dcrat | 6d4ac58da19a639e21eba4f4aebf1c4b61c1de2877eb3c5e8044fed7cd79a068

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/10/2022, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe
Size 1.4MB
Sample221027-ld69zabff7
SHA256 6d4ac58da19a639e21eba4f4aebf1c4b61c1de2877eb3c5e8044fed7cd79a068
MD5 7355bae4e1eef0a7df90389ec66011d9
SHA1 2f9515c019d33da97e57c85ae779f1debd80af28
SHA512 462099d44b6658c4483a555811b75577943b472483d25ae00995c29735b3d536f0bd135834c2a45405072a593f5ca22c134626a80a5291edbaf039dd19025d3a
SSDEEP 24576:r4lcUmodBM5aKlt9Kopa/cjxp0jERruShLazqbim4j9NmIzEWAUHwgxs0mvc/pzM:k+AMHrU/cXvh/GT0IzLAUwjc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4120	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3920	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3944	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3956	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3676	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3748	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4348	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3900	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4460	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1244	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3836	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4664	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3560	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1136	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	844	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	660	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4472	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2492	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4676	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	332	schtasks.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3132	332	schtasks.exe	45

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2776-137-0x0000000000000000-mapping.dmp	dcrat
behavioral2/memory/2776-138-0x0000000000400000-0x00000000004F8000-memory.dmp	dcrat
behavioral2/memory/1260-150-0x0000000000000000-mapping.dmp	dcrat

Executes dropped EXE 2 IoCs

pid	Process
4212	backgroundTaskHost.exe
1260	backgroundTaskHost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2576 set thread context of 2776	2576	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe	89
PID 4212 set thread context of 1260	4212	backgroundTaskHost.exe	134

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Portable Devices\c5b4cb5e9653cc	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\ee2ad38f3d4382	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\9e8d7a4ca61bd9	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\winlogon.exe	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\cc11b995f2a76d	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe
File created	C:\Program Files\Windows Portable Devices\services.exe	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Offline Web Pages\backgroundTaskHost.exe	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe
File created	C:\Windows\Offline Web Pages\eddb19405b7ce1	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe
File created	C:\Windows\Media\Garden\RuntimeBroker.exe	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe
File created	C:\Windows\Media\Garden\9e8d7a4ca61bd9	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4664	schtasks.exe
2968	schtasks.exe
1892	schtasks.exe
3956	schtasks.exe
3748	schtasks.exe
3900	schtasks.exe
1244	schtasks.exe
2184	schtasks.exe
2492	schtasks.exe
1600	schtasks.exe
3920	schtasks.exe
1248	schtasks.exe
3560	schtasks.exe
1136	schtasks.exe
844	schtasks.exe
1640	schtasks.exe
3944	schtasks.exe
2480	schtasks.exe
4348	schtasks.exe
4460	schtasks.exe
4676	schtasks.exe
2244	schtasks.exe
3132	schtasks.exe
3836	schtasks.exe
3052	schtasks.exe
660	schtasks.exe
1060	schtasks.exe
2204	schtasks.exe
1856	schtasks.exe
4120	schtasks.exe
2600	schtasks.exe
4472	schtasks.exe
4648	schtasks.exe
3676	schtasks.exe
1632	schtasks.exe
2992	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2776	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe
2776	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe
2776	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe
2776	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe
2776	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe
2776	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe
2776	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe
2776	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe
2776	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe
2776	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe
2776	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe
1260	backgroundTaskHost.exe
1260	backgroundTaskHost.exe
1260	backgroundTaskHost.exe
1260	backgroundTaskHost.exe
1260	backgroundTaskHost.exe
1260	backgroundTaskHost.exe
1260	backgroundTaskHost.exe
1260	backgroundTaskHost.exe
1260	backgroundTaskHost.exe
1260	backgroundTaskHost.exe
1260	backgroundTaskHost.exe
1260	backgroundTaskHost.exe
1260	backgroundTaskHost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1260	backgroundTaskHost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe
Token: SeDebugPrivilege	1260	backgroundTaskHost.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 4840	2576	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe	85
PID 2576 wrote to memory of 4840	2576	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe	85
PID 2576 wrote to memory of 4840	2576	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe	85
PID 2576 wrote to memory of 2776	2576	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe	89
PID 2576 wrote to memory of 2776	2576	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe	89
PID 2576 wrote to memory of 2776	2576	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe	89
PID 2576 wrote to memory of 2776	2576	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe	89
PID 2576 wrote to memory of 2776	2576	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe	89
PID 2576 wrote to memory of 2776	2576	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe	89
PID 2576 wrote to memory of 2776	2576	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe	89
PID 2576 wrote to memory of 2776	2576	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe	89
PID 2776 wrote to memory of 1068	2776	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe	129
PID 2776 wrote to memory of 1068	2776	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe	129
PID 2776 wrote to memory of 1068	2776	6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe	129
PID 1068 wrote to memory of 1928	1068	cmd.exe	131
PID 1068 wrote to memory of 1928	1068	cmd.exe	131
PID 1068 wrote to memory of 1928	1068	cmd.exe	131
PID 1928 wrote to memory of 2448	1928	w32tm.exe	132
PID 1928 wrote to memory of 2448	1928	w32tm.exe	132
PID 1068 wrote to memory of 4212	1068	cmd.exe	133
PID 1068 wrote to memory of 4212	1068	cmd.exe	133
PID 1068 wrote to memory of 4212	1068	cmd.exe	133
PID 4212 wrote to memory of 1260	4212	backgroundTaskHost.exe	134
PID 4212 wrote to memory of 1260	4212	backgroundTaskHost.exe	134
PID 4212 wrote to memory of 1260	4212	backgroundTaskHost.exe	134
PID 4212 wrote to memory of 1260	4212	backgroundTaskHost.exe	134
PID 4212 wrote to memory of 1260	4212	backgroundTaskHost.exe	134
PID 4212 wrote to memory of 1260	4212	backgroundTaskHost.exe	134
PID 4212 wrote to memory of 1260	4212	backgroundTaskHost.exe	134
PID 4212 wrote to memory of 1260	4212	backgroundTaskHost.exe	134

C:\Users\Admin\AppData\Local\Temp\6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe
"C:\Users\Admin\AppData\Local\Temp\6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Users\Admin\AppData\Local\Temp\6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe
  C:\Users\Admin\AppData\Local\Temp\6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe
  2⤵
  PID:4840
- C:\Users\Admin\AppData\Local\Temp\6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe
  C:\Users\Admin\AppData\Local\Temp\6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe
  2⤵
  - Checks computer location settings
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ckg6GRmN5r.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1068
  - - C:\Windows\SysWOW64\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1928
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:2448
  - - C:\Windows\Offline Web Pages\backgroundTaskHost.exe
      "C:\Windows\Offline Web Pages\backgroundTaskHost.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4212
    - - C:\Windows\Offline Web Pages\backgroundTaskHost.exe
        
        "C:\Windows\Offline Web Pages\backgroundTaskHost.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:1260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\odt\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Portable Devices\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Portable Devices\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Windows\Offline Web Pages\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Windows\Offline Web Pages\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB36" /sc MINUTE /mo 13 /tr "'C:\Users\Public\6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3" /sc ONLOGON /tr "'C:\Users\Public\6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB36" /sc MINUTE /mo 12 /tr "'C:\Users\Public\6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\AppData\Local\Application Data\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Application Data\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\AppData\Local\Application Data\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\Media\Garden\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Media\Garden\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\Media\Garden\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\odt\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Application Data\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Users\Admin\Application Data\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Application Data\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\6D4AC58DA19A639E21EBA4F4AEBF1C4B61C1DE2877EB3.exe.log
Size 789B
SHA256 745ab70552d9a0463b791fd8dc1942838ac3e34fb1a68f09ed3766c7e3b05631
MD5 03d2df1e8834bc4ec1756735429b458c
SHA1 4ee6c0f5b04c8e0c5076219c5724032daab11d40
SHA512 2482c3d4478125ccbc7f224f50e86b7bf925ed438b59f4dce57b9b6bcdb59df51417049096b131b6b911173550eed98bc92aba7050861de303a692f0681b197b
MD5 SHA1 SHA512

Submit Download

backgroundTaskHost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\backgroundTaskHost.exe.log
Size 789B
SHA256 745ab70552d9a0463b791fd8dc1942838ac3e34fb1a68f09ed3766c7e3b05631
MD5 03d2df1e8834bc4ec1756735429b458c
SHA1 4ee6c0f5b04c8e0c5076219c5724032daab11d40
SHA512 2482c3d4478125ccbc7f224f50e86b7bf925ed438b59f4dce57b9b6bcdb59df51417049096b131b6b911173550eed98bc92aba7050861de303a692f0681b197b
MD5 SHA1 SHA512

Submit Download

Ckg6GRmN5r.bat

Path C:\Users\Admin\AppData\Local\Temp\Ckg6GRmN5r.bat
Size 216B
SHA256 1e2fdd690a2b4fc6e34bf7a1403269bfb0828d3fcab757a5fc37cdd460fb25f0
MD5 64d308c6158bfdc82474a49024037e3a
SHA1 9d9f7857a9faba4a047b069120b3b32e4c2d0bbe
SHA512 e310990d50e73bdc95853e2fba9f6c39c88afc2d3681d44078dcc928882ade45296e622c087a5729cb5d83c3631f43db5670bc9c35ec33102e1e1c992bcbcca5
MD5 SHA1 SHA512

Submit Download

backgroundTaskHost.exe

Path C:\Windows\Offline Web Pages\backgroundTaskHost.exe
Size 1.4MB
SHA256 6d4ac58da19a639e21eba4f4aebf1c4b61c1de2877eb3c5e8044fed7cd79a068
MD5 7355bae4e1eef0a7df90389ec66011d9
SHA1 2f9515c019d33da97e57c85ae779f1debd80af28
SHA512 462099d44b6658c4483a555811b75577943b472483d25ae00995c29735b3d536f0bd135834c2a45405072a593f5ca22c134626a80a5291edbaf039dd19025d3a
SSDEEP 24576:r4lcUmodBM5aKlt9Kopa/cjxp0jERruShLazqbim4j9NmIzEWAUHwgxs0mvc/pzM:k+AMHrU/cXvh/GT0IzLAUwjc
MD5 SHA1 SHA512 SSDEEP

Submit Download

backgroundTaskHost.exe

Path C:\Windows\Offline Web Pages\backgroundTaskHost.exe
Size 1.4MB
SHA256 6d4ac58da19a639e21eba4f4aebf1c4b61c1de2877eb3c5e8044fed7cd79a068
MD5 7355bae4e1eef0a7df90389ec66011d9
SHA1 2f9515c019d33da97e57c85ae779f1debd80af28
SHA512 462099d44b6658c4483a555811b75577943b472483d25ae00995c29735b3d536f0bd135834c2a45405072a593f5ca22c134626a80a5291edbaf039dd19025d3a
SSDEEP 24576:r4lcUmodBM5aKlt9Kopa/cjxp0jERruShLazqbim4j9NmIzEWAUHwgxs0mvc/pzM:k+AMHrU/cXvh/GT0IzLAUwjc
MD5 SHA1 SHA512 SSDEEP

Submit Download

backgroundTaskHost.exe

Path C:\Windows\Offline Web Pages\backgroundTaskHost.exe
Size 1.4MB
SHA256 6d4ac58da19a639e21eba4f4aebf1c4b61c1de2877eb3c5e8044fed7cd79a068
MD5 7355bae4e1eef0a7df90389ec66011d9
SHA1 2f9515c019d33da97e57c85ae779f1debd80af28
SHA512 462099d44b6658c4483a555811b75577943b472483d25ae00995c29735b3d536f0bd135834c2a45405072a593f5ca22c134626a80a5291edbaf039dd19025d3a
SSDEEP 24576:r4lcUmodBM5aKlt9Kopa/cjxp0jERruShLazqbim4j9NmIzEWAUHwgxs0mvc/pzM:k+AMHrU/cXvh/GT0IzLAUwjc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2576-132-0x00000000004C0000-0x000000000062A000-memory.dmp

Download

memory/2576-136-0x00000000077D0000-0x00000000077EE000-memory.dmp

Download

memory/2576-135-0x0000000007AB0000-0x0000000007B26000-memory.dmp

Download

memory/2576-134-0x0000000007810000-0x00000000078A2000-memory.dmp

Download

memory/2576-133-0x0000000007D20000-0x00000000082C4000-memory.dmp

Download

memory/2776-138-0x0000000000400000-0x00000000004F8000-memory.dmp

Download

memory/2776-139-0x0000000005A70000-0x0000000005AC0000-memory.dmp

Download

memory/2776-141-0x0000000007580000-0x00000000075E6000-memory.dmp

Download

memory/2776-140-0x00000000079B0000-0x0000000007EDC000-memory.dmp

Download