dcrat | bc26338f3ca12f362b6ad447f16b4e65cc4b63518ab1d184740852880856f5fe

Analysis

max time kernel
8s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2022, 06:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc26338f3ca12f362b6ad447f16b4e65cc4b63518ab1d184740852880856f5fe.exe
Size

1.3MB
MD5

082cdc41f88db9cc658aafd47777f956
SHA1

ffb32406220f7007b1570cac4958baea361b7e50
SHA256

bc26338f3ca12f362b6ad447f16b4e65cc4b63518ab1d184740852880856f5fe
SHA512

00b590016808d28cc83a1f9fcd144e55c25e699668fe79cd5c39873df246faecee45379654b92cb218c49711cf98a3299202ffcd765bcaa591513738f5c52f2c
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3616	4444	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4172	4444	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	236	4444	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3264	4444	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	4444	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3732	4444	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	4444	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	4444	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3700	4444	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	4444	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3420	4444	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3800	4444	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3240	4444	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4484	4444	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	364	4444	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4380	4444	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3464	4444	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3476	4444	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4884	4444	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4944	4444	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3384	4444	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	4444	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4456	4444	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3900	4444	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	4444	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3760	4444	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	4444	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	712	4444	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	4444	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	744	4444	schtasks.exe	28

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0006000000022e28-137.dat	dcrat
behavioral1/files/0x0006000000022e28-138.dat	dcrat
behavioral1/memory/3636-139-0x00000000000F0000-0x0000000000200000-memory.dmp	dcrat
behavioral1/files/0x0006000000022e2b-154.dat	dcrat
behavioral1/files/0x0006000000022e2b-153.dat	dcrat

Executes dropped EXE 1 IoCs

pid	Process
3636	DllCommonsvc.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	bc26338f3ca12f362b6ad447f16b4e65cc4b63518ab1d184740852880856f5fe.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\smss.exe	DllCommonsvc.exe
File created	C:\Program Files\Common Files\69ddcba757bf72	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\cmd.exe	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files\7-Zip\Lang\cc11b995f2a76d	DllCommonsvc.exe
File created	C:\Program Files\Windows Media Player\Skins\wininit.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\WmiPrvSE.exe	DllCommonsvc.exe
File created	C:\Program Files\7-Zip\Lang\winlogon.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Media Player\Skins\56085415360792	DllCommonsvc.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Windows\apppatch\ja-JP\lsass.exe	DllCommonsvc.exe
File created	C:\Windows\apppatch\ja-JP\6203df4a6bafc7	DllCommonsvc.exe
File created	C:\Windows\es-ES\services.exe	DllCommonsvc.exe
File created	C:\Windows\es-ES\c5b4cb5e9653cc	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3296	4088	WerFault.exe	118
4952	2248	WerFault.exe	120
740	4616	WerFault.exe	123

Creates scheduled task(s) 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3900	schtasks.exe
3616	schtasks.exe
3384	schtasks.exe
3240	schtasks.exe
4380	schtasks.exe
712	schtasks.exe
3036	schtasks.exe
3800	schtasks.exe
2876	schtasks.exe
3700	schtasks.exe
3464	schtasks.exe
3760	schtasks.exe
744	schtasks.exe
4172	schtasks.exe
3420	schtasks.exe
4456	schtasks.exe
2388	schtasks.exe
4884	schtasks.exe
4944	schtasks.exe
2016	schtasks.exe
3264	schtasks.exe
2320	schtasks.exe
2028	schtasks.exe
4928	schtasks.exe
4484	schtasks.exe
364	schtasks.exe
3476	schtasks.exe
2592	schtasks.exe
236	schtasks.exe
3732	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	bc26338f3ca12f362b6ad447f16b4e65cc4b63518ab1d184740852880856f5fe.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3636	DllCommonsvc.exe
3636	DllCommonsvc.exe
3636	DllCommonsvc.exe
3636	DllCommonsvc.exe
3636	DllCommonsvc.exe
3636	DllCommonsvc.exe
3636	DllCommonsvc.exe
3636	DllCommonsvc.exe
3636	DllCommonsvc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3636	DllCommonsvc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 4988	5044	bc26338f3ca12f362b6ad447f16b4e65cc4b63518ab1d184740852880856f5fe.exe	80
PID 5044 wrote to memory of 4988	5044	bc26338f3ca12f362b6ad447f16b4e65cc4b63518ab1d184740852880856f5fe.exe	80
PID 5044 wrote to memory of 4988	5044	bc26338f3ca12f362b6ad447f16b4e65cc4b63518ab1d184740852880856f5fe.exe	80
PID 4988 wrote to memory of 432	4988	WScript.exe	84
PID 4988 wrote to memory of 432	4988	WScript.exe	84
PID 4988 wrote to memory of 432	4988	WScript.exe	84
PID 432 wrote to memory of 3636	432	cmd.exe	86
PID 432 wrote to memory of 3636	432	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\bc26338f3ca12f362b6ad447f16b4e65cc4b63518ab1d184740852880856f5fe.exe
"C:\Users\Admin\AppData\Local\Temp\bc26338f3ca12f362b6ad447f16b4e65cc4b63518ab1d184740852880856f5fe.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3636
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        
        PID:1816
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'
        5⤵
        
        PID:4088
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4088 -s 2016
        6⤵
        Program crash
        
        PID:3296
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\Lang\winlogon.exe'
        5⤵
        
        PID:2248
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2248 -s 2012
        6⤵
        Program crash
        
        PID:4952
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\Skins\wininit.exe'
        5⤵
        
        PID:4616
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4616 -s 2008
        6⤵
        Program crash
        
        PID:740
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\WaaSMedicAgent.exe'
        5⤵
        
        PID:4092
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\cmd.exe'
        5⤵
        
        PID:2180
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\smss.exe'
        5⤵
        
        PID:4260
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\apppatch\ja-JP\lsass.exe'
        5⤵
        
        PID:4104
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\assembly\NativeImages_v2.0.50727_32\RuntimeBroker.exe'
        5⤵
        
        PID:4068
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\es-ES\services.exe'
        5⤵
        
        PID:2460
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\NetHood\OfficeClickToRun.exe'
        5⤵
        
        PID:4348
    - - C:\Program Files (x86)\Windows Mail\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Mail\fontdrvhost.exe"
        5⤵
        
        PID:3904
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4yEObGBIDe.bat"
        6⤵
        
        PID:4156
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:3064
        
        C:\Program Files (x86)\Windows Mail\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Mail\fontdrvhost.exe"
        7⤵
        
        PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_32\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_32\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_32\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\Lang\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files\7-Zip\Lang\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\apppatch\ja-JP\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Windows\apppatch\ja-JP\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Windows\apppatch\ja-JP\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Media Player\Skins\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Skins\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Media Player\Skins\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 12 /tr "'C:\providercommon\WaaSMedicAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\providercommon\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 5 /tr "'C:\providercommon\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Common Files\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files\Common Files\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Mail\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Mail\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Windows\es-ES\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\es-ES\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Windows\es-ES\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\NetHood\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Admin\NetHood\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\NetHood\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:744

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 488 -p 4616 -ip 4616
1⤵
PID:432

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 528 -p 2248 -ip 2248
1⤵
PID:3384

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 464 -p 4088 -ip 4088
1⤵
PID:3052

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Mail\fontdrvhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Mail\fontdrvhost.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\AppData\Local\Temp\4yEObGBIDe.bat

Filesize
216B

MD5
6c43b4b7d8edf65af1f25822d7df7f13

SHA1
7fd29c72ee33cfcb4ab42b8685fe43f117428b1e

SHA256
2edb43e23d17d8e155d63a9f80b890ac20286ec18eb71cf25ab20f62c122f2c1

SHA512
7a6303c5ca8d57aa41f6cc73fd3d9c6fb7b9bf2bb6e700be9d6de55b10e623b6ee83edc6158265c2b92b5235ee47e93f3c9ecfcfba1e700602ef3e2170df2333

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1816-165-0x00007FFC60ED0000-0x00007FFC61991000-memory.dmp

Filesize
10.8MB

Download
memory/1816-173-0x00007FFC60ED0000-0x00007FFC61991000-memory.dmp

Filesize
10.8MB

Download
memory/2180-162-0x00007FFC60ED0000-0x00007FFC61991000-memory.dmp

Filesize
10.8MB

Download
memory/2248-159-0x00007FFC60ED0000-0x00007FFC61991000-memory.dmp

Filesize
10.8MB

Download
memory/2248-180-0x00007FFC60ED0000-0x00007FFC61991000-memory.dmp

Filesize
10.8MB

Download
memory/2460-166-0x00007FFC60ED0000-0x00007FFC61991000-memory.dmp

Filesize
10.8MB

Download
memory/3636-139-0x00000000000F0000-0x0000000000200000-memory.dmp

Filesize
1.1MB

Download
memory/3636-140-0x00007FFC60ED0000-0x00007FFC61991000-memory.dmp

Filesize
10.8MB

Download
memory/3636-155-0x00007FFC60ED0000-0x00007FFC61991000-memory.dmp

Filesize
10.8MB

Download
memory/3904-170-0x00007FFC60ED0000-0x00007FFC61991000-memory.dmp

Filesize
10.8MB

Download
memory/3904-167-0x00007FFC60ED0000-0x00007FFC61991000-memory.dmp

Filesize
10.8MB

Download
memory/4068-158-0x00007FFC60ED0000-0x00007FFC61991000-memory.dmp

Filesize
10.8MB

Download
memory/4068-156-0x00000220DF310000-0x00000220DF332000-memory.dmp

Filesize
136KB

Download
memory/4068-177-0x00007FFC60ED0000-0x00007FFC61991000-memory.dmp

Filesize
10.8MB

Download
memory/4088-157-0x00007FFC60ED0000-0x00007FFC61991000-memory.dmp

Filesize
10.8MB

Download
memory/4088-179-0x00007FFC60ED0000-0x00007FFC61991000-memory.dmp

Filesize
10.8MB

Download
memory/4092-178-0x00007FFC60ED0000-0x00007FFC61991000-memory.dmp

Filesize
10.8MB

Download
memory/4092-163-0x00007FFC60ED0000-0x00007FFC61991000-memory.dmp

Filesize
10.8MB

Download
memory/4104-175-0x00007FFC60ED0000-0x00007FFC61991000-memory.dmp

Filesize
10.8MB

Download
memory/4104-160-0x00007FFC60ED0000-0x00007FFC61991000-memory.dmp

Filesize
10.8MB

Download
memory/4260-164-0x00007FFC60ED0000-0x00007FFC61991000-memory.dmp

Filesize
10.8MB

Download
memory/4260-176-0x00007FFC60ED0000-0x00007FFC61991000-memory.dmp

Filesize
10.8MB

Download
memory/4348-174-0x00007FFC60ED0000-0x00007FFC61991000-memory.dmp

Filesize
10.8MB

Download
memory/4348-168-0x00007FFC60ED0000-0x00007FFC61991000-memory.dmp

Filesize
10.8MB

Download
memory/4616-161-0x00007FFC60ED0000-0x00007FFC61991000-memory.dmp

Filesize
10.8MB

Download
memory/4616-181-0x00007FFC60ED0000-0x00007FFC61991000-memory.dmp

Filesize
10.8MB

Download