dcrat | fe38269743b859fac313a354198e60cc6f6b5b5c26d71c70b8e8f2848a22afea

Analysis

max time kernel
152s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2022 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe38269743b859fac313a354198e60cc6f6b5b5c26d71c70b8e8f2848a22afea.exe
Size

1.3MB
MD5

9d4c63f291700110d07ddfc99c070c1e
SHA1

8e74a2b4ffe3ad31e86bc449bd267bacdabac3a2
SHA256

fe38269743b859fac313a354198e60cc6f6b5b5c26d71c70b8e8f2848a22afea
SHA512

444e6e3ff167c7c21bd45cefb582afeeb30e0e6150fa8b411af50c4d270fc2e6202aa7add562223393c15ab68850ec05b67f93a35fcbac441f95922e0b988aa2
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4388	1048	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1296	1048	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	1048	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1328	1048	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	876	1048	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4560	1048	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4664	1048	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3528	1048	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	1048	schtasks.exe	82

DCRat payload 13 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0006000000022e05-137.dat	dcrat
behavioral1/files/0x0006000000022e05-138.dat	dcrat
behavioral1/memory/1560-139-0x0000000000A80000-0x0000000000B90000-memory.dmp	dcrat
behavioral1/files/0x0006000000022e0f-162.dat	dcrat
behavioral1/files/0x0006000000022e0f-163.dat	dcrat
behavioral1/files/0x0006000000022e0f-171.dat	dcrat
behavioral1/files/0x0006000000022e0f-179.dat	dcrat
behavioral1/files/0x0006000000022e0f-186.dat	dcrat
behavioral1/files/0x0006000000022e0f-193.dat	dcrat
behavioral1/files/0x0006000000022e0f-200.dat	dcrat
behavioral1/files/0x0006000000022e0f-207.dat	dcrat
behavioral1/files/0x0006000000022e0f-214.dat	dcrat
behavioral1/files/0x0006000000022e0f-221.dat	dcrat

Executes dropped EXE 10 IoCs

pid	Process
1560	DllCommonsvc.exe
5064	dllhost.exe
1780	dllhost.exe
2576	dllhost.exe
2420	dllhost.exe
2240	dllhost.exe
3120	dllhost.exe
1964	dllhost.exe
1392	dllhost.exe
480	dllhost.exe

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	fe38269743b859fac313a354198e60cc6f6b5b5c26d71c70b8e8f2848a22afea.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4388	schtasks.exe
4664	schtasks.exe
4560	schtasks.exe
3528	schtasks.exe
2240	schtasks.exe
1296	schtasks.exe
2316	schtasks.exe
1328	schtasks.exe
876	schtasks.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	fe38269743b859fac313a354198e60cc6f6b5b5c26d71c70b8e8f2848a22afea.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	dllhost.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1560	DllCommonsvc.exe
1560	DllCommonsvc.exe
1560	DllCommonsvc.exe
4236	powershell.exe
4852	powershell.exe
212	powershell.exe
4784	powershell.exe
212	powershell.exe
4852	powershell.exe
4236	powershell.exe
4784	powershell.exe
5064	dllhost.exe
1780	dllhost.exe
2576	dllhost.exe
2420	dllhost.exe
2240	dllhost.exe
3120	dllhost.exe
1964	dllhost.exe
1392	dllhost.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	1560	DllCommonsvc.exe
Token: SeDebugPrivilege	4236	powershell.exe
Token: SeDebugPrivilege	4852	powershell.exe
Token: SeDebugPrivilege	212	powershell.exe
Token: SeDebugPrivilege	4784	powershell.exe
Token: SeDebugPrivilege	5064	dllhost.exe
Token: SeDebugPrivilege	1780	dllhost.exe
Token: SeDebugPrivilege	2576	dllhost.exe
Token: SeDebugPrivilege	2420	dllhost.exe
Token: SeDebugPrivilege	2240	dllhost.exe
Token: SeDebugPrivilege	3120	dllhost.exe
Token: SeDebugPrivilege	1964	dllhost.exe
Token: SeDebugPrivilege	1392	dllhost.exe
Token: SeDebugPrivilege	480	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 372	2264	fe38269743b859fac313a354198e60cc6f6b5b5c26d71c70b8e8f2848a22afea.exe	79
PID 2264 wrote to memory of 372	2264	fe38269743b859fac313a354198e60cc6f6b5b5c26d71c70b8e8f2848a22afea.exe	79
PID 2264 wrote to memory of 372	2264	fe38269743b859fac313a354198e60cc6f6b5b5c26d71c70b8e8f2848a22afea.exe	79
PID 372 wrote to memory of 3468	372	WScript.exe	81
PID 372 wrote to memory of 3468	372	WScript.exe	81
PID 372 wrote to memory of 3468	372	WScript.exe	81
PID 3468 wrote to memory of 1560	3468	cmd.exe	84
PID 3468 wrote to memory of 1560	3468	cmd.exe	84
PID 1560 wrote to memory of 4236	1560	DllCommonsvc.exe	94
PID 1560 wrote to memory of 4236	1560	DllCommonsvc.exe	94
PID 1560 wrote to memory of 212	1560	DllCommonsvc.exe	95
PID 1560 wrote to memory of 212	1560	DllCommonsvc.exe	95
PID 1560 wrote to memory of 4852	1560	DllCommonsvc.exe	97
PID 1560 wrote to memory of 4852	1560	DllCommonsvc.exe	97
PID 1560 wrote to memory of 4784	1560	DllCommonsvc.exe	101
PID 1560 wrote to memory of 4784	1560	DllCommonsvc.exe	101
PID 1560 wrote to memory of 4104	1560	DllCommonsvc.exe	102
PID 1560 wrote to memory of 4104	1560	DllCommonsvc.exe	102
PID 4104 wrote to memory of 2944	4104	cmd.exe	104
PID 4104 wrote to memory of 2944	4104	cmd.exe	104
PID 4104 wrote to memory of 5064	4104	cmd.exe	105
PID 4104 wrote to memory of 5064	4104	cmd.exe	105
PID 5064 wrote to memory of 4280	5064	dllhost.exe	107
PID 5064 wrote to memory of 4280	5064	dllhost.exe	107
PID 4280 wrote to memory of 3848	4280	cmd.exe	108
PID 4280 wrote to memory of 3848	4280	cmd.exe	108
PID 4280 wrote to memory of 1780	4280	cmd.exe	109
PID 4280 wrote to memory of 1780	4280	cmd.exe	109
PID 1780 wrote to memory of 3260	1780	dllhost.exe	112
PID 1780 wrote to memory of 3260	1780	dllhost.exe	112
PID 3260 wrote to memory of 2320	3260	cmd.exe	114
PID 3260 wrote to memory of 2320	3260	cmd.exe	114
PID 3260 wrote to memory of 2576	3260	cmd.exe	117
PID 3260 wrote to memory of 2576	3260	cmd.exe	117
PID 2576 wrote to memory of 2152	2576	dllhost.exe	120
PID 2576 wrote to memory of 2152	2576	dllhost.exe	120
PID 2152 wrote to memory of 4844	2152	cmd.exe	122
PID 2152 wrote to memory of 4844	2152	cmd.exe	122
PID 2152 wrote to memory of 2420	2152	cmd.exe	123
PID 2152 wrote to memory of 2420	2152	cmd.exe	123
PID 2420 wrote to memory of 4588	2420	dllhost.exe	124
PID 2420 wrote to memory of 4588	2420	dllhost.exe	124
PID 4588 wrote to memory of 216	4588	cmd.exe	126
PID 4588 wrote to memory of 216	4588	cmd.exe	126
PID 4588 wrote to memory of 2240	4588	cmd.exe	127
PID 4588 wrote to memory of 2240	4588	cmd.exe	127
PID 2240 wrote to memory of 4136	2240	dllhost.exe	128
PID 2240 wrote to memory of 4136	2240	dllhost.exe	128
PID 4136 wrote to memory of 548	4136	cmd.exe	130
PID 4136 wrote to memory of 548	4136	cmd.exe	130
PID 4136 wrote to memory of 3120	4136	cmd.exe	131
PID 4136 wrote to memory of 3120	4136	cmd.exe	131
PID 3120 wrote to memory of 748	3120	dllhost.exe	133
PID 3120 wrote to memory of 748	3120	dllhost.exe	133
PID 748 wrote to memory of 1852	748	cmd.exe	134
PID 748 wrote to memory of 1852	748	cmd.exe	134
PID 748 wrote to memory of 1964	748	cmd.exe	135
PID 748 wrote to memory of 1964	748	cmd.exe	135
PID 1964 wrote to memory of 5100	1964	dllhost.exe	136
PID 1964 wrote to memory of 5100	1964	dllhost.exe	136
PID 5100 wrote to memory of 4596	5100	cmd.exe	138
PID 5100 wrote to memory of 4596	5100	cmd.exe	138
PID 5100 wrote to memory of 1392	5100	cmd.exe	139
PID 5100 wrote to memory of 1392	5100	cmd.exe	139

C:\Users\Admin\AppData\Local\Temp\fe38269743b859fac313a354198e60cc6f6b5b5c26d71c70b8e8f2848a22afea.exe
"C:\Users\Admin\AppData\Local\Temp\fe38269743b859fac313a354198e60cc6f6b5b5c26d71c70b8e8f2848a22afea.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:372
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3468
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1560
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4236
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\wininit.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:212
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\services.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4852
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\dllhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4784
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3G73IUFJD2.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4104
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2944
      - C:\odt\dllhost.exe
        
        "C:\odt\dllhost.exe"
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5064
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lg1oIatdTn.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4280
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:3848
        
        C:\odt\dllhost.exe
        
        "C:\odt\dllhost.exe"
        8⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1780
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3Fb5uY85DH.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3260
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2320
        
        C:\odt\dllhost.exe
        
        "C:\odt\dllhost.exe"
        10⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2576
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9IAAZSZGIv.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2152
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:4844
        
        C:\odt\dllhost.exe
        
        "C:\odt\dllhost.exe"
        12⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2420
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yNYzWO1Iaj.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4588
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:216
        
        C:\odt\dllhost.exe
        
        "C:\odt\dllhost.exe"
        14⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2240
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jkzlbVqk90.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:4136
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:548
        
        C:\odt\dllhost.exe
        
        "C:\odt\dllhost.exe"
        16⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3120
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uVUt9EuWwA.bat"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:748
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:1852
        
        C:\odt\dllhost.exe
        
        "C:\odt\dllhost.exe"
        18⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1964
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\onYrHPGvDe.bat"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:4596
        
        C:\odt\dllhost.exe
        
        "C:\odt\dllhost.exe"
        20⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1392
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HGlJwS3LgK.bat"
        21⤵
        
        PID:312
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:4592
        
        C:\odt\dllhost.exe
        
        "C:\odt\dllhost.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\odt\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\odt\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\odt\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\odt\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\odt\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\odt\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Temp\3Fb5uY85DH.bat

Filesize
183B

MD5
b500e7026cc33600a9411ccdebbe3118

SHA1
5dc4368dc096748be381793b4453cf78a82043ca

SHA256
45922a99cf2ab6c6efd4edba5646d7ffb78397720d6bcac0713d4e75fc4c38c5

SHA512
a2411dcdd138b89d1a912afc854876d3c1e4a30efd209c6cd3740ea5b6e3c60203fb9daa087782d761057ffe8ba5b436471d0cd7d2826829e8b5d6090e57154e

Download Submit
C:\Users\Admin\AppData\Local\Temp\3G73IUFJD2.bat

Filesize
183B

MD5
1ccf86c03a0d7a06873e4194f819e511

SHA1
dd8b3c6bb91ab36596d72c060534b7fc2fef1c84

SHA256
8c321482186a53c265ebc5f47af013bf87b329878b7406f7482597c53e72deb9

SHA512
5a6219edc86c8f272c0250bbc5a467c05552b5b6dea2d21385210ba79350f105c5d6efe409f28641137d6f93e27cc7e58d45d77d97c79b3fc12aa962e7d85826

Download Submit
C:\Users\Admin\AppData\Local\Temp\9IAAZSZGIv.bat

Filesize
183B

MD5
a2918362e8d78ede9910ea6711d99e93

SHA1
3011dabfd61a73b35c8b5b55b23326e02fd8abd9

SHA256
6aa56aa7ea5ab9c9ac3c8d8f02531834a91ecc30a9749e69bb67c30eda62f01a

SHA512
2768dc0f1390c42162ef5210e2c6668d1c4fce8fd82fb37d616ac94ca709731dd1c41a07f82be982d486636a6b342a6c7480dafbd77e5621ff5e2f18b479f639

Download Submit
C:\Users\Admin\AppData\Local\Temp\HGlJwS3LgK.bat

Filesize
183B

MD5
12da686227bbd5474a598a425a389747

SHA1
c8cfd1f93d8d3c5098121544e94a46f5ae4965d1

SHA256
fb1466c467643178fb2aaf04a5dd2c56442ae3cd3c9d4923d9e530d12df418bb

SHA512
9674402855c5d2d5b45efa62233a36d37f4f4a32c267d98ade3f188c0b83eb0b62ade1c51ffc19a9e2218109da33fffbb7980ed32b9c9351e7a088c3b8431850

Download Submit
C:\Users\Admin\AppData\Local\Temp\jkzlbVqk90.bat

Filesize
183B

MD5
96356a51135c60e965121822f784c77e

SHA1
c9de70dd7eb621e208bd41f9247f374cb4c4e76c

SHA256
c9a510b89399d9e1efd8213aedbbb26b049b1b283df9b59cebb97d5d5bfc5d55

SHA512
619342e04877be0f9089fa4ed3b56649d20f302744c6dc2764f8b045abaf0180840833180cab1151d85021c9b7b53d2876e547f6fc4f47ee2ea5f5288c1114e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\lg1oIatdTn.bat

Filesize
183B

MD5
973401edef6e5d0d521f53e9570ffda0

SHA1
daf4080ed637777528cbeb95014abd1c6443dce7

SHA256
747d8054ff5c47b253fac5562aa65e34182d68a909ba7beffdf86daf08ff2342

SHA512
28ac0bc996a21dc69bc24bf67052ef850f07e2668262f870f218f3af5fe55992d13629b03856fb9497b9184f6dffd84e4c90d294efb2dafbd4afe67240a76ed9

Download Submit
C:\Users\Admin\AppData\Local\Temp\onYrHPGvDe.bat

Filesize
183B

MD5
f4e95abfc9d64e696cbf6109e281323e

SHA1
42a31dcdd415dbe01d7d0130721d14b07bd813de

SHA256
def27f3a0a0cb79a8cc565832b6e0d3636263f74fdc99da47738adfe737b3d1e

SHA512
00c7c4e507cb7747573d8a859915b34e9671b92a7ce404513658c71a9a37168478414b7efed0a92d464891bdc08246504dc4c75facb966437ab086fda3266223

Download Submit
C:\Users\Admin\AppData\Local\Temp\uVUt9EuWwA.bat

Filesize
183B

MD5
ed651b6987a69192a00a7aa2e2dc5e2a

SHA1
3b5f0ab181887cee8b1df91ed4bfe6610cdf0adb

SHA256
6b7586e9b9cee81edffad53ab459741686eceb55fa4271e406fe1f2366b64387

SHA512
c1b41f851bbdcf457fbbd7f5b1a262824765e9a5c80af2a21466d9326a5d6d7abda742c80d1bf28609b11e52a06344e32c23a0ee7a36a9f928ce949990ac7a34

Download Submit
C:\Users\Admin\AppData\Local\Temp\yNYzWO1Iaj.bat

Filesize
183B

MD5
6e3ccfb4bdc3d48a7c8966bba4d4d900

SHA1
b6615859a459d26d17fcfc24661d5da05cf4af90

SHA256
b7fff114eae362c79eb2dc39e657e9ecbda13a54b6ecfebeece08982a16f0fbf

SHA512
3e490b479f6f5843918f189782d42430e7b04fd364408b28080578dace5bf860b19bf1446ec14afa7cd3c1a591e21c8c6ba053f72aff7dba56ad0debb5650462

Download Submit
C:\odt\dllhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\dllhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\dllhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\dllhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\dllhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\dllhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\dllhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\dllhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\dllhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\odt\dllhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/212-169-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/212-145-0x000001C4E7730000-0x000001C4E7752000-memory.dmp

Filesize
136KB

Download
memory/212-151-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/480-222-0x00007FF9059C0000-0x00007FF906481000-memory.dmp

Filesize
10.8MB

Download
memory/1392-219-0x00007FF9059C0000-0x00007FF906481000-memory.dmp

Filesize
10.8MB

Download
memory/1392-215-0x00007FF9059C0000-0x00007FF906481000-memory.dmp

Filesize
10.8MB

Download
memory/1560-149-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/1560-140-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/1560-139-0x0000000000A80000-0x0000000000B90000-memory.dmp

Filesize
1.1MB

Download
memory/1780-177-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/1780-173-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/1964-212-0x00007FF9059C0000-0x00007FF906481000-memory.dmp

Filesize
10.8MB

Download
memory/1964-208-0x00007FF9059C0000-0x00007FF906481000-memory.dmp

Filesize
10.8MB

Download
memory/2240-198-0x00007FF9059C0000-0x00007FF906481000-memory.dmp

Filesize
10.8MB

Download
memory/2240-194-0x00007FF9059C0000-0x00007FF906481000-memory.dmp

Filesize
10.8MB

Download
memory/2420-191-0x00007FF9059C0000-0x00007FF906481000-memory.dmp

Filesize
10.8MB

Download
memory/2420-187-0x00007FF9059C0000-0x00007FF906481000-memory.dmp

Filesize
10.8MB

Download
memory/2576-180-0x00007FF9059C0000-0x00007FF906481000-memory.dmp

Filesize
10.8MB

Download
memory/2576-184-0x00007FF9059C0000-0x00007FF906481000-memory.dmp

Filesize
10.8MB

Download
memory/3120-205-0x00007FF9059C0000-0x00007FF906481000-memory.dmp

Filesize
10.8MB

Download
memory/3120-201-0x00007FF9059C0000-0x00007FF906481000-memory.dmp

Filesize
10.8MB

Download
memory/4236-159-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/4236-150-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/4784-160-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/4784-153-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/4852-152-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/4852-158-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/5064-164-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/5064-168-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download