dcrat | e4ae89fae552ad33c4e25a0feb8f8547254f27c197e51c183ee16edae898f6c8

Analysis

max time kernel
146s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2023, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2e8356dfe51bd0a98aadcbd170a6d777.exe
Size 1.2MB
Sample231205-b47cjsgh63
SHA256 e4ae89fae552ad33c4e25a0feb8f8547254f27c197e51c183ee16edae898f6c8
MD5 2e8356dfe51bd0a98aadcbd170a6d777
SHA1 4bd29d52517f4b14433ca5e911e277123968dbfb
SHA512 2615a8c39079d57e70dcae1c0f180e4a6d292348c28d8c094f9b1312bfbd74f02e40bada740faadd563c061067f99dde00de32d71d261b1424ed1ef8ce0926ef
SSDEEP 24576:N3sTOPjpOgaRtddWpNs1e9fvz+iPRdz5nk86:OTScbRcp1nl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4740	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3336	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3820	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4120	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3356	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4244	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3896	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4916	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1788	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4272	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4876	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3460	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3300	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1204	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1192	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3316	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5036	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3124	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	3132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4856	3132	schtasks.exe	86

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/744-0-0x0000000000AE0000-0x0000000000C1E000-memory.dmp	dcrat
behavioral2/files/0x000600000002321b-16.dat	dcrat
behavioral2/files/0x0006000000023226-40.dat	dcrat
behavioral2/files/0x0006000000023226-41.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000\Control Panel\International\Geo\Nation	2e8356dfe51bd0a98aadcbd170a6d777.exe

Executes dropped EXE 1 IoCs

pid	Process
4536	OfficeClickToRun.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files\Windows NT\Accessories\en-US\29c1c3cc0f7685	2e8356dfe51bd0a98aadcbd170a6d777.exe
File created	C:\Program Files\Microsoft Office 15\eddb19405b7ce1	2e8356dfe51bd0a98aadcbd170a6d777.exe
File created	C:\Program Files\dotnet\host\fxr\8.0.0\5940a34987c991	2e8356dfe51bd0a98aadcbd170a6d777.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\Registry.exe	2e8356dfe51bd0a98aadcbd170a6d777.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\ee2ad38f3d4382	2e8356dfe51bd0a98aadcbd170a6d777.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\eddb19405b7ce1	2e8356dfe51bd0a98aadcbd170a6d777.exe
File created	C:\Program Files\Windows NT\Accessories\en-US\unsecapp.exe	2e8356dfe51bd0a98aadcbd170a6d777.exe
File created	C:\Program Files\Common Files\System\de-DE\69ddcba757bf72	2e8356dfe51bd0a98aadcbd170a6d777.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\backgroundTaskHost.exe	2e8356dfe51bd0a98aadcbd170a6d777.exe
File created	C:\Program Files\Microsoft Office 15\backgroundTaskHost.exe	2e8356dfe51bd0a98aadcbd170a6d777.exe
File created	C:\Program Files\dotnet\host\fxr\8.0.0\dllhost.exe	2e8356dfe51bd0a98aadcbd170a6d777.exe
File created	C:\Program Files\Common Files\System\de-DE\smss.exe	2e8356dfe51bd0a98aadcbd170a6d777.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SKB\LanguageModels\csrss.exe	2e8356dfe51bd0a98aadcbd170a6d777.exe
File created	C:\Windows\SKB\LanguageModels\886983d96e3d3e	2e8356dfe51bd0a98aadcbd170a6d777.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4916	schtasks.exe
2672	schtasks.exe
3316	schtasks.exe
4856	schtasks.exe
1432	schtasks.exe
4244	schtasks.exe
3300	schtasks.exe
2184	schtasks.exe
4620	schtasks.exe
4652	schtasks.exe
4120	schtasks.exe
2792	schtasks.exe
4740	schtasks.exe
2112	schtasks.exe
5036	schtasks.exe
548	schtasks.exe
1788	schtasks.exe
3820	schtasks.exe
2720	schtasks.exe
3460	schtasks.exe
1204	schtasks.exe
1192	schtasks.exe
2684	schtasks.exe
3336	schtasks.exe
4272	schtasks.exe
4876	schtasks.exe
2892	schtasks.exe
3124	schtasks.exe
5040	schtasks.exe
4996	schtasks.exe
1948	schtasks.exe
3896	schtasks.exe
5044	schtasks.exe
3356	schtasks.exe
2248	schtasks.exe
2728	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000_Classes\Local Settings	2e8356dfe51bd0a98aadcbd170a6d777.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
744	2e8356dfe51bd0a98aadcbd170a6d777.exe
744	2e8356dfe51bd0a98aadcbd170a6d777.exe
744	2e8356dfe51bd0a98aadcbd170a6d777.exe
744	2e8356dfe51bd0a98aadcbd170a6d777.exe
744	2e8356dfe51bd0a98aadcbd170a6d777.exe
744	2e8356dfe51bd0a98aadcbd170a6d777.exe
744	2e8356dfe51bd0a98aadcbd170a6d777.exe
744	2e8356dfe51bd0a98aadcbd170a6d777.exe
744	2e8356dfe51bd0a98aadcbd170a6d777.exe
744	2e8356dfe51bd0a98aadcbd170a6d777.exe
744	2e8356dfe51bd0a98aadcbd170a6d777.exe
744	2e8356dfe51bd0a98aadcbd170a6d777.exe
744	2e8356dfe51bd0a98aadcbd170a6d777.exe
744	2e8356dfe51bd0a98aadcbd170a6d777.exe
744	2e8356dfe51bd0a98aadcbd170a6d777.exe
744	2e8356dfe51bd0a98aadcbd170a6d777.exe
744	2e8356dfe51bd0a98aadcbd170a6d777.exe
744	2e8356dfe51bd0a98aadcbd170a6d777.exe
744	2e8356dfe51bd0a98aadcbd170a6d777.exe
744	2e8356dfe51bd0a98aadcbd170a6d777.exe
744	2e8356dfe51bd0a98aadcbd170a6d777.exe
744	2e8356dfe51bd0a98aadcbd170a6d777.exe
4536	OfficeClickToRun.exe
4536	OfficeClickToRun.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	744	2e8356dfe51bd0a98aadcbd170a6d777.exe
Token: SeDebugPrivilege	4536	OfficeClickToRun.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 3980	744	2e8356dfe51bd0a98aadcbd170a6d777.exe	123
PID 744 wrote to memory of 3980	744	2e8356dfe51bd0a98aadcbd170a6d777.exe	123
PID 3980 wrote to memory of 3028	3980	cmd.exe	125
PID 3980 wrote to memory of 3028	3980	cmd.exe	125
PID 3980 wrote to memory of 4536	3980	cmd.exe	136
PID 3980 wrote to memory of 4536	3980	cmd.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2e8356dfe51bd0a98aadcbd170a6d777.exe
"C:\Users\Admin\AppData\Local\Temp\2e8356dfe51bd0a98aadcbd170a6d777.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZCVaPxKZPC.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3028
- - C:\Recovery\WindowsRE\OfficeClickToRun.exe
    "C:\Recovery\WindowsRE\OfficeClickToRun.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\odt\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\odt\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\odt\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\en-US\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\Accessories\en-US\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\en-US\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows NT\Accessories\en-US\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office 15\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office 15\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files\dotnet\host\fxr\8.0.0\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\dotnet\host\fxr\8.0.0\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files\dotnet\host\fxr\8.0.0\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\SKB\LanguageModels\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\SKB\LanguageModels\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\SKB\LanguageModels\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files\Common Files\System\de-DE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Common Files\System\de-DE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Program Files\Common Files\System\de-DE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

unsecapp.exe

Path C:\Program Files\Windows NT\Accessories\en-US\unsecapp.exe
Size 1.2MB
SHA256 e4ae89fae552ad33c4e25a0feb8f8547254f27c197e51c183ee16edae898f6c8
MD5 2e8356dfe51bd0a98aadcbd170a6d777
SHA1 4bd29d52517f4b14433ca5e911e277123968dbfb
SHA512 2615a8c39079d57e70dcae1c0f180e4a6d292348c28d8c094f9b1312bfbd74f02e40bada740faadd563c061067f99dde00de32d71d261b1424ed1ef8ce0926ef
SSDEEP 24576:N3sTOPjpOgaRtddWpNs1e9fvz+iPRdz5nk86:OTScbRcp1nl
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeClickToRun.exe

Path C:\Recovery\WindowsRE\OfficeClickToRun.exe
Size 1.2MB
SHA256 e4ae89fae552ad33c4e25a0feb8f8547254f27c197e51c183ee16edae898f6c8
MD5 2e8356dfe51bd0a98aadcbd170a6d777
SHA1 4bd29d52517f4b14433ca5e911e277123968dbfb
SHA512 2615a8c39079d57e70dcae1c0f180e4a6d292348c28d8c094f9b1312bfbd74f02e40bada740faadd563c061067f99dde00de32d71d261b1424ed1ef8ce0926ef
SSDEEP 24576:N3sTOPjpOgaRtddWpNs1e9fvz+iPRdz5nk86:OTScbRcp1nl
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeClickToRun.exe

Path C:\Recovery\WindowsRE\OfficeClickToRun.exe
Size 1.2MB
SHA256 e4ae89fae552ad33c4e25a0feb8f8547254f27c197e51c183ee16edae898f6c8
MD5 2e8356dfe51bd0a98aadcbd170a6d777
SHA1 4bd29d52517f4b14433ca5e911e277123968dbfb
SHA512 2615a8c39079d57e70dcae1c0f180e4a6d292348c28d8c094f9b1312bfbd74f02e40bada740faadd563c061067f99dde00de32d71d261b1424ed1ef8ce0926ef
SSDEEP 24576:N3sTOPjpOgaRtddWpNs1e9fvz+iPRdz5nk86:OTScbRcp1nl
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZCVaPxKZPC.bat

Path C:\Users\Admin\AppData\Local\Temp\ZCVaPxKZPC.bat
Size 207B
SHA256 b9039277b24a810b5caa84fa6ef3223f4359757aef5aaf93ea9494712ccce61f
MD5 977648c1c38ca58116c2b79ea14b5ac5
SHA1 17508e628b95f27aaa659bb574bbaef15461e9db
SHA512 4d0046fb37122580640608e0964c8d4dd2984148040b57b9f32a8ce410531b35cfbd8e1f73f04a09b085ad11902712b95710f5cc8b252f92bcbb68a1daf0de8f
MD5 SHA1 SHA512

Submit Download

memory/744-1-0x00007FFD4FF50000-0x00007FFD50A11000-memory.dmp

Download

memory/744-3-0x00000000013E0000-0x00000000013FC000-memory.dmp

Download

memory/744-4-0x000000001B7B0000-0x000000001B800000-memory.dmp

Download

memory/744-7-0x000000001C5F0000-0x000000001CB18000-memory.dmp

Download

memory/744-2-0x000000001BA50000-0x000000001BA60000-memory.dmp

Download

memory/744-37-0x00007FFD4FF50000-0x00007FFD50A11000-memory.dmp

Download

memory/744-5-0x0000000002E00000-0x0000000002E16000-memory.dmp

Download

memory/744-0-0x0000000000AE0000-0x0000000000C1E000-memory.dmp

Download

memory/744-6-0x0000000002E20000-0x0000000002E32000-memory.dmp

Download

memory/4536-42-0x00007FFD4EDC0000-0x00007FFD4F881000-memory.dmp

Download

memory/4536-43-0x000000001B750000-0x000000001B760000-memory.dmp

Download

memory/4536-44-0x0000000002C00000-0x0000000002C12000-memory.dmp

Download

memory/4536-45-0x00007FFD4EDC0000-0x00007FFD4F881000-memory.dmp

Download

memory/4536-46-0x000000001B750000-0x000000001B760000-memory.dmp

Download

memory/4536-48-0x00007FFD4EDC0000-0x00007FFD4F881000-memory.dmp

Download