dcrat | 2f9bf1b8e047c1fa8ec80deccb3e9b575aaf5247f23c0fea81157b8b995562c9

Analysis

max time kernel
153s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2f9bf1b8e047c1fa8ec80deccb3e9b575aaf5247f23c0fea81157b8b995562c9.exe
Size 1.5MB
Sample240112-266rxagda4
SHA256 2f9bf1b8e047c1fa8ec80deccb3e9b575aaf5247f23c0fea81157b8b995562c9
MD5 c44819eb2ff2ffd7f9bf6163d5994a99
SHA1 1af74ac1121a7704c69c934035f68df1d9205576
SHA512 0ad8b5afd6482327feba6a79cd5a7bfbbbc40bc7888783e757c5b3d4b6a9db4e2f1b6f108351b2d3390028e767e3e5fb7ac6354c0a9f66553e37d13741bb4420
SSDEEP 24576:d2G/nvxW3W9hIWg69UY2cJLejOLGz3lVPde0Aj2CQrOyRgwpqhrVcyXSIhQ:dbA3G33sRCvyRg5qt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3244	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3328	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4632	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4516	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3312	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3584	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	628	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3308	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4372	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4376	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4816	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4128	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3520	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3184	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	828	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3748	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3104	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4044	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5032	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4492	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4840	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4356	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1128	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3580	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3640	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4452	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	3592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	3592	schtasks.exe	97

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000900000002301f-10.dat	dcrat
behavioral2/memory/3148-12-0x0000000000010000-0x0000000000144000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	2f9bf1b8e047c1fa8ec80deccb3e9b575aaf5247f23c0fea81157b8b995562c9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	chainPerfDll.exe

Executes dropped EXE 2 IoCs

pid	Process
3148	chainPerfDll.exe
1484	winlogon.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\ModifiableWindowsApps\SppExtComObj.exe	chainPerfDll.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\fontdrvhost.exe	chainPerfDll.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\5b884080fd4f94	chainPerfDll.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\Saved Games\5940a34987c991	chainPerfDll.exe
File created	C:\Windows\rescache\_merged\1973483750\csrss.exe	chainPerfDll.exe
File created	C:\Windows\Boot\Misc\PCAT\SppExtComObj.exe	chainPerfDll.exe
File created	C:\Windows\OCR\en-us\SppExtComObj.exe	chainPerfDll.exe
File created	C:\Windows\ServiceProfiles\LocalService\Saved Games\dllhost.exe	chainPerfDll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2768	schtasks.exe
3312	schtasks.exe
5032	schtasks.exe
4492	schtasks.exe
4840	schtasks.exe
4452	schtasks.exe
1976	schtasks.exe
4632	schtasks.exe
2600	schtasks.exe
2988	schtasks.exe
2644	schtasks.exe
628	schtasks.exe
4128	schtasks.exe
1128	schtasks.exe
3104	schtasks.exe
1928	schtasks.exe
3580	schtasks.exe
2300	schtasks.exe
4516	schtasks.exe
4372	schtasks.exe
4376	schtasks.exe
828	schtasks.exe
2512	schtasks.exe
2980	schtasks.exe
3184	schtasks.exe
4764	schtasks.exe
3584	schtasks.exe
1884	schtasks.exe
3308	schtasks.exe
4816	schtasks.exe
3244	schtasks.exe
3520	schtasks.exe
3640	schtasks.exe
2484	schtasks.exe
3748	schtasks.exe
4044	schtasks.exe
4356	schtasks.exe
3328	schtasks.exe
1564	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings	2f9bf1b8e047c1fa8ec80deccb3e9b575aaf5247f23c0fea81157b8b995562c9.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings	chainPerfDll.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3148	chainPerfDll.exe
3148	chainPerfDll.exe
3148	chainPerfDll.exe
3148	chainPerfDll.exe
3148	chainPerfDll.exe
3148	chainPerfDll.exe
3148	chainPerfDll.exe
3148	chainPerfDll.exe
1484	winlogon.exe
1484	winlogon.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3148	chainPerfDll.exe
Token: SeDebugPrivilege	1484	winlogon.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 4220	2000	2f9bf1b8e047c1fa8ec80deccb3e9b575aaf5247f23c0fea81157b8b995562c9.exe	92
PID 2000 wrote to memory of 4220	2000	2f9bf1b8e047c1fa8ec80deccb3e9b575aaf5247f23c0fea81157b8b995562c9.exe	92
PID 2000 wrote to memory of 4220	2000	2f9bf1b8e047c1fa8ec80deccb3e9b575aaf5247f23c0fea81157b8b995562c9.exe	92
PID 4220 wrote to memory of 1416	4220	WScript.exe	99
PID 4220 wrote to memory of 1416	4220	WScript.exe	99
PID 4220 wrote to memory of 1416	4220	WScript.exe	99
PID 1416 wrote to memory of 3148	1416	cmd.exe	101
PID 1416 wrote to memory of 3148	1416	cmd.exe	101
PID 3148 wrote to memory of 3708	3148	chainPerfDll.exe	143
PID 3148 wrote to memory of 3708	3148	chainPerfDll.exe	143
PID 3708 wrote to memory of 3968	3708	cmd.exe	145
PID 3708 wrote to memory of 3968	3708	cmd.exe	145
PID 3708 wrote to memory of 1484	3708	cmd.exe	146
PID 3708 wrote to memory of 1484	3708	cmd.exe	146

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2f9bf1b8e047c1fa8ec80deccb3e9b575aaf5247f23c0fea81157b8b995562c9.exe
"C:\Users\Admin\AppData\Local\Temp\2f9bf1b8e047c1fa8ec80deccb3e9b575aaf5247f23c0fea81157b8b995562c9.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\comRefNetCommonsvc\8MgiEWoxbbYDSMA1DFyZ.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\comRefNetCommonsvc\QGIh2QXQ99ka6NL.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1416
  - - C:\comRefNetCommonsvc\chainPerfDll.exe
      "C:\comRefNetCommonsvc\chainPerfDll.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3148
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\P9q91965Gg.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3708
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3968
      - C:\odt\winlogon.exe
        
        "C:\odt\winlogon.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\odt\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\odt\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\odt\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chainPerfDllc" /sc MINUTE /mo 11 /tr "'C:\odt\chainPerfDll.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chainPerfDll" /sc ONLOGON /tr "'C:\odt\chainPerfDll.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chainPerfDllc" /sc MINUTE /mo 10 /tr "'C:\odt\chainPerfDll.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\ServiceProfiles\LocalService\Saved Games\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\LocalService\Saved Games\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\ServiceProfiles\LocalService\Saved Games\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\comRefNetCommonsvc\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\comRefNetCommonsvc\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\comRefNetCommonsvc\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\comRefNetCommonsvc\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\comRefNetCommonsvc\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\comRefNetCommonsvc\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\comRefNetCommonsvc\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\comRefNetCommonsvc\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\comRefNetCommonsvc\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

P9q91965Gg.bat

Path C:\Users\Admin\AppData\Local\Temp\P9q91965Gg.bat
Size 184B
SHA256 d3d2d536c2671950e533ec06c1b19fa455b76d51ab446e2931026229b6e68a3e
MD5 4fb43eb7075ffaf687054083e48d78cc
SHA1 c9185bf5f3e9144536f97795f0a7f8d8e7fcbb56
SHA512 0e4122cbf600532493d581f8908c1a1a3ebe25859c63fa8071aa7e14bf47f6648e394d417ce34c9a644a51e36383734727f955da965067b90e8a7960a49bcc52
MD5 SHA1 SHA512

Submit Download

8MgiEWoxbbYDSMA1DFyZ.vbe

Path C:\comRefNetCommonsvc\8MgiEWoxbbYDSMA1DFyZ.vbe
Size 210B
SHA256 ad8055cfb3e110b7b7227c9db5071559f8b8e5d4fa8cf05892ddc3f7a45551bc
MD5 9dac29d31af393491b90673d79ff8a4b
SHA1 05b71211575fc4861dd075b11da6bd87f62f4554
SHA512 2bff06e8702ff5ceaf401fa46644df737b55ff898db0005380f370a04ba0bd2c32fbf6f6227b9937ef6202070d3995d4a78774211c73b8c1ac2f9859e8279fcb
MD5 SHA1 SHA512

Submit Download

QGIh2QXQ99ka6NL.bat

Path C:\comRefNetCommonsvc\QGIh2QXQ99ka6NL.bat
Size 40B
SHA256 7a61441e265ab1772ffe1e87c7002aa1f4533313c1383905fe8d1508b2d14ed8
MD5 f3be4b07d4624cfa5a444497e00c14d2
SHA1 3edb26d22f70e32f95d506528d682de73cf0b8cf
SHA512 182e0e08d93a1ca74524d4a1bb38ab7824115293e5fc168f6337daefc107a0835c925ea6c47ac29446539212ee270838399d6a6106f641555377c457cd0fee12
MD5 SHA1 SHA512

Submit Download

chainPerfDll.exe

Path C:\comRefNetCommonsvc\chainPerfDll.exe
Size 1.2MB
SHA256 55db61ef4e149769a22b6eadd09776016263884c5fb26fc5949fad81cce7960b
MD5 7f0a2572a0910b3f9e08175f93ebfe22
SHA1 c62ed7ea6d001dcac8b6fdcd65b00708c6c4fbbe
SHA512 e758ac2cf3072e5e6906883a908f1b6fbfb62e05e8a9639e6bdcd18183ef15a1989c4e12a9ad33ac82f59c05333d49c84b95ab731699660fe41c2b0fc580750f
SSDEEP 24576:d69UY2cJLejOLGz3lVPde0Aj2CQrOyRgwpqhrVcyