dcrat | 01e2946bab81b880ec494a1692a791ced92624246e6aed7a15c725851ede71dd

General

Target

b313d25c0fed1c6069e6a72e73a5751f.exe
Size

1.2MB
MD5

b313d25c0fed1c6069e6a72e73a5751f
SHA1

1717db41053d68f4b6cb0619eaee7d7617a6ebc9
SHA256

01e2946bab81b880ec494a1692a791ced92624246e6aed7a15c725851ede71dd
SHA512

6807bc163b386f0398a7195f83f7b0619d912724582780ace94d0cd115c2f192a90536f9950cf61c9f18d7df0da58ea9116a22544ff9f3a5489e6c2398d975d3
SSDEEP

24576:1oz7PdSo8OhfvG83PxEXY5TZ95f+bYy4HKTtadCK2yseqa+B:1odSo80/GXC9+bl4ewpEe+

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5100	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4332	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	400	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	620	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4808	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4796	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4708	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4788	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3592	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3972	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4028	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1396	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4300	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	992	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4412	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4296	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4272	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1252	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4172	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	740	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3544	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4264	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	108	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	224	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4660	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3980	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1332	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3952	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4988	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4044	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4136	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1888	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	772	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	816	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2336	2332	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1496	2332	schtasks.exe

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral2/memory/4004-132-0x0000000000860000-0x0000000000996000-memory.dmp	dcrat
C:\odt\SppExtComObj.exe	dcrat
C:\odt\SppExtComObj.exe	dcrat

Executes dropped EXE 1 IoCs

Processes:

SppExtComObj.exe

pid process

4344 SppExtComObj.exe

pid	process
4344	SppExtComObj.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b313d25c0fed1c6069e6a72e73a5751f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	b313d25c0fed1c6069e6a72e73a5751f.exe

Drops file in Program Files directory 12 IoCs

Processes:

b313d25c0fed1c6069e6a72e73a5751f.exe

description	ioc	process
File created	C:\Program Files (x86)\Windows NT\TableTextService\6ccacd8608530f	b313d25c0fed1c6069e6a72e73a5751f.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\5b884080fd4f94	b313d25c0fed1c6069e6a72e73a5751f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\csrss.exe	b313d25c0fed1c6069e6a72e73a5751f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\886983d96e3d3e	b313d25c0fed1c6069e6a72e73a5751f.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\fontdrvhost.exe	b313d25c0fed1c6069e6a72e73a5751f.exe
File created	C:\Program Files (x86)\Windows Portable Devices\ee2ad38f3d4382	b313d25c0fed1c6069e6a72e73a5751f.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Idle.exe	b313d25c0fed1c6069e6a72e73a5751f.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\Idle.exe	b313d25c0fed1c6069e6a72e73a5751f.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\fontdrvhost.exe	b313d25c0fed1c6069e6a72e73a5751f.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\5b884080fd4f94	b313d25c0fed1c6069e6a72e73a5751f.exe
File created	C:\Program Files (x86)\Windows Portable Devices\Registry.exe	b313d25c0fed1c6069e6a72e73a5751f.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\6ccacd8608530f	b313d25c0fed1c6069e6a72e73a5751f.exe

Drops file in Windows directory 7 IoCs

Processes:

b313d25c0fed1c6069e6a72e73a5751f.exe

description	ioc	process
File created	C:\Windows\es-ES\69ddcba757bf72	b313d25c0fed1c6069e6a72e73a5751f.exe
File created	C:\Windows\SoftwareDistribution\Download\SharedFileCache\WmiPrvSE.exe	b313d25c0fed1c6069e6a72e73a5751f.exe
File created	C:\Windows\SoftwareDistribution\Download\SharedFileCache\24dbde2999530e	b313d25c0fed1c6069e6a72e73a5751f.exe
File created	C:\Windows\Fonts\dwm.exe	b313d25c0fed1c6069e6a72e73a5751f.exe
File opened for modification	C:\Windows\Fonts\dwm.exe	b313d25c0fed1c6069e6a72e73a5751f.exe
File created	C:\Windows\Fonts\6cb0b6c459d5d3	b313d25c0fed1c6069e6a72e73a5751f.exe
File created	C:\Windows\es-ES\smss.exe	b313d25c0fed1c6069e6a72e73a5751f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
4296	schtasks.exe
108	schtasks.exe
4988	schtasks.exe
1848	schtasks.exe
4044	schtasks.exe
4796	schtasks.exe
3972	schtasks.exe
2044	schtasks.exe
772	schtasks.exe
3592	schtasks.exe
1936	schtasks.exe
4300	schtasks.exe
3544	schtasks.exe
4660	schtasks.exe
4332	schtasks.exe
620	schtasks.exe
4780	schtasks.exe
3952	schtasks.exe
4788	schtasks.exe
1660	schtasks.exe
4172	schtasks.exe
4272	schtasks.exe
1252	schtasks.exe
4136	schtasks.exe
5100	schtasks.exe
400	schtasks.exe
2792	schtasks.exe
4412	schtasks.exe
740	schtasks.exe
2116	schtasks.exe
816	schtasks.exe
4764	schtasks.exe
4708	schtasks.exe
1688	schtasks.exe
4496	schtasks.exe
224	schtasks.exe
1332	schtasks.exe
1888	schtasks.exe
4808	schtasks.exe
1676	schtasks.exe
4028	schtasks.exe
2068	schtasks.exe
4264	schtasks.exe
3980	schtasks.exe
2152	schtasks.exe
2336	schtasks.exe
1780	schtasks.exe
1560	schtasks.exe
992	schtasks.exe
1396	schtasks.exe
1496	schtasks.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

Processes:

b313d25c0fed1c6069e6a72e73a5751f.exeSppExtComObj.exe

pid	process
4004	b313d25c0fed1c6069e6a72e73a5751f.exe
4004	b313d25c0fed1c6069e6a72e73a5751f.exe
4004	b313d25c0fed1c6069e6a72e73a5751f.exe
4004	b313d25c0fed1c6069e6a72e73a5751f.exe
4004	b313d25c0fed1c6069e6a72e73a5751f.exe
4004	b313d25c0fed1c6069e6a72e73a5751f.exe
4004	b313d25c0fed1c6069e6a72e73a5751f.exe
4004	b313d25c0fed1c6069e6a72e73a5751f.exe
4004	b313d25c0fed1c6069e6a72e73a5751f.exe
4004	b313d25c0fed1c6069e6a72e73a5751f.exe
4004	b313d25c0fed1c6069e6a72e73a5751f.exe
4004	b313d25c0fed1c6069e6a72e73a5751f.exe
4004	b313d25c0fed1c6069e6a72e73a5751f.exe
4004	b313d25c0fed1c6069e6a72e73a5751f.exe
4004	b313d25c0fed1c6069e6a72e73a5751f.exe
4004	b313d25c0fed1c6069e6a72e73a5751f.exe
4004	b313d25c0fed1c6069e6a72e73a5751f.exe
4004	b313d25c0fed1c6069e6a72e73a5751f.exe
4004	b313d25c0fed1c6069e6a72e73a5751f.exe
4004	b313d25c0fed1c6069e6a72e73a5751f.exe
4004	b313d25c0fed1c6069e6a72e73a5751f.exe
4004	b313d25c0fed1c6069e6a72e73a5751f.exe
4004	b313d25c0fed1c6069e6a72e73a5751f.exe
4004	b313d25c0fed1c6069e6a72e73a5751f.exe
4004	b313d25c0fed1c6069e6a72e73a5751f.exe
4344	SppExtComObj.exe
4344	SppExtComObj.exe
4344	SppExtComObj.exe
4344	SppExtComObj.exe
4344	SppExtComObj.exe
4344	SppExtComObj.exe
4344	SppExtComObj.exe
4344	SppExtComObj.exe
4344	SppExtComObj.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

SppExtComObj.exe

pid process

4344 SppExtComObj.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

b313d25c0fed1c6069e6a72e73a5751f.exeSppExtComObj.exe

description pid process

Token: SeDebugPrivilege 4004 b313d25c0fed1c6069e6a72e73a5751f.exe
Token: SeDebugPrivilege 4344 SppExtComObj.exe

pid	process
4344	SppExtComObj.exe

description	pid	process
Token: SeDebugPrivilege	4004	b313d25c0fed1c6069e6a72e73a5751f.exe
Token: SeDebugPrivilege	4344	SppExtComObj.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

b313d25c0fed1c6069e6a72e73a5751f.exe

description	pid	process	target process
PID 4004 wrote to memory of 4344	4004	b313d25c0fed1c6069e6a72e73a5751f.exe	SppExtComObj.exe
PID 4004 wrote to memory of 4344	4004	b313d25c0fed1c6069e6a72e73a5751f.exe	SppExtComObj.exe

C:\Users\Admin\AppData\Local\Temp\b313d25c0fed1c6069e6a72e73a5751f.exe
"C:\Users\Admin\AppData\Local\Temp\b313d25c0fed1c6069e6a72e73a5751f.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4004

C:\odt\SppExtComObj.exe
"C:\odt\SppExtComObj.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Windows\Fonts\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Fonts\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Windows\Fonts\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 14 /tr "'C:\odt\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\odt\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\odt\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\es-ES\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\es-ES\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Windows\es-ES\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\odt\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\odt\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\odt\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\odt\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\All Users\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\odt\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\odt\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\odt\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Windows\SoftwareDistribution\Download\SharedFileCache\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\Download\SharedFileCache\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Windows\SoftwareDistribution\Download\SharedFileCache\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Portable Devices\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Portable Devices\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\odt\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\odt\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\odt\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1496

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\odt\SppExtComObj.exe
Filesize
1.2MB

MD5
b313d25c0fed1c6069e6a72e73a5751f

SHA1
1717db41053d68f4b6cb0619eaee7d7617a6ebc9

SHA256
01e2946bab81b880ec494a1692a791ced92624246e6aed7a15c725851ede71dd

SHA512
6807bc163b386f0398a7195f83f7b0619d912724582780ace94d0cd115c2f192a90536f9950cf61c9f18d7df0da58ea9116a22544ff9f3a5489e6c2398d975d3

Download Submit
C:\odt\SppExtComObj.exe
Filesize
1.2MB

MD5
b313d25c0fed1c6069e6a72e73a5751f

SHA1
1717db41053d68f4b6cb0619eaee7d7617a6ebc9

SHA256
01e2946bab81b880ec494a1692a791ced92624246e6aed7a15c725851ede71dd

SHA512
6807bc163b386f0398a7195f83f7b0619d912724582780ace94d0cd115c2f192a90536f9950cf61c9f18d7df0da58ea9116a22544ff9f3a5489e6c2398d975d3

Download Submit
memory/4004-132-0x0000000000860000-0x0000000000996000-memory.dmp

Filesize
1.2MB

Download
memory/4004-133-0x000000001CBD0000-0x000000001CC20000-memory.dmp

Filesize
320KB

Download
memory/4004-134-0x00007FF857620000-0x00007FF8580E1000-memory.dmp

Filesize
10.8MB

Download
memory/4004-138-0x00007FF857620000-0x00007FF8580E1000-memory.dmp

Filesize
10.8MB

Download
memory/4344-135-0x0000000000000000-mapping.dmp

Download
memory/4344-139-0x00007FF857620000-0x00007FF8580E1000-memory.dmp

Filesize
10.8MB

Download
memory/4344-140-0x00007FF857620000-0x00007FF8580E1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads