dcrat | a904e48086728bfab083bbbc8aceda9fe9e6a456d5857a4a59fef1bc36049407

Analysis

max time kernel
147s
max time network
146s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
01/11/2022, 01:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a904e48086728bfab083bbbc8aceda9fe9e6a456d5857a4a59fef1bc36049407.exe
Size 1.3MB
Sample221101-b6fmlsfhgp
SHA256 a904e48086728bfab083bbbc8aceda9fe9e6a456d5857a4a59fef1bc36049407
MD5 02278889bd14daf8c91986cd3e939aac
SHA1 6b9681ca155301bf72a56625638152afea1ffefa
SHA512 6d8ec0114f39a65354b4e772963bf7116dc6e58e842cd30b696de7d4d1115d78cb1905e260cf620abf65315679482ecf95ff5f04da656d6cf43bfe60175d9fb6
SSDEEP 24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4328	3128	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4332	3128	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3120	3128	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3988	3128	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4656	3128	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5080	3128	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	808	3128	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	3128	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	424	3128	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	164	3128	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3396	3128	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1364	3128	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2472	3128	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	748	3128	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	3128	schtasks.exe	70

DCRat payload 18 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000a00000001ac4d-280.dat	dcrat
behavioral1/files/0x000a00000001ac4d-281.dat	dcrat
behavioral1/memory/3696-282-0x0000000000D70000-0x0000000000E80000-memory.dmp	dcrat
behavioral1/files/0x000a00000001ac4d-297.dat	dcrat
behavioral1/files/0x000700000001ac66-379.dat	dcrat
behavioral1/files/0x000700000001ac66-380.dat	dcrat
behavioral1/files/0x000700000001ac66-522.dat	dcrat
behavioral1/files/0x000700000001ac66-528.dat	dcrat
behavioral1/files/0x000700000001ac66-533.dat	dcrat
behavioral1/files/0x000700000001ac66-538.dat	dcrat
behavioral1/files/0x000700000001ac66-543.dat	dcrat
behavioral1/files/0x000700000001ac66-549.dat	dcrat
behavioral1/files/0x000700000001ac66-554.dat	dcrat
behavioral1/files/0x000700000001ac66-560.dat	dcrat
behavioral1/files/0x000700000001ac66-565.dat	dcrat
behavioral1/files/0x000700000001ac66-570.dat	dcrat
behavioral1/files/0x000700000001ac66-576.dat	dcrat
behavioral1/files/0x000700000001ac66-581.dat	dcrat

Executes dropped EXE 15 IoCs

pid	Process
3696	DllCommonsvc.exe
4576	DllCommonsvc.exe
3004	spoolsv.exe
2332	spoolsv.exe
4744	spoolsv.exe
2904	spoolsv.exe
5096	spoolsv.exe
3952	spoolsv.exe
4676	spoolsv.exe
4564	spoolsv.exe
1156	spoolsv.exe
1276	spoolsv.exe
3852	spoolsv.exe
2352	spoolsv.exe
4736	spoolsv.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Windows NT\cmd.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows NT\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\sihost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\66fc9ff0ee96c2	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
748	schtasks.exe
3120	schtasks.exe
5080	schtasks.exe
640	schtasks.exe
164	schtasks.exe
3396	schtasks.exe
1864	schtasks.exe
4328	schtasks.exe
4332	schtasks.exe
808	schtasks.exe
3988	schtasks.exe
4656	schtasks.exe
424	schtasks.exe
1364	schtasks.exe
2472	schtasks.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	a904e48086728bfab083bbbc8aceda9fe9e6a456d5857a4a59fef1bc36049407.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
3696	DllCommonsvc.exe
4972	powershell.exe
4976	powershell.exe
4964	powershell.exe
4964	powershell.exe
4576	DllCommonsvc.exe
4972	powershell.exe
4976	powershell.exe
4964	powershell.exe
4576	DllCommonsvc.exe
4576	DllCommonsvc.exe
4972	powershell.exe
4576	DllCommonsvc.exe
4576	DllCommonsvc.exe
4976	powershell.exe
4576	DllCommonsvc.exe
4576	DllCommonsvc.exe
2304	powershell.exe
2380	powershell.exe
996	powershell.exe
3004	spoolsv.exe
2304	powershell.exe
2304	powershell.exe
996	powershell.exe
2380	powershell.exe
996	powershell.exe
2380	powershell.exe
2332	spoolsv.exe
4744	spoolsv.exe
2904	spoolsv.exe
5096	spoolsv.exe
3952	spoolsv.exe
4676	spoolsv.exe
4564	spoolsv.exe
1156	spoolsv.exe
1276	spoolsv.exe
3852	spoolsv.exe
2352	spoolsv.exe
4736	spoolsv.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3696	DllCommonsvc.exe
Token: SeDebugPrivilege	4972	powershell.exe
Token: SeDebugPrivilege	4964	powershell.exe
Token: SeDebugPrivilege	4976	powershell.exe
Token: SeDebugPrivilege	4576	DllCommonsvc.exe
Token: SeDebugPrivilege	3004	spoolsv.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeDebugPrivilege	2380	powershell.exe
Token: SeDebugPrivilege	996	powershell.exe
Token: SeIncreaseQuotaPrivilege	4972	powershell.exe
Token: SeSecurityPrivilege	4972	powershell.exe
Token: SeTakeOwnershipPrivilege	4972	powershell.exe
Token: SeLoadDriverPrivilege	4972	powershell.exe
Token: SeSystemProfilePrivilege	4972	powershell.exe
Token: SeSystemtimePrivilege	4972	powershell.exe
Token: SeProfSingleProcessPrivilege	4972	powershell.exe
Token: SeIncBasePriorityPrivilege	4972	powershell.exe
Token: SeCreatePagefilePrivilege	4972	powershell.exe
Token: SeBackupPrivilege	4972	powershell.exe
Token: SeRestorePrivilege	4972	powershell.exe
Token: SeShutdownPrivilege	4972	powershell.exe
Token: SeDebugPrivilege	4972	powershell.exe
Token: SeSystemEnvironmentPrivilege	4972	powershell.exe
Token: SeRemoteShutdownPrivilege	4972	powershell.exe
Token: SeUndockPrivilege	4972	powershell.exe
Token: SeManageVolumePrivilege	4972	powershell.exe
Token: 33	4972	powershell.exe
Token: 34	4972	powershell.exe
Token: 35	4972	powershell.exe
Token: 36	4972	powershell.exe
Token: SeIncreaseQuotaPrivilege	4976	powershell.exe
Token: SeSecurityPrivilege	4976	powershell.exe
Token: SeTakeOwnershipPrivilege	4976	powershell.exe
Token: SeLoadDriverPrivilege	4976	powershell.exe
Token: SeSystemProfilePrivilege	4976	powershell.exe
Token: SeSystemtimePrivilege	4976	powershell.exe
Token: SeProfSingleProcessPrivilege	4976	powershell.exe
Token: SeIncBasePriorityPrivilege	4976	powershell.exe
Token: SeCreatePagefilePrivilege	4976	powershell.exe
Token: SeBackupPrivilege	4976	powershell.exe
Token: SeRestorePrivilege	4976	powershell.exe
Token: SeShutdownPrivilege	4976	powershell.exe
Token: SeDebugPrivilege	4976	powershell.exe
Token: SeSystemEnvironmentPrivilege	4976	powershell.exe
Token: SeRemoteShutdownPrivilege	4976	powershell.exe
Token: SeUndockPrivilege	4976	powershell.exe
Token: SeManageVolumePrivilege	4976	powershell.exe
Token: 33	4976	powershell.exe
Token: 34	4976	powershell.exe
Token: 35	4976	powershell.exe
Token: 36	4976	powershell.exe
Token: SeIncreaseQuotaPrivilege	4964	powershell.exe
Token: SeSecurityPrivilege	4964	powershell.exe
Token: SeTakeOwnershipPrivilege	4964	powershell.exe
Token: SeLoadDriverPrivilege	4964	powershell.exe
Token: SeSystemProfilePrivilege	4964	powershell.exe
Token: SeSystemtimePrivilege	4964	powershell.exe
Token: SeProfSingleProcessPrivilege	4964	powershell.exe
Token: SeIncBasePriorityPrivilege	4964	powershell.exe
Token: SeCreatePagefilePrivilege	4964	powershell.exe
Token: SeBackupPrivilege	4964	powershell.exe
Token: SeRestorePrivilege	4964	powershell.exe
Token: SeShutdownPrivilege	4964	powershell.exe
Token: SeDebugPrivilege	4964	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 4812	2404	a904e48086728bfab083bbbc8aceda9fe9e6a456d5857a4a59fef1bc36049407.exe	66
PID 2404 wrote to memory of 4812	2404	a904e48086728bfab083bbbc8aceda9fe9e6a456d5857a4a59fef1bc36049407.exe	66
PID 2404 wrote to memory of 4812	2404	a904e48086728bfab083bbbc8aceda9fe9e6a456d5857a4a59fef1bc36049407.exe	66
PID 4812 wrote to memory of 5092	4812	WScript.exe	67
PID 4812 wrote to memory of 5092	4812	WScript.exe	67
PID 4812 wrote to memory of 5092	4812	WScript.exe	67
PID 5092 wrote to memory of 3696	5092	cmd.exe	69
PID 5092 wrote to memory of 3696	5092	cmd.exe	69
PID 3696 wrote to memory of 4964	3696	DllCommonsvc.exe	77
PID 3696 wrote to memory of 4964	3696	DllCommonsvc.exe	77
PID 3696 wrote to memory of 4972	3696	DllCommonsvc.exe	79
PID 3696 wrote to memory of 4972	3696	DllCommonsvc.exe	79
PID 3696 wrote to memory of 4976	3696	DllCommonsvc.exe	81
PID 3696 wrote to memory of 4976	3696	DllCommonsvc.exe	81
PID 3696 wrote to memory of 4576	3696	DllCommonsvc.exe	83
PID 3696 wrote to memory of 4576	3696	DllCommonsvc.exe	83
PID 4576 wrote to memory of 2304	4576	DllCommonsvc.exe	92
PID 4576 wrote to memory of 2304	4576	DllCommonsvc.exe	92
PID 4576 wrote to memory of 2380	4576	DllCommonsvc.exe	93
PID 4576 wrote to memory of 2380	4576	DllCommonsvc.exe	93
PID 4576 wrote to memory of 996	4576	DllCommonsvc.exe	94
PID 4576 wrote to memory of 996	4576	DllCommonsvc.exe	94
PID 4576 wrote to memory of 2072	4576	DllCommonsvc.exe	96
PID 4576 wrote to memory of 2072	4576	DllCommonsvc.exe	96
PID 4576 wrote to memory of 3004	4576	DllCommonsvc.exe	101
PID 4576 wrote to memory of 3004	4576	DllCommonsvc.exe	101
PID 3004 wrote to memory of 736	3004	spoolsv.exe	103
PID 3004 wrote to memory of 736	3004	spoolsv.exe	103
PID 736 wrote to memory of 1508	736	cmd.exe	105
PID 736 wrote to memory of 1508	736	cmd.exe	105
PID 736 wrote to memory of 2332	736	cmd.exe	106
PID 736 wrote to memory of 2332	736	cmd.exe	106
PID 2332 wrote to memory of 1420	2332	spoolsv.exe	107
PID 2332 wrote to memory of 1420	2332	spoolsv.exe	107
PID 1420 wrote to memory of 3080	1420	cmd.exe	109
PID 1420 wrote to memory of 3080	1420	cmd.exe	109
PID 1420 wrote to memory of 4744	1420	cmd.exe	110
PID 1420 wrote to memory of 4744	1420	cmd.exe	110
PID 4744 wrote to memory of 4528	4744	spoolsv.exe	111
PID 4744 wrote to memory of 4528	4744	spoolsv.exe	111
PID 4528 wrote to memory of 4308	4528	cmd.exe	113
PID 4528 wrote to memory of 4308	4528	cmd.exe	113
PID 4528 wrote to memory of 2904	4528	cmd.exe	114
PID 4528 wrote to memory of 2904	4528	cmd.exe	114
PID 2904 wrote to memory of 4960	2904	spoolsv.exe	115
PID 2904 wrote to memory of 4960	2904	spoolsv.exe	115
PID 4960 wrote to memory of 4532	4960	cmd.exe	117
PID 4960 wrote to memory of 4532	4960	cmd.exe	117
PID 4960 wrote to memory of 5096	4960	cmd.exe	118
PID 4960 wrote to memory of 5096	4960	cmd.exe	118
PID 5096 wrote to memory of 4496	5096	spoolsv.exe	119
PID 5096 wrote to memory of 4496	5096	spoolsv.exe	119
PID 4496 wrote to memory of 3556	4496	cmd.exe	121
PID 4496 wrote to memory of 3556	4496	cmd.exe	121
PID 4496 wrote to memory of 3952	4496	cmd.exe	122
PID 4496 wrote to memory of 3952	4496	cmd.exe	122
PID 3952 wrote to memory of 420	3952	spoolsv.exe	123
PID 3952 wrote to memory of 420	3952	spoolsv.exe	123
PID 420 wrote to memory of 4036	420	cmd.exe	125
PID 420 wrote to memory of 4036	420	cmd.exe	125
PID 420 wrote to memory of 4676	420	cmd.exe	126
PID 420 wrote to memory of 4676	420	cmd.exe	126
PID 4676 wrote to memory of 996	4676	spoolsv.exe	127
PID 4676 wrote to memory of 996	4676	spoolsv.exe	127

C:\Users\Admin\AppData\Local\Temp\a904e48086728bfab083bbbc8aceda9fe9e6a456d5857a4a59fef1bc36049407.exe
"C:\Users\Admin\AppData\Local\Temp\a904e48086728bfab083bbbc8aceda9fe9e6a456d5857a4a59fef1bc36049407.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3696
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4964
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\spoolsv.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4972
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\cmd.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4976
    - - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4576
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2304
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\conhost.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2380
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\sihost.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:996
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\spoolsv.exe'
        6⤵
        
        PID:2072
      - C:\odt\spoolsv.exe
        
        "C:\odt\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3004
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GvLkm7sAXX.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:736
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1508
        
        C:\odt\spoolsv.exe
        
        "C:\odt\spoolsv.exe"
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2332
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rE1HJofSUb.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1420
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:3080
        
        C:\odt\spoolsv.exe
        
        "C:\odt\spoolsv.exe"
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4744
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ay7XDWEJg9.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:4308
        
        C:\odt\spoolsv.exe
        
        "C:\odt\spoolsv.exe"
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2904
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rE1HJofSUb.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4960
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:4532
        
        C:\odt\spoolsv.exe
        
        "C:\odt\spoolsv.exe"
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5096
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pI0EcicZAo.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:4496
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:3556
        
        C:\odt\spoolsv.exe
        
        "C:\odt\spoolsv.exe"
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3952
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YUw1O57cI2.bat"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:420
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:4036
        
        C:\odt\spoolsv.exe
        
        "C:\odt\spoolsv.exe"
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4676
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zDcPfnAXs0.bat"
        19⤵
        
        PID:996
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:3820
        
        C:\odt\spoolsv.exe
        
        "C:\odt\spoolsv.exe"
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:4564
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xAFUrPKKMy.bat"
        21⤵
        
        PID:4788
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:4580
        
        C:\odt\spoolsv.exe
        
        "C:\odt\spoolsv.exe"
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:1156
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cLz7lFEPwa.bat"
        23⤵
        
        PID:2304
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:4548
        
        C:\odt\spoolsv.exe
        
        "C:\odt\spoolsv.exe"
        24⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:1276
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BjebbrynYr.bat"
        25⤵
        
        PID:3432
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:3144
        
        C:\odt\spoolsv.exe
        
        "C:\odt\spoolsv.exe"
        26⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:3852
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eON2Ze4cSc.bat"
        27⤵
        
        PID:760
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:2184
        
        C:\odt\spoolsv.exe
        
        "C:\odt\spoolsv.exe"
        28⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:2352
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\18eSMsDQCm.bat"
        29⤵
        
        PID:2868
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:4100
        
        C:\odt\spoolsv.exe
        
        "C:\odt\spoolsv.exe"
        30⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\providercommon\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows NT\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Windows NT\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows NT\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\odt\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\odt\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\odt\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1864

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DllCommonsvc.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log
Size 1KB
SHA256 61d17affcc8d91ecb1858e710c455186f9d0ccfc4d8ae17a1145d87bc7317879
MD5 b4268d8ae66fdd920476b97a1776bf85
SHA1 f920de54f7467f0970eccc053d3c6c8dd181d49a
SHA512 03b6b90641837f9efb6065698602220d6c5ad263d51d7b7714747c2a3c3c618bd3d94add206b034d6fa2b8e43cbd1ac4a1741cfa1c2b1c1fc8589ae0b0c89516
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033
MD5 ad5cd538ca58cb28ede39c108acb5785
SHA1 1ae910026f3dbe90ed025e9e96ead2b5399be877
SHA512 c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13
MD5 SHA1 SHA512

Submit Download

spoolsv.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\spoolsv.exe.log
Size 1KB
SHA256 375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12
MD5 d63ff49d7c92016feb39812e4db10419
SHA1 2307d5e35ca9864ffefc93acf8573ea995ba189b
SHA512 00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a
MD5 SHA1 SHA512

Submit Download