dcrat | 147e07c4f900dbd2c64b3bf60502937838a2b2afed76ada94ef8705a12b5b6a6

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13-06-2023 11:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02965599.exe
Size

2.6MB
MD5

372cc839865083adf0f65df5328bd899
SHA1

c0b501e644a12cd28957359f81e984b669c630a4
SHA256

147e07c4f900dbd2c64b3bf60502937838a2b2afed76ada94ef8705a12b5b6a6
SHA512

09ca0793b79583178f2aa9de209adaa73e4ca3c898bf732ee4874adea070caacebaec961772feca62816c0c45de0acc7ca940e08862c14b7b01178649eabc36e
SSDEEP

49152:UbA30qPDl0T7HdZNFvKiUy2CDnVjT6f3XFmI2:UbcJ0T7jvL+2BTsHFmI2

Score

10^/10

dcrat evasion infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1900	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	428	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	680	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	316	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1000	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	796	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1388	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	928	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	940	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1100	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	880	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1056	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1256	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1220	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	904	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	916	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	280	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	788	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	984	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1896	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1900	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	884	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	744	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	268	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	880	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1428	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1256	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1100	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1388	1528	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	1528	schtasks.exe

DCRat payload 10 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
\reviewdhcpsvc\AgentCommon.exe	dcrat
C:\reviewdhcpsvc\AgentCommon.exe	dcrat
\reviewdhcpsvc\AgentCommon.exe	dcrat
C:\reviewdhcpsvc\AgentCommon.exe	dcrat
behavioral1/memory/1040-72-0x0000000001330000-0x0000000001582000-memory.dmp	dcrat
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\explorer.exe	dcrat
C:\Program Files (x86)\Internet Explorer\de-DE\taskhost.exe	dcrat
C:\Program Files (x86)\Internet Explorer\de-DE\taskhost.exe	dcrat
behavioral1/memory/1004-119-0x0000000000C20000-0x0000000000E72000-memory.dmp	dcrat
behavioral1/memory/1004-122-0x0000000002390000-0x0000000002410000-memory.dmp	dcrat

Disables Task Manager via registry modification
evasion
Executes dropped EXE 2 IoCs

Processes:

AgentCommon.exetaskhost.exe

pid process

1040 AgentCommon.exe
1004 taskhost.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

828 cmd.exe
828 cmd.exe

pid	process
828	cmd.exe
828	cmd.exe

Drops file in Program Files directory 9 IoCs

Processes:

AgentCommon.exe

description	ioc	process
File created	C:\Program Files\Windows Photo Viewer\de-DE\lsass.exe	AgentCommon.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\6203df4a6bafc7	AgentCommon.exe
File created	C:\Program Files (x86)\Internet Explorer\de-DE\b75386f1303e64	AgentCommon.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\6ccacd8608530f	AgentCommon.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\Idle.exe	AgentCommon.exe
File created	C:\Program Files\Windows Media Player\fr-FR\cmd.exe	AgentCommon.exe
File created	C:\Program Files\Windows Media Player\fr-FR\ebf1f9fa8afd6d	AgentCommon.exe
File created	C:\Program Files (x86)\Internet Explorer\de-DE\taskhost.exe	AgentCommon.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\Idle.exe	AgentCommon.exe

Drops file in Windows directory 8 IoCs

Processes:

AgentCommon.exe

description	ioc	process
File created	C:\Windows\PCHEALTH\ERRORREP\QSIGNOFF\6cb0b6c459d5d3	AgentCommon.exe
File created	C:\Windows\debug\WIA\explorer.exe	AgentCommon.exe
File created	C:\Windows\debug\WIA\7a0fd90576e088	AgentCommon.exe
File created	C:\Windows\debug\WIA\taskhost.exe	AgentCommon.exe
File created	C:\Windows\debug\WIA\b75386f1303e64	AgentCommon.exe
File created	C:\Windows\tracing\cmd.exe	AgentCommon.exe
File created	C:\Windows\tracing\ebf1f9fa8afd6d	AgentCommon.exe
File created	C:\Windows\PCHEALTH\ERRORREP\QSIGNOFF\dwm.exe	AgentCommon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
1000	schtasks.exe
1484	schtasks.exe
1492	schtasks.exe
1084	schtasks.exe
1576	schtasks.exe
1140	schtasks.exe
428	schtasks.exe
1944	schtasks.exe
1100	schtasks.exe
744	schtasks.exe
880	schtasks.exe
1768	schtasks.exe
1056	schtasks.exe
1356	schtasks.exe
904	schtasks.exe
1900	schtasks.exe
1596	schtasks.exe
1100	schtasks.exe
1388	schtasks.exe
1900	schtasks.exe
1220	schtasks.exe
1736	schtasks.exe
268	schtasks.exe
1680	schtasks.exe
680	schtasks.exe
928	schtasks.exe
1256	schtasks.exe
1916	schtasks.exe
1428	schtasks.exe
316	schtasks.exe
1004	schtasks.exe
940	schtasks.exe
1736	schtasks.exe
880	schtasks.exe
1656	schtasks.exe
1892	schtasks.exe
280	schtasks.exe
796	schtasks.exe
1388	schtasks.exe
1728	schtasks.exe
1256	schtasks.exe
788	schtasks.exe
984	schtasks.exe
916	schtasks.exe
1896	schtasks.exe
884	schtasks.exe
548	schtasks.exe
2044	schtasks.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1104 reg.exe

pid	process
1104	reg.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

AgentCommon.exetaskhost.exe

pid	process
1040	AgentCommon.exe
1004	taskhost.exe
1004	taskhost.exe
1004	taskhost.exe
1004	taskhost.exe
1004	taskhost.exe
1004	taskhost.exe
1004	taskhost.exe
1004	taskhost.exe
1004	taskhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AgentCommon.exetaskhost.exe

description pid process

Token: SeDebugPrivilege 1040 AgentCommon.exe
Token: SeDebugPrivilege 1004 taskhost.exe

description	pid	process
Token: SeDebugPrivilege	1040	AgentCommon.exe
Token: SeDebugPrivilege	1004	taskhost.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

02965599.exeWScript.execmd.exeAgentCommon.exe

description	pid	process	target process
PID 788 wrote to memory of 1692	788	02965599.exe	WScript.exe
PID 788 wrote to memory of 1692	788	02965599.exe	WScript.exe
PID 788 wrote to memory of 1692	788	02965599.exe	WScript.exe
PID 788 wrote to memory of 1692	788	02965599.exe	WScript.exe
PID 788 wrote to memory of 760	788	02965599.exe	WScript.exe
PID 788 wrote to memory of 760	788	02965599.exe	WScript.exe
PID 788 wrote to memory of 760	788	02965599.exe	WScript.exe
PID 788 wrote to memory of 760	788	02965599.exe	WScript.exe
PID 1692 wrote to memory of 828	1692	WScript.exe	cmd.exe
PID 1692 wrote to memory of 828	1692	WScript.exe	cmd.exe
PID 1692 wrote to memory of 828	1692	WScript.exe	cmd.exe
PID 1692 wrote to memory of 828	1692	WScript.exe	cmd.exe
PID 828 wrote to memory of 1040	828	cmd.exe	AgentCommon.exe
PID 828 wrote to memory of 1040	828	cmd.exe	AgentCommon.exe
PID 828 wrote to memory of 1040	828	cmd.exe	AgentCommon.exe
PID 828 wrote to memory of 1040	828	cmd.exe	AgentCommon.exe
PID 1040 wrote to memory of 1004	1040	AgentCommon.exe	taskhost.exe
PID 1040 wrote to memory of 1004	1040	AgentCommon.exe	taskhost.exe
PID 1040 wrote to memory of 1004	1040	AgentCommon.exe	taskhost.exe
PID 828 wrote to memory of 1104	828	cmd.exe	reg.exe
PID 828 wrote to memory of 1104	828	cmd.exe	reg.exe
PID 828 wrote to memory of 1104	828	cmd.exe	reg.exe
PID 828 wrote to memory of 1104	828	cmd.exe	reg.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\02965599.exe
"C:\Users\Admin\AppData\Local\Temp\02965599.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:788

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\reviewdhcpsvc\mUKdghzpqGHjXShI5nXTcwIxK1c.vbe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\reviewdhcpsvc\LlPAERN42DMwqf5ax8R7gZ.bat" "
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:828

C:\reviewdhcpsvc\AgentCommon.exe
"C:\reviewdhcpsvc\AgentCommon.exe"
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1040

C:\Program Files (x86)\Internet Explorer\de-DE\taskhost.exe
"C:\Program Files (x86)\Internet Explorer\de-DE\taskhost.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1004

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
4⤵
- Modifies registry key
PID:1104

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\reviewdhcpsvc\file.vbs"
2⤵
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\de-DE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\de-DE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Photo Viewer\de-DE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\f8d1ec42-b1b7-11ed-bba7-be56d16f7d95\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\f8d1ec42-b1b7-11ed-bba7-be56d16f7d95\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\f8d1ec42-b1b7-11ed-bba7-be56d16f7d95\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\Recovery\f8d1ec42-b1b7-11ed-bba7-be56d16f7d95\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\f8d1ec42-b1b7-11ed-bba7-be56d16f7d95\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Recovery\f8d1ec42-b1b7-11ed-bba7-be56d16f7d95\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\reviewdhcpsvc\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\reviewdhcpsvc\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\reviewdhcpsvc\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\reviewdhcpsvc\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\reviewdhcpsvc\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\reviewdhcpsvc\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Windows\PCHEALTH\ERRORREP\QSIGNOFF\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Windows\PCHEALTH\ERRORREP\QSIGNOFF\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\PCHEALTH\ERRORREP\QSIGNOFF\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Media Player\fr-FR\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\fr-FR\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Media Player\fr-FR\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Users\Default\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Default\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Users\Default\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Downloads\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\Public\Downloads\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Downloads\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Windows\debug\WIA\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\debug\WIA\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Windows\debug\WIA\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Start Menu\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Admin\Start Menu\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Start Menu\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Windows\debug\WIA\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\debug\WIA\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\Windows\debug\WIA\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Windows\tracing\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\tracing\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Windows\tracing\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1140

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\explorer.exe
Filesize
2.3MB

MD5
c12e4a53dc571ccce79abefd054c2424

SHA1
e673e215b3ac6d550ab8a10e4978f81494e50e81

SHA256
fa1cd5896935e6be20825665599a1bd7ea09c82830cd18c303c1fa38eefac315

SHA512
0a5e4b1a1c6964ae9538ca7139133e605d89ea9e501ef7642bf2dbf9bd39c798b6811c09016a525331e8ebffa9604b3e6e32bc82a150bcc8f40353170a9296ce

Download Submit
C:\Program Files (x86)\Internet Explorer\de-DE\taskhost.exe
Filesize
2.3MB

MD5
c12e4a53dc571ccce79abefd054c2424

SHA1
e673e215b3ac6d550ab8a10e4978f81494e50e81

SHA256
fa1cd5896935e6be20825665599a1bd7ea09c82830cd18c303c1fa38eefac315

SHA512
0a5e4b1a1c6964ae9538ca7139133e605d89ea9e501ef7642bf2dbf9bd39c798b6811c09016a525331e8ebffa9604b3e6e32bc82a150bcc8f40353170a9296ce

Download Submit
C:\Program Files (x86)\Internet Explorer\de-DE\taskhost.exe
Filesize
2.3MB

MD5
c12e4a53dc571ccce79abefd054c2424

SHA1
e673e215b3ac6d550ab8a10e4978f81494e50e81

SHA256
fa1cd5896935e6be20825665599a1bd7ea09c82830cd18c303c1fa38eefac315

SHA512
0a5e4b1a1c6964ae9538ca7139133e605d89ea9e501ef7642bf2dbf9bd39c798b6811c09016a525331e8ebffa9604b3e6e32bc82a150bcc8f40353170a9296ce

Download Submit
C:\reviewdhcpsvc\AgentCommon.exe
Filesize
2.3MB

MD5
c12e4a53dc571ccce79abefd054c2424

SHA1
e673e215b3ac6d550ab8a10e4978f81494e50e81

SHA256
fa1cd5896935e6be20825665599a1bd7ea09c82830cd18c303c1fa38eefac315

SHA512
0a5e4b1a1c6964ae9538ca7139133e605d89ea9e501ef7642bf2dbf9bd39c798b6811c09016a525331e8ebffa9604b3e6e32bc82a150bcc8f40353170a9296ce

Download Submit
C:\reviewdhcpsvc\AgentCommon.exe
Filesize
2.3MB

MD5
c12e4a53dc571ccce79abefd054c2424

SHA1
e673e215b3ac6d550ab8a10e4978f81494e50e81

SHA256
fa1cd5896935e6be20825665599a1bd7ea09c82830cd18c303c1fa38eefac315

SHA512
0a5e4b1a1c6964ae9538ca7139133e605d89ea9e501ef7642bf2dbf9bd39c798b6811c09016a525331e8ebffa9604b3e6e32bc82a150bcc8f40353170a9296ce

