dcrat | 26349dc06d51f089cd42c5a28c946abaa7bf24537ad6dab87d78aba0ca60fbe1

Analysis

max time kernel
150s
max time network
149s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
01/11/2022, 11:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
26349dc06d51f089cd42c5a28c946abaa7bf24537ad6dab87d78aba0ca60fbe1.exe
Size 1.3MB
Sample221101-nvf58abef6
SHA256 26349dc06d51f089cd42c5a28c946abaa7bf24537ad6dab87d78aba0ca60fbe1
MD5 2af0634106773de6f37b00d610e08bfa
SHA1 dc954e4759f7f342dabda5a598c6e81b44637c7d
SHA512 9306e893f49350420c513a428799eb6a5809ab3e99b6cebbe63126b104572a85048a9c4111414832a018b770794bdddd243a63d2577bd8f3a1fc191446598501
SSDEEP 24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4544	4896	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4572	4896	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4328	4896	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4616	4896	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	4896	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3660	4896	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	4896	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	4896	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4940	4896	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	4896	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	4896	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4300	4896	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	4896	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3644	4896	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	4896	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	4896	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	4896	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4500	4896	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	4896	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4440	4896	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4412	4896	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	4896	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4672	4896	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3908	4896	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3912	4896	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	4896	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	4896	schtasks.exe	70

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000800000001abe9-279.dat	dcrat
behavioral1/files/0x000800000001abe9-280.dat	dcrat
behavioral1/memory/4272-281-0x00000000007D0000-0x00000000008E0000-memory.dmp	dcrat
behavioral1/files/0x000600000001ac11-313.dat	dcrat
behavioral1/files/0x000600000001ac11-312.dat	dcrat
behavioral1/files/0x000600000001ac11-645.dat	dcrat
behavioral1/files/0x000600000001ac11-652.dat	dcrat
behavioral1/files/0x000600000001ac11-658.dat	dcrat
behavioral1/files/0x000600000001ac11-663.dat	dcrat

Executes dropped EXE 6 IoCs

pid	Process
4272	DllCommonsvc.exe
2392	fontdrvhost.exe
3524	fontdrvhost.exe
1740	fontdrvhost.exe
2284	fontdrvhost.exe
4216	fontdrvhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\cmd.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\ebf1f9fa8afd6d	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ShellExperiences\OfficeClickToRun.exe	DllCommonsvc.exe
File created	C:\Windows\ShellExperiences\e6c9b481da804f	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2020	schtasks.exe
2776	schtasks.exe
2892	schtasks.exe
3028	schtasks.exe
4500	schtasks.exe
5040	schtasks.exe
1048	schtasks.exe
4544	schtasks.exe
3912	schtasks.exe
2772	schtasks.exe
4300	schtasks.exe
3644	schtasks.exe
4440	schtasks.exe
4940	schtasks.exe
4536	schtasks.exe
4488	schtasks.exe
4412	schtasks.exe
4672	schtasks.exe
3660	schtasks.exe
5020	schtasks.exe
4512	schtasks.exe
756	schtasks.exe
3908	schtasks.exe
4328	schtasks.exe
4616	schtasks.exe
2872	schtasks.exe
4572	schtasks.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	26349dc06d51f089cd42c5a28c946abaa7bf24537ad6dab87d78aba0ca60fbe1.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
4272	DllCommonsvc.exe
4272	DllCommonsvc.exe
4272	DllCommonsvc.exe
4272	DllCommonsvc.exe
4272	DllCommonsvc.exe
4272	DllCommonsvc.exe
4272	DllCommonsvc.exe
612	powershell.exe
1256	powershell.exe
1380	powershell.exe
908	powershell.exe
508	powershell.exe
1732	powershell.exe
612	powershell.exe
220	powershell.exe
312	powershell.exe
1256	powershell.exe
2252	powershell.exe
2212	powershell.exe
2392	fontdrvhost.exe
1256	powershell.exe
612	powershell.exe
1380	powershell.exe
908	powershell.exe
220	powershell.exe
508	powershell.exe
312	powershell.exe
1732	powershell.exe
2212	powershell.exe
2212	powershell.exe
2252	powershell.exe
2252	powershell.exe
1380	powershell.exe
1380	powershell.exe
908	powershell.exe
908	powershell.exe
508	powershell.exe
508	powershell.exe
1732	powershell.exe
1732	powershell.exe
220	powershell.exe
220	powershell.exe
312	powershell.exe
312	powershell.exe
2212	powershell.exe
2252	powershell.exe
3524	fontdrvhost.exe
1740	fontdrvhost.exe
2284	fontdrvhost.exe
4216	fontdrvhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4272	DllCommonsvc.exe
Token: SeDebugPrivilege	612	powershell.exe
Token: SeDebugPrivilege	1256	powershell.exe
Token: SeDebugPrivilege	1380	powershell.exe
Token: SeDebugPrivilege	908	powershell.exe
Token: SeDebugPrivilege	508	powershell.exe
Token: SeDebugPrivilege	2392	fontdrvhost.exe
Token: SeDebugPrivilege	1732	powershell.exe
Token: SeDebugPrivilege	220	powershell.exe
Token: SeDebugPrivilege	312	powershell.exe
Token: SeDebugPrivilege	2252	powershell.exe
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeIncreaseQuotaPrivilege	1256	powershell.exe
Token: SeSecurityPrivilege	1256	powershell.exe
Token: SeTakeOwnershipPrivilege	1256	powershell.exe
Token: SeLoadDriverPrivilege	1256	powershell.exe
Token: SeSystemProfilePrivilege	1256	powershell.exe
Token: SeSystemtimePrivilege	1256	powershell.exe
Token: SeProfSingleProcessPrivilege	1256	powershell.exe
Token: SeIncBasePriorityPrivilege	1256	powershell.exe
Token: SeCreatePagefilePrivilege	1256	powershell.exe
Token: SeBackupPrivilege	1256	powershell.exe
Token: SeRestorePrivilege	1256	powershell.exe
Token: SeShutdownPrivilege	1256	powershell.exe
Token: SeDebugPrivilege	1256	powershell.exe
Token: SeSystemEnvironmentPrivilege	1256	powershell.exe
Token: SeRemoteShutdownPrivilege	1256	powershell.exe
Token: SeUndockPrivilege	1256	powershell.exe
Token: SeManageVolumePrivilege	1256	powershell.exe
Token: 33	1256	powershell.exe
Token: 34	1256	powershell.exe
Token: 35	1256	powershell.exe
Token: 36	1256	powershell.exe
Token: SeIncreaseQuotaPrivilege	612	powershell.exe
Token: SeSecurityPrivilege	612	powershell.exe
Token: SeTakeOwnershipPrivilege	612	powershell.exe
Token: SeLoadDriverPrivilege	612	powershell.exe
Token: SeSystemProfilePrivilege	612	powershell.exe
Token: SeSystemtimePrivilege	612	powershell.exe
Token: SeProfSingleProcessPrivilege	612	powershell.exe
Token: SeIncBasePriorityPrivilege	612	powershell.exe
Token: SeCreatePagefilePrivilege	612	powershell.exe
