dcrat | da836408b89e756bd33aed58103d85199671e6fa41ded4d2247bf189b29c6f14

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
16/11/2022, 03:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
da836408b89e756bd33aed58103d85199671e6fa41ded.exe
Size 6.3MB
Sample221116-d5w93sha45
SHA256 da836408b89e756bd33aed58103d85199671e6fa41ded4d2247bf189b29c6f14
MD5 e4d36e28d3b449eb13e123edba90a359
SHA1 086866e70769b2069d5fcb8ab8906695c28dd2a9
SHA512 288aaf35594ddb464370acd913a3c46e7f0745f36e8b51659546c571acf772de0bd44aa0eb6136ab68f3ca468ff4317cf061dbc842f4c504796ff43ab657860e
SSDEEP 196608:bPfF+m1vG5C8pR5b/yVLbyqeaWFrHyh5ODmRHRJ:bV1OV5zNaWtHQOD4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4060	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3888	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	828	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2212	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3488	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4548	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	728	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3620	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3664	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3460	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5024	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3912	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3320	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4900	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	860	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3896	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4068	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5100	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1072	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4872	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4912	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4748	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4984	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4976	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4400	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4428	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4952	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3396	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2560	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4088	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1164	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3624	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3328	1448	schtasks.exe	24
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3916	1448	schtasks.exe	24

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000022d7d-145.dat	dcrat
behavioral2/files/0x000a000000022d7d-146.dat	dcrat
behavioral2/files/0x0008000000022dcc-152.dat	dcrat
behavioral2/files/0x0008000000022dcc-153.dat	dcrat
behavioral2/memory/316-154-0x0000000000020000-0x00000000000F6000-memory.dmp	dcrat
behavioral2/files/0x0006000000022de0-158.dat	dcrat
behavioral2/files/0x0006000000022de0-157.dat	dcrat

Executes dropped EXE 3 IoCs

pid	Process
3976	test.exe
316	reviewwindriver.exe
3784	dllhost.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	reviewwindriver.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	test.exe

Loads dropped DLL 4 IoCs

pid	Process
640	da836408b89e756bd33aed58103d85199671e6fa41ded.exe
640	da836408b89e756bd33aed58103d85199671e6fa41ded.exe
640	da836408b89e756bd33aed58103d85199671e6fa41ded.exe
640	da836408b89e756bd33aed58103d85199671e6fa41ded.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files\Windows NT\Accessories\6203df4a6bafc7	reviewwindriver.exe
File created	C:\Program Files (x86)\Windows Media Player\Skins\dllhost.exe	reviewwindriver.exe
File created	C:\Program Files (x86)\Windows Media Player\Skins\5940a34987c991	reviewwindriver.exe
File created	C:\Program Files (x86)\Windows Portable Devices\reviewwindriver.exe	reviewwindriver.exe
File created	C:\Program Files (x86)\Windows Portable Devices\93d65274bb6f4e	reviewwindriver.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\7a0fd90576e088	reviewwindriver.exe
File created	C:\Program Files\Windows NT\Accessories\lsass.exe	reviewwindriver.exe
File created	C:\Program Files (x86)\Adobe\smss.exe	reviewwindriver.exe
File created	C:\Program Files (x86)\Adobe\69ddcba757bf72	reviewwindriver.exe
File created	C:\Program Files\Google\Chrome\Application\89.0.4389.114\SearchApp.exe	reviewwindriver.exe
File created	C:\Program Files\Google\Chrome\Application\89.0.4389.114\38384e6a620884	reviewwindriver.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\explorer.exe	reviewwindriver.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\debug\eddb19405b7ce1	reviewwindriver.exe
File created	C:\Windows\ServiceProfiles\dwm.exe	reviewwindriver.exe
File created	C:\Windows\ServiceProfiles\6cb0b6c459d5d3	reviewwindriver.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Documents\SppExtComObj.exe	reviewwindriver.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Documents\e1ef82546f0b02	reviewwindriver.exe
File created	C:\Windows\debug\backgroundTaskHost.exe	reviewwindriver.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3888	schtasks.exe
860	schtasks.exe
1072	schtasks.exe
4872	schtasks.exe
3320	schtasks.exe
2136	schtasks.exe
2116	schtasks.exe
828	schtasks.exe
1084	schtasks.exe
4912	schtasks.exe
4936	schtasks.exe
4748	schtasks.exe
4400	schtasks.exe
4428	schtasks.exe
3624	schtasks.exe
4548	schtasks.exe
728	schtasks.exe
3664	schtasks.exe
4068	schtasks.exe
4952	schtasks.exe
4088	schtasks.exe
1164	schtasks.exe
4060	schtasks.exe
4480	schtasks.exe
3488	schtasks.exe
5024	schtasks.exe
2224	schtasks.exe
2080	schtasks.exe
2568	schtasks.exe
3916	schtasks.exe
2000	schtasks.exe
4996	schtasks.exe
1560	schtasks.exe
4984	schtasks.exe
2892	schtasks.exe
2108	schtasks.exe
2212	schtasks.exe
3620	schtasks.exe
3912	schtasks.exe
3896	schtasks.exe
5100	schtasks.exe
3396	schtasks.exe
5020	schtasks.exe
3460	schtasks.exe
4900	schtasks.exe
4976	schtasks.exe
2560	schtasks.exe
3328	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	test.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
316	reviewwindriver.exe
316	reviewwindriver.exe
316	reviewwindriver.exe
316	reviewwindriver.exe
316	reviewwindriver.exe
316	reviewwindriver.exe
316	reviewwindriver.exe
3784	dllhost.exe
3784	dllhost.exe
3784	dllhost.exe
3784	dllhost.exe
3784	dllhost.exe
3784	dllhost.exe
3784	dllhost.exe
3784	dllhost.exe
3784	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3784	dllhost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 35	640	da836408b89e756bd33aed58103d85199671e6fa41ded.exe
Token: SeDebugPrivilege	316	reviewwindriver.exe
Token: SeDebugPrivilege	3784	dllhost.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 640	1360	da836408b89e756bd33aed58103d85199671e6fa41ded.exe	82
PID 1360 wrote to memory of 640	1360	da836408b89e756bd33aed58103d85199671e6fa41ded.exe	82
PID 640 wrote to memory of 3392	640	da836408b89e756bd33aed58103d85199671e6fa41ded.exe	83
PID 640 wrote to memory of 3392	640	da836408b89e756bd33aed58103d85199671e6fa41ded.exe	83
PID 3392 wrote to memory of 3976	3392	cmd.exe	85
PID 3392 wrote to memory of 3976	3392	cmd.exe	85
PID 3392 wrote to memory of 3976	3392	cmd.exe	85
PID 3976 wrote to memory of 4540	3976	test.exe	86
PID 3976 wrote to memory of 4540	3976	test.exe	86
PID 3976 wrote to memory of 4540	3976	test.exe	86
PID 4540 wrote to memory of 3476	4540	WScript.exe	87
PID 4540 wrote to memory of 3476	4540	WScript.exe	87
PID 4540 wrote to memory of 3476	4540	WScript.exe	87
PID 3476 wrote to memory of 316	3476	cmd.exe	89
PID 3476 wrote to memory of 316	3476	cmd.exe	89
PID 316 wrote to memory of 3784	316	reviewwindriver.exe	138
PID 316 wrote to memory of 3784	316	reviewwindriver.exe	138

C:\Users\Admin\AppData\Local\Temp\da836408b89e756bd33aed58103d85199671e6fa41ded.exe
"C:\Users\Admin\AppData\Local\Temp\da836408b89e756bd33aed58103d85199671e6fa41ded.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Users\Admin\AppData\Local\Temp\da836408b89e756bd33aed58103d85199671e6fa41ded.exe
  "C:\Users\Admin\AppData\Local\Temp\da836408b89e756bd33aed58103d85199671e6fa41ded.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\\test.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - C:\test.exe
      C:\\test.exe
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3976
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\bridgecrt\XsVbRo5p4XICmtGZ8b7wlzKshVVmBA.vbe"
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:4540
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\bridgecrt\Hf4A2.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3476
        
        C:\bridgecrt\reviewwindriver.exe
        
        "C:\bridgecrt\reviewwindriver.exe"
        7⤵
        Executes dropped EXE
        Checks computer location settings
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:316
        
        C:\odt\dllhost.exe
        
        "C:\odt\dllhost.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:3784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\bridgecrt\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\bridgecrt\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\bridgecrt\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\bridgecrt\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\bridgecrt\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\bridgecrt\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows NT\Accessories\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows NT\Accessories\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "reviewwindriverr" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\reviewwindriver.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "reviewwindriver" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\reviewwindriver.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "reviewwindriverr" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\reviewwindriver.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Media Player\Skins\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Skins\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Media Player\Skins\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Windows\ServiceProfiles\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Windows\ServiceProfiles\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Adobe\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Adobe\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\odt\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Google\Chrome\Application\89.0.4389.114\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\89.0.4389.114\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\Application\89.0.4389.114\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "reviewwindriverr" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\reviewwindriver.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "reviewwindriver" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\reviewwindriver.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "reviewwindriverr" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Portable Devices\reviewwindriver.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Windows\ServiceProfiles\NetworkService\Documents\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\NetworkService\Documents\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Windows\ServiceProfiles\NetworkService\Documents\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\bridgecrt\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\bridgecrt\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\bridgecrt\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\odt\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\odt\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\odt\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Windows\debug\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\debug\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Windows\debug\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13602\VCRUNTIME140.dll
Size 85KB
SHA256 d89c7b863fc1ac3a179d45d5fe1b9fd35fb6fbd45171ca68d0d68ab1c1ad04fb
MD5 edf9d5c18111d82cf10ec99f6afa6b47
SHA1 d247f5b9d4d3061e3d421e0e623595aa40d9493c
SHA512 bf017aa8275c5b6d064984a606c5d40852aa70047759468395fe520f7f68b5452befc3145efaa7c51f8ec3bf71d9e32dbd5633637f040d58ff9a4b6953bf1cbf
SSDEEP 1536:6iOTTyN9d/mqN5fomseOpLZ5UP4nlf9ecbtGgcvg9EBIN:6DIVzgx5UAecbt4g9EuN
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13602\VCRUNTIME140.dll
Size 85KB
SHA256 d89c7b863fc1ac3a179d45d5fe1b9fd35fb6fbd45171ca68d0d68ab1c1ad04fb
MD5 edf9d5c18111d82cf10ec99f6afa6b47
SHA1 d247f5b9d4d3061e3d421e0e623595aa40d9493c
SHA512 bf017aa8275c5b6d064984a606c5d40852aa70047759468395fe520f7f68b5452befc3145efaa7c51f8ec3bf71d9e32dbd5633637f040d58ff9a4b6953bf1cbf
SSDEEP 1536:6iOTTyN9d/mqN5fomseOpLZ5UP4nlf9ecbtGgcvg9EBIN:6DIVzgx5UAecbt4g9EuN
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13602\_bz2.pyd
Size 92KB
SHA256 ba0e2dacda0cdca371f0f214484f6ee28dfd95da8b93ab4eec3b76518a1ea0e5
MD5 4db92e04d46cc6e0394d57cd06960a52
SHA1 c88c36984519da695d2b61c452d093e077a72dbf
SHA512 72f05408a68c4f28b9df898c1884224481835e3f2f6af8c7b746c7fa2124fb2b59b74989955dfe45630bf00102695781bc64170edf5d7c259ac2c3f337a47b51
SSDEEP 1536:BEIVBlvXrO/udhh1x8/Nlv+SymdYv787J7SM++SbrEtIz4VEsVpI9dm:ieiMA7pJd97J7SM++SbAtIz4VEWc0
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13602\_bz2.pyd
Size 92KB
SHA256 ba0e2dacda0cdca371f0f214484f6ee28dfd95da8b93ab4eec3b76518a1ea0e5
MD5 4db92e04d46cc6e0394d57cd06960a52
SHA1 c88c36984519da695d2b61c452d093e077a72dbf
SHA512 72f05408a68c4f28b9df898c1884224481835e3f2f6af8c7b746c7fa2124fb2b59b74989955dfe45630bf00102695781bc64170edf5d7c259ac2c3f337a47b51
SSDEEP 1536:BEIVBlvXrO/udhh1x8/Nlv+SymdYv787J7SM++SbrEtIz4VEsVpI9dm:ieiMA7pJd97J7SM++SbAtIz4VEWc0
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13602\_lzma.pyd
Size 248KB
SHA256 5c1087db19394e368b7bf7af6976fb9122ebfa7d06c1e9de94d2b6c361eee6b0
MD5 854926509c595cb975d092c0e1124f2d
SHA1 0f02a231f974725fc2a2d9f65b3be22111289e11
SHA512 e68fed43cfe5b71817b3840940691e5ca4a9b3319269bd437407bff02e24cd594b9ed1319750c615091d0a6e4a6bd99f697734e008f9d489a2502f111b6dd162
SSDEEP 6144:gos7JXamRCFMwtbNqpNnkC/vOEhZw9bdnqANjky/EOIhwwzbJqRNuk9/hOZhAw4C:go4pwjGb1LotoIwt
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13602\_lzma.pyd
Size 248KB
SHA256 5c1087db19394e368b7bf7af6976fb9122ebfa7d06c1e9de94d2b6c361eee6b0
MD5 854926509c595cb975d092c0e1124f2d
SHA1 0f02a231f974725fc2a2d9f65b3be22111289e11
SHA512 e68fed43cfe5b71817b3840940691e5ca4a9b3319269bd437407bff02e24cd594b9ed1319750c615091d0a6e4a6bd99f697734e008f9d489a2502f111b6dd162
SSDEEP 6144:gos7JXamRCFMwtbNqpNnkC/vOEhZw9bdnqANjky/EOIhwwzbJqRNuk9/hOZhAw4C:go4pwjGb1LotoIwt
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI13602\base_library.zip
Size 767KB
SHA256 1dd8cac61b80024736b38de6e4aac3baa54918b2ed8662b7784beb9ad1d6fbaa
MD5 20f81e916303ea80f4e13279086183cb
SHA1 29e23515442d6995cb6cb78071539fdc4e0e54ba
SHA512 5383ad1b751082e4cc1335d8ee5fcbca12bbd9aa235147528c1030c5419d7a24ddba66e28bf593b9c98260c36b4238c303750c21d97f2e3f1b3edef2f74a2a59
SSDEEP 12288:kbd9UMBb6vdnR/13CT0VsANNlZ4VK4iySX0/3jE0rbD9ehTO6:Ud9U+0VsANNlZ4VK4iyx3jE0rbsTO6
MD5 SHA1 SHA512 SSDEEP

