb7b2544b26ad9a8105e439e5c175856bcc33367f532
SSDEEP 24576:U2G/nvxW3Ww0tvgsBdI3Eb5pNCpSsAhWkwgOdztudNrqDjCRf4mACXh6:UbA30vg6uEdpNSULNrqic
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	780	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	592	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	672	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	700	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	776	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	796	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1136	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	960	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1396	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1896	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1800	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	472	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1028	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1324	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	320	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2072	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2212	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	1032	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	1032	schtasks.exe	32

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000012726-60.dat	dcrat
behavioral1/files/0x0008000000012726-61.dat	dcrat
behavioral1/files/0x0008000000012726-62.dat	dcrat
behavioral1/files/0x0008000000012726-64.dat	dcrat
behavioral1/memory/1736-65-0x00000000002E0000-0x000000000041E000-memory.dmp	dcrat
behavioral1/files/0x0006000000014248-70.dat	dcrat
behavioral1/files/0x0006000000014248-71.dat	dcrat
behavioral1/memory/2372-72-0x0000000000C30000-0x0000000000D6E000-memory.dmp	dcrat

Executes dropped EXE 2 IoCs

pid	Process
1736	Hypernet.exe
2372	Hypernet.exe

Loads dropped DLL 2 IoCs

pid	Process
956	cmd.exe
956	cmd.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Stationery\taskhost.exe	Hypernet.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\WMIADAP.exe	Hypernet.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\75a57c1bdf437c	Hypernet.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\sppsvc.exe	Hypernet.exe
File created	C:\Program Files (x86)\Internet Explorer\services.exe	Hypernet.exe
File created	C:\Program Files (x86)\Internet Explorer\c5b4cb5e9653cc	Hypernet.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\0a1fd5f707cd16	Hypernet.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\taskhost.exe	Hypernet.exe
File created	C:\Program Files (x86)\Microsoft Office\Stationery\b75386f1303e64	Hypernet.exe
File created	C:\Program Files\Uninstall Information\csrss.exe	Hypernet.exe
File created	C:\Program Files\Uninstall Information\886983d96e3d3e	Hypernet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1636	schtasks.exe
2092	schtasks.exe
2212	schtasks.exe
2332	schtasks.exe
1964	schtasks.exe
1136	schtasks.exe
1840	schtasks.exe
1764	schtasks.exe
1324	schtasks.exe
592	schtasks.exe
700	schtasks.exe
2012	schtasks.exe
1396	schtasks.exe
1292	schtasks.exe
776	schtasks.exe
796	schtasks.exe
1724	schtasks.exe
1556	schtasks.exe
2072	schtasks.exe
1504	schtasks.exe
2164	schtasks.exe
672	schtasks.exe
872	schtasks.exe
320	schtasks.exe
2144	schtasks.exe
2304	schtasks.exe
1028	schtasks.exe
2232	schtasks.exe
2284	schtasks.exe
1948	schtasks.exe
1688	schtasks.exe
1356	schtasks.exe
1896	schtasks.exe
472	schtasks.exe
2120	schtasks.exe
2192	schtasks.exe
2260	schtasks.exe
780	schtasks.exe
1484	schtasks.exe
960	schtasks.exe
1800	schtasks.exe
2008	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1736	Hypernet.exe
2372	Hypernet.exe
2372	Hypernet.exe
2372	Hypernet.exe
2372	Hypernet.exe
2372	Hypernet.exe
2372	Hypernet.exe
2372	Hypernet.exe
2372	Hypernet.exe
2372	Hypernet.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1736	Hypernet.exe
Token: SeDebugPrivilege	2372	Hypernet.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 1708	1112	41806c88409d2cf704e9475b84b6e619.exe	28
PID 1112 wrote to memory of 1708	1112	41806c88409d2cf704e9475b84b6e619.exe	28
PID 1112 wrote to memory of 1708	1112	41806c88409d2cf704e9475b84b6e619.exe	28
PID 1112 wrote to memory of 1708	1112	41806c88409d2cf704e9475b84b6e619.exe	28
PID 1708 wrote to memory of 956	1708	WScript.exe	29
PID 1708 wrote to memory of 956	1708	WScript.exe	29
PID 1708 wrote to memory of 956	1708	WScript.exe	29
PID 1708 wrote to memory of 956	1708	WScript.exe	29
PID 956 wrote to memory of 1736	956	cmd.exe	31
PID 956 wrote to memory of 1736	956	cmd.exe	31
PID 956 wrote to memory of 1736	956	cmd.exe	31
PID 956 wrote to memory of 1736	956	cmd.exe	31
PID 1736 wrote to memory of 2372	1736	Hypernet.exe	75
PID 1736 wrote to memory of 2372	1736	Hypernet.exe	75
PID 1736 wrote to memory of 2372	1736	Hypernet.exe	75

C:\Users\Admin\AppData\Local\Temp\41806c88409d2cf704e9475b84b6e619.exe
"C:\Users\Admin\AppData\Local\Temp\41806c88409d2cf704e9475b84b6e619.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ComRefHostdll\Xv1EvtWs.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\ComRefHostdll\qmdzcBrSjQ9skt6XqmW1q.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:956
  - - C:\ComRefHostdll\Hypernet.exe
      "C:\ComRefHostdll\Hypernet.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1736
    - - C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Hypernet.exe
        
        "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Hypernet.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Office\Stationery\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\Stationery\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Office\Stationery\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Admin\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Uninstall Information\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Uninstall Information\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Local Settings\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\Local Settings\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Local Settings\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 13 /tr "'C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 9 /tr "'C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Internet Explorer\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HypernetH" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Hypernet.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Hypernet" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Hypernet.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HypernetH" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Hypernet.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Hypernet.exe

Path C:\ComRefHostdll\Hypernet.exe
Size 1.2MB
SHA256 3b4afa47d370e809b34053638389e9c35b072745cb47671e6181aac16bafc442
MD5 172c04decdbb6725819e787b3b44b9d5
SHA1 a807c34ace991eea1f71206f73b340be3e86cac6
SHA512 56e8c995f9d3d14d51cb834ad2bb88cee760b865a1f5390f389444e7f6b90f91692ab335ef51e0360ca93175552b0221b42f2aaa4c46965822d443216736d9d4
SSDEEP 24576:4gsBdI3Eb5pNCpSsAhWkwgOdztudNrqDjCRf4mACXh:4g6uEdpNSULNrqi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hypernet.exe

Path C:\ComRefHostdll\Hypernet.exe
Size 1.2MB
SHA256 3b4afa47d370e809b34053638389e9c35b072745cb47671e6181aac16bafc442
MD5 172c04decdbb6725819e787b3b44b9d5
SHA1 a807c34ace991eea1f71206f73b340be3e86cac6
SHA512 56e8c995f9d3d14d51cb834ad2bb88cee760b865a1f5390f389444e7f6b90f91692ab335ef51e0360ca93175552b0221b42f2aaa4c46965822d443216736d9d4
SSDEEP 24576:4gsBdI3Eb5pNCpSsAhWkwgOdztudNrqDjCRf4mACXh:4g6uEdpNSULNrqi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Xv1EvtWs.vbe

Path C:\ComRefHostdll\Xv1EvtWs.vbe
Size 211B
SHA256 431a40d12378998f56849be8d6ab414ae743ba1eca0cf309db0c29d768ca805c
MD5 3db176619fb401ea7debd3811ac815f6
SHA1 8c8cd48be9da03db3e00b5faff4a2aded41d139b
SHA512 ab7cf1574a77972f0efc4da3c6885ab31935a90d594ce4263507436b97687d4d4f0d0abd5734bbb0601f5d7aa45ebf7930af0c8d242ced08a7257f8f918610f7
MD5 SHA1 SHA512

Submit Download

qmdzcBrSjQ9skt6XqmW1q.bat

Path C:\ComRefHostdll\qmdzcBrSjQ9skt6XqmW1q.bat
Size 31B
SHA256 56d2234231307b7811c5d6163cdb1809f2163bfe52b6d2c022a44c5f3c5298ab
MD5 594dff98508cd34824c9819ca0f1bcf6
SHA1 99fcc393f5b51c19ac09462cf70626c4b699919a
SHA512 34a42e4df5d0eb4953c28314b1f8e472d5d187c94d8baa602eaacc0e9286334f08b0eb0d88755e9b6179663f0f0fc6eed07a11aae2bba2dd79221c10ae0f14af
MD5 SHA1 SHA512

Submit Download

Hypernet.exe

Path C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Hypernet.exe
Size 1.2MB
SHA256 3b4afa47d370e809b34053638389e9c35b072745cb47671e6181aac16bafc442
MD5 172c04decdbb6725819e787b3b44b9d5
SHA1 a807c34ace991eea1f71206f73b340be3e86cac6
SHA512 56e8c995f9d3d14d51cb834ad2bb88cee760b865a1f5390f389444e7f6b90f91692ab335ef51e0360ca93175552b0221b42f2aaa4c46965822d443216736d9d4
SSDEEP 24576:4gsBdI3Eb5pNCpSsAhWkwgOdztudNrqDjCRf4mACXh:4g6uEdpNSULNrqi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hypernet.exe

Path C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Hypernet.exe
Size 1.2MB
SHA256 3b4afa47d370e809b34053638389e9c35b072745cb47671e6181aac16bafc442
MD5 172c04decdbb6725819e787b3b44b9d5
SHA1 a807c34ace991eea1f71206f73b340be3e86cac6
SHA512 56e8c995f9d3d14d51cb834ad2bb88cee760b865a1f5390f389444e7f6b90f91692ab335ef51e0360ca93175552b0221b42f2aaa4c46965822d443216736d9d4
SSDEEP 24576:4gsBdI3Eb5pNCpSsAhWkwgOdztudNrqDjCRf4mACXh:4g6uEdpNSULNrqi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hypernet.exe

Path \ComRefHostdll\Hypernet.exe
Size 1.2MB
SHA256 3b4afa47d370e809b34053638389e9c35b072745cb47671e6181aac16bafc442
MD5 172c04decdbb6725819e787b3b44b9d5
SHA1 a807c34ace991eea1f71206f73b340be3e86cac6
SHA512 56e8c995f9d3d14d51cb834ad2bb88cee760b865a1f5390f389444e7f6b90f91692ab335ef51e0360ca93175552b0221b42f2aaa4c46965822d443216736d9d4
SSDEEP 24576:4gsBdI3Eb5pNCpSsAhWkwgOdztudNrqDjCRf4mACXh:4g6uEdpNSULNrqi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hypernet.exe

Path \ComRefHostdll\Hypernet.exe
Size 1.2MB
SHA256 3b4afa47d370e809b34053638389e9c35b072745cb47671e6181aac16bafc442
MD5 172c04decdbb6725819e787b3b44b9d5
SHA1 a807c34ace991eea1f71206f73b340be3e86cac6
SHA512 56e8c995f9d3d14d51cb834ad2bb88cee760b865a1f5390f389444e7f6b90f91692ab335ef51e0360ca93175552b0221b42f2aaa4c46965822d443216736d9d4
SSDEEP 24576:4gsBdI3Eb5pNCpSsAhWkwgOdztudNrqDjCRf4mACXh:4g6uEdpNSULNrqi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1112-54-0x0000000075B11000-0x0000000075B13000-memory.dmp

Download

memory/1736-67-0x0000000000520000-0x0000000000536000-memory.dmp

Download

memory/1736-68-0x0000000000540000-0x0000000000552000-memory.dmp

Download

memory/1736-66-0x00000000002C0000-0x00000000002DC000-memory.dmp

Download

memory/1736-65-0x00000000002E0000-0x000000000041E000-memory.dmp

Download

memory/2372-72-0x0000000000C30000-0x0000000000D6E000-memory.dmp

Download

memory/2372-73-0x0000000000500000-0x0000000000512000-memory.dmp

Download