Token: SeBackupPrivilege	612	powershell.exe
Token: SeRestorePrivilege	612	powershell.exe
Token: SeShutdownPrivilege	612	powershell.exe
Token: SeDebugPrivilege	612	powershell.exe
Token: SeSystemEnvironmentPrivilege	612	powershell.exe
Token: SeRemoteShutdownPrivilege	612	powershell.exe
Token: SeUndockPrivilege	612	powershell.exe
Token: SeManageVolumePrivilege	612	powershell.exe
Token: 33	612	powershell.exe
Token: 34	612	powershell.exe
Token: 35	612	powershell.exe
Token: 36	612	powershell.exe
Token: SeIncreaseQuotaPrivilege	1380	powershell.exe
Token: SeSecurityPrivilege	1380	powershell.exe
Token: SeTakeOwnershipPrivilege	1380	powershell.exe
Token: SeLoadDriverPrivilege	1380	powershell.exe
Token: SeSystemProfilePrivilege	1380	powershell.exe
Token: SeSystemtimePrivilege	1380	powershell.exe
Token: SeProfSingleProcessPrivilege	1380	powershell.exe
Token: SeIncBasePriorityPrivilege	1380	powershell.exe
Token: SeCreatePagefilePrivilege	1380	powershell.exe
Token: SeBackupPrivilege	1380	powershell.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 4848	2748	26349dc06d51f089cd42c5a28c946abaa7bf24537ad6dab87d78aba0ca60fbe1.exe	66
PID 2748 wrote to memory of 4848	2748	26349dc06d51f089cd42c5a28c946abaa7bf24537ad6dab87d78aba0ca60fbe1.exe	66
PID 2748 wrote to memory of 4848	2748	26349dc06d51f089cd42c5a28c946abaa7bf24537ad6dab87d78aba0ca60fbe1.exe	66
PID 4848 wrote to memory of 3872	4848	WScript.exe	67
PID 4848 wrote to memory of 3872	4848	WScript.exe	67
PID 4848 wrote to memory of 3872	4848	WScript.exe	67
PID 3872 wrote to memory of 4272	3872	cmd.exe	69
PID 3872 wrote to memory of 4272	3872	cmd.exe	69
PID 4272 wrote to memory of 612	4272	DllCommonsvc.exe	98
PID 4272 wrote to memory of 612	4272	DllCommonsvc.exe	98
PID 4272 wrote to memory of 1380	4272	DllCommonsvc.exe	99
PID 4272 wrote to memory of 1380	4272	DllCommonsvc.exe	99
PID 4272 wrote to memory of 1256	4272	DllCommonsvc.exe	104
PID 4272 wrote to memory of 1256	4272	DllCommonsvc.exe	104
PID 4272 wrote to memory of 908	4272	DllCommonsvc.exe	100
PID 4272 wrote to memory of 908	4272	DllCommonsvc.exe	100
PID 4272 wrote to memory of 1732	4272	DllCommonsvc.exe	101
PID 4272 wrote to memory of 1732	4272	DllCommonsvc.exe	101
PID 4272 wrote to memory of 508	4272	DllCommonsvc.exe	106
PID 4272 wrote to memory of 508	4272	DllCommonsvc.exe	106
PID 4272 wrote to memory of 312	4272	DllCommonsvc.exe	107
PID 4272 wrote to memory of 312	4272	DllCommonsvc.exe	107
PID 4272 wrote to memory of 220	4272	DllCommonsvc.exe	112
PID 4272 wrote to memory of 220	4272	DllCommonsvc.exe	112
PID 4272 wrote to memory of 2252	4272	DllCommonsvc.exe	110
PID 4272 wrote to memory of 2252	4272	DllCommonsvc.exe	110
PID 4272 wrote to memory of 2212	4272	DllCommonsvc.exe	114
PID 4272 wrote to memory of 2212	4272	DllCommonsvc.exe	114
PID 4272 wrote to memory of 2392	4272	DllCommonsvc.exe	118
PID 4272 wrote to memory of 2392	4272	DllCommonsvc.exe	118
PID 2392 wrote to memory of 4656	2392	fontdrvhost.exe	119
PID 2392 wrote to memory of 4656	2392	fontdrvhost.exe	119
PID 4656 wrote to memory of 4296	4656	cmd.exe	122
PID 4656 wrote to memory of 4296	4656	cmd.exe	122
PID 4656 wrote to memory of 3524	4656	cmd.exe	123
PID 4656 wrote to memory of 3524	4656	cmd.exe	123
PID 3524 wrote to memory of 4328	3524	fontdrvhost.exe	124
PID 3524 wrote to memory of 4328	3524	fontdrvhost.exe	124
PID 4328 wrote to memory of 2140	4328	cmd.exe	126
PID 4328 wrote to memory of 2140	4328	cmd.exe	126
PID 4328 wrote to memory of 1740	4328	cmd.exe	127
PID 4328 wrote to memory of 1740	4328	cmd.exe	127
PID 1740 wrote to memory of 2776	1740	fontdrvhost.exe	128
PID 1740 wrote to memory of 2776	1740	fontdrvhost.exe	128
PID 2776 wrote to memory of 4752	2776	cmd.exe	130
PID 2776 wrote to memory of 4752	2776	cmd.exe	130
PID 2776 wrote to memory of 2284	2776	cmd.exe	131
PID 2776 wrote to memory of 2284	2776	cmd.exe	131
PID 2284 wrote to memory of 4780	2284	fontdrvhost.exe	132
PID 2284 wrote to memory of 4780	2284	fontdrvhost.exe	132
PID 4780 wrote to memory of 1920	4780	cmd.exe	134
PID 4780 wrote to memory of 1920	4780	cmd.exe	134
PID 4780 wrote to memory of 4216	4780	cmd.exe	135
PID 4780 wrote to memory of 4216	4780	cmd.exe	135

C:\Users\Admin\AppData\Local\Temp\26349dc06d51f089cd42c5a28c946abaa7bf24537ad6dab87d78aba0ca60fbe1.exe
"C:\Users\Admin\AppData\Local\Temp\26349dc06d51f089cd42c5a28c946abaa7bf24537ad6dab87d78aba0ca60fbe1.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3872
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4272
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:612
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\Idle.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1380
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:908
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1732
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Desktop\cmd.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1256
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\fr-FR\spoolsv.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:508
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellExperiences\OfficeClickToRun.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:312
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2252
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender Advanced Threat Protection\cmd.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:220
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2212
    - - C:\Recovery\WindowsRE\fontdrvhost.exe
        
        "C:\Recovery\WindowsRE\fontdrvhost.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2392
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kp2dTY47HA.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4656
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:4296
        
        C:\Recovery\WindowsRE\fontdrvhost.exe
        
        "C:\Recovery\WindowsRE\fontdrvhost.exe"
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3524
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\evbbIz777a.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4328
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2140
        
        C:\Recovery\WindowsRE\fontdrvhost.exe
        
        "C:\Recovery\WindowsRE\fontdrvhost.exe"
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1740
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DJG58brWjr.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:4752
        
        C:\Recovery\WindowsRE\fontdrvhost.exe
        
        "C:\Recovery\WindowsRE\fontdrvhost.exe"
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2284
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rd8mWnFnEV.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4780
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:1920
        
        C:\Recovery\WindowsRE\fontdrvhost.exe
        
        "C:\Recovery\WindowsRE\fontdrvhost.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Desktop\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Default\Desktop\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Desktop\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Windows\ShellExperiences\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\ShellExperiences\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Windows\ShellExperiences\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Documents\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Public\Documents\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Documents\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1048

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fontdrvhost.exe

Path C:\Recovery\WindowsRE\fontdrvhost.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

fontdrvhost.exe

Path C:\Recovery\WindowsRE\fontdrvhost.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

fontdrvhost.exe

Path C:\Recovery\WindowsRE\fontdrvhost.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

fontdrvhost.exe

Path C:\Recovery\WindowsRE\fontdrvhost.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

fontdrvhost.exe

Path C:\Recovery\WindowsRE\fontdrvhost.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

fontdrvhost.exe

Path C:\Recovery\WindowsRE\fontdrvhost.exe
Size 1.0MB
SHA256 b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
MD5 bd31e94b4143c4ce49c17d3af46bcad0
SHA1 f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA512 f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
SSDEEP 24576:jTnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:HnzV/q+DnsXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

fontdrvhost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fontdrvhost.exe.log
Size 1KB
SHA256 375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12
MD5 d63ff49d7c92016feb39812e4db10419
SHA1 2307d5e35ca9864ffefc93acf8573ea995ba189b
SHA512 00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
MD5 8592ba100a78835a6b94d5949e13dfc1
SHA1 63e901200ab9a57c7dd4c078d7f75dcd3b357020
SHA512 87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3
MD5 SHA1 SHA512

Submit Download