Submit Download

main.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI13602\main.zip
Size 1.1MB
SHA256 105838375241d6332407d1304d0a05b424abc160bbcb34eda14d005c51d73c2e
MD5 da4b7a3d9d616a0cef0e4c6a4834b92b
SHA1 4322c2434d79a8a69ceb3b15c938f5e64c8cacac
SHA512 b23e81e36906afa87cb3b8c34dc6403510cf1ca19501ba3cf10e95c10edcc4d55c2336d6406abec883ccb05d7ab7f717d73ea644280bfe266786690b00ee6ef1
SSDEEP 24576:MHf67kRAiKKVCBFLSLY+jdKwvTdnqGg5Qk3p0gnI2ULC4MJVKflwsd0:MHfL4N6LYPwbdnqHGk3QVMuS
MD5 SHA1 SHA512 SSDEEP

Submit Download

python36.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13602\python36.dll
Size 3.4MB
SHA256 89a963d8b75e2c23cc8d0c24d72e2662424cd9006dece16bc93fb5d3a3f665fa
MD5 93de8b996048d9090d7d6b36e7c22c58
SHA1 d6d8ceb8a871a2b837989f5bc8517922364fb062
SHA512 bc34ea015d763e50dd3e7c3791b224c1ea242e87b35c178baedff46075fbe61bccd9ff6cae997f63922dea5f8c2f3e2ff6396cf64b9f5ca7979dd08c72186d89
SSDEEP 49152:vFHLoUiJBuvh5pGqBcUfh/X/ev0d6L9ifb68CBFRU8tTjIULbH4UMlnRPEx6X6s9:v9HrmriWWUfHNMlGE6F+
MD5 SHA1 SHA512 SSDEEP

Submit Download

python36.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13602\python36.dll
Size 3.4MB
SHA256 89a963d8b75e2c23cc8d0c24d72e2662424cd9006dece16bc93fb5d3a3f665fa
MD5 93de8b996048d9090d7d6b36e7c22c58
SHA1 d6d8ceb8a871a2b837989f5bc8517922364fb062
SHA512 bc34ea015d763e50dd3e7c3791b224c1ea242e87b35c178baedff46075fbe61bccd9ff6cae997f63922dea5f8c2f3e2ff6396cf64b9f5ca7979dd08c72186d89
SSDEEP 49152:vFHLoUiJBuvh5pGqBcUfh/X/ev0d6L9ifb68CBFRU8tTjIULbH4UMlnRPEx6X6s9:v9HrmriWWUfHNMlGE6F+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hf4A2.bat

Path C:\bridgecrt\Hf4A2.bat
Size 34B
SHA256 910ac1eb193a69250cdfbdbf1b46de1494f981891ebf8efb78127cad1dc3f7b7
MD5 a3c979b55698f4f01f9de4020b2c0bf6
SHA1 cdfca6f1c9318fa6d217a195336c3f51f445e828
SHA512 e3729c81f32a16ef6cecd1f9a299b80ae8da58e7662dd43a1619e1d31ecae838f5102807eae2b3f34ace8fe767c0c0124d48acb1d0fee6db8b7c6121b4315a79
MD5 SHA1 SHA512

Submit Download

XsVbRo5p4XICmtGZ8b7wlzKshVVmBA.vbe

Path C:\bridgecrt\XsVbRo5p4XICmtGZ8b7wlzKshVVmBA.vbe
Size 191B
SHA256 4361c079bd04aa4f33cb29a4fe7063c5db4b051fed151f2d9b984134a86a5782
MD5 fba3d916c545a8c2ebf8730243281afc
SHA1 82b65a8a42568fd5c464a38ca10052d00a6908ca
SHA512 fb6880a3a460cde1ad21ee1dc74d50cd13d6dc3c8501d2e60386021f17df044bc947c83631e1db172599c012a828946b83ab93ad12a7eeb92b62a2f4de5ae659
MD5 SHA1 SHA512

Submit Download

reviewwindriver.exe

Path C:\bridgecrt\reviewwindriver.exe
Size 827KB
SHA256 e72398405a56730bd0d9fd14032287f7bfd198662c948317d0be3e7f01757002
MD5 f9566b8c2952f34176e02f2ecaff5587
SHA1 8afbfc12a1f01441ff57703244778dae7469ddd4
SHA512 4859df0ebab9a57d4a9939b081637decd0c95e4f95d2ddd9c00fd887ff6716dc35b4d704364f68c40b5473d6fd1fa200341b88080e51c0e3f78d888b0488b346
SSDEEP 12288:b8bmf/UExgHf4Xw8/rjX56faRis3Jqxy45HuWozCuXnF:PgHf4XLXX5D4xuWaCi
MD5 SHA1 SHA512 SSDEEP

Submit Download

reviewwindriver.exe

Path C:\bridgecrt\reviewwindriver.exe
Size 827KB
SHA256 e72398405a56730bd0d9fd14032287f7bfd198662c948317d0be3e7f01757002
MD5 f9566b8c2952f34176e02f2ecaff5587
SHA1 8afbfc12a1f01441ff57703244778dae7469ddd4
SHA512 4859df0ebab9a57d4a9939b081637decd0c95e4f95d2ddd9c00fd887ff6716dc35b4d704364f68c40b5473d6fd1fa200341b88080e51c0e3f78d888b0488b346
SSDEEP 12288:b8bmf/UExgHf4Xw8/rjX56faRis3Jqxy45HuWozCuXnF:PgHf4XLXX5D4xuWaCi
MD5 SHA1 SHA512 SSDEEP