Download Submit
C:\reviewdhcpsvc\LlPAERN42DMwqf5ax8R7gZ.bat
Filesize
146B

MD5
ca5ae6a576781a9f77124addb764d81f

SHA1
06f28caf056efc0aa8426006415db979ae2016fe

SHA256
2776f5470fce110bfb8d847ac112564ddbe69e0bfa43f597e117ba382667b5a4

SHA512
0e131d0f0f4e583e64ea4c9c3478f5ab8818f8dce8046f329d7e1bd40db09200c6c22f5846ce30fa2f8a5c018eba92deb5bcbbab7a6032ec51282fe75db608fa

Download Submit
C:\reviewdhcpsvc\file.vbs
Filesize
34B

MD5
677cc4360477c72cb0ce00406a949c61

SHA1
b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

SHA256
f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

SHA512
7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

Download Submit
C:\reviewdhcpsvc\mUKdghzpqGHjXShI5nXTcwIxK1c.vbe
Filesize
212B

MD5
9af3f91f678eb5dbee799914975f15aa

SHA1
f5ae5e45d49b48c271a5a51f8eee634b0a2751b4

SHA256
11307e00ec4f82cd159f6a4abba62fd6424e49860da33e0465635339781dd72f

SHA512
0648786d03057b9c16d8ddedca83a7ab4ac317e638d8f82939711f658f78b999788c9e9f9c308ab49cd168ed9a76fa03c8d7375de1a0550d558fc10032e886fb

Download Submit
\reviewdhcpsvc\AgentCommon.exe
Filesize
2.3MB

MD5
c12e4a53dc571ccce79abefd054c2424

SHA1
e673e215b3ac6d550ab8a10e4978f81494e50e81

SHA256
fa1cd5896935e6be20825665599a1bd7ea09c82830cd18c303c1fa38eefac315

SHA512
0a5e4b1a1c6964ae9538ca7139133e605d89ea9e501ef7642bf2dbf9bd39c798b6811c09016a525331e8ebffa9604b3e6e32bc82a150bcc8f40353170a9296ce

Download Submit
\reviewdhcpsvc\AgentCommon.exe
Filesize
2.3MB

MD5
c12e4a53dc571ccce79abefd054c2424

SHA1
e673e215b3ac6d550ab8a10e4978f81494e50e81

SHA256
fa1cd5896935e6be20825665599a1bd7ea09c82830cd18c303c1fa38eefac315

SHA512
0a5e4b1a1c6964ae9538ca7139133e605d89ea9e501ef7642bf2dbf9bd39c798b6811c09016a525331e8ebffa9604b3e6e32bc82a150bcc8f40353170a9296ce

Download Submit
memory/1004-120-0x0000000002390000-0x0000000002410000-memory.dmp

Filesize
512KB

Download
memory/1004-121-0x00000000001F0000-0x0000000000202000-memory.dmp

Filesize
72KB

Download
memory/1004-119-0x0000000000C20000-0x0000000000E72000-memory.dmp

Filesize
2.3MB

Download
memory/1004-122-0x0000000002390000-0x0000000002410000-memory.dmp

Filesize
512KB

Download
memory/1040-75-0x0000000000C50000-0x0000000000CA6000-memory.dmp

Filesize
344KB

Download
memory/1040-80-0x0000000000B10000-0x0000000000B18000-memory.dmp

Filesize
32KB

Download
memory/1040-79-0x0000000000A80000-0x0000000000A88000-memory.dmp

Filesize
32KB

Download
memory/1040-78-0x0000000000A70000-0x0000000000A7E000-memory.dmp

Filesize
56KB

Download
memory/1040-77-0x000000001B050000-0x000000001B0D0000-memory.dmp

Filesize
512KB

Download
memory/1040-76-0x0000000000510000-0x0000000000522000-memory.dmp

Filesize
72KB

Download
memory/1040-74-0x00000000004F0000-0x0000000000506000-memory.dmp

Filesize
88KB

Download
memory/1040-73-0x0000000000240000-0x000000000025C000-memory.dmp

Filesize
112KB

Download
memory/1040-72-0x0000000001330000-0x0000000001582000-memory.dmp

Filesize
2.3MB

Download