Submit Download

dllhost.exe

Path C:\odt\dllhost.exe
Size 827KB
SHA256 e72398405a56730bd0d9fd14032287f7bfd198662c948317d0be3e7f01757002
MD5 f9566b8c2952f34176e02f2ecaff5587
SHA1 8afbfc12a1f01441ff57703244778dae7469ddd4
SHA512 4859df0ebab9a57d4a9939b081637decd0c95e4f95d2ddd9c00fd887ff6716dc35b4d704364f68c40b5473d6fd1fa200341b88080e51c0e3f78d888b0488b346
SSDEEP 12288:b8bmf/UExgHf4Xw8/rjX56faRis3Jqxy45HuWozCuXnF:PgHf4XLXX5D4xuWaCi
MD5 SHA1 SHA512 SSDEEP

Submit Download

dllhost.exe

Path C:\odt\dllhost.exe
Size 827KB
SHA256 e72398405a56730bd0d9fd14032287f7bfd198662c948317d0be3e7f01757002
MD5 f9566b8c2952f34176e02f2ecaff5587
SHA1 8afbfc12a1f01441ff57703244778dae7469ddd4
SHA512 4859df0ebab9a57d4a9939b081637decd0c95e4f95d2ddd9c00fd887ff6716dc35b4d704364f68c40b5473d6fd1fa200341b88080e51c0e3f78d888b0488b346
SSDEEP 12288:b8bmf/UExgHf4Xw8/rjX56faRis3Jqxy45HuWozCuXnF:PgHf4XLXX5D4xuWaCi
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.exe

Path C:\test.exe
Size 1.1MB
SHA256 6945bde5b568e239c7c13c0c29d637edb0518e1f8814433d2c1386325e59272d
MD5 4161b638c466ab21431ea02f49dfa0f4
SHA1 6d41c89df1ed854702d1c30f41fe17899721656c
SHA512 326344bdbfecb6b11ffcef5c98d0ff09dc5d02d45a9e9ab387ec8d70262c1808ab85a9314cad4ea7fa4e8eb339c8923eafb408a79749291a9fb7f28fe1af3e61
SSDEEP 12288:aRZ+IoG/n9IQxW3OBsee2X+t4RbO8bmf/UExgHf4Xw8/rjX56faRis3Jqxy45Hur:U2G/nvxW3Ww0tmgHf4XLXX5D4xuWaCi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.exe

Path C:\test.exe
Size 1.1MB
SHA256 6945bde5b568e239c7c13c0c29d637edb0518e1f8814433d2c1386325e59272d
MD5 4161b638c466ab21431ea02f49dfa0f4
SHA1 6d41c89df1ed854702d1c30f41fe17899721656c
SHA512 326344bdbfecb6b11ffcef5c98d0ff09dc5d02d45a9e9ab387ec8d70262c1808ab85a9314cad4ea7fa4e8eb339c8923eafb408a79749291a9fb7f28fe1af3e61
SSDEEP 12288:aRZ+IoG/n9IQxW3OBsee2X+t4RbO8bmf/UExgHf4Xw8/rjX56faRis3Jqxy45Hur:U2G/nvxW3Ww0tmgHf4XLXX5D4xuWaCi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/316-154-0x0000000000020000-0x00000000000F6000-memory.dmp

Download

memory/316-155-0x00007FFF1D770000-0x00007FFF1E231000-memory.dmp

Download

memory/316-159-0x00007FFF1D770000-0x00007FFF1E231000-memory.dmp

Download

memory/3784-160-0x00007FFF1D770000-0x00007FFF1E231000-memory.dmp

Download

memory/3784-161-0x00007FFF1D770000-0x00007FFF1E231000-memory.dmp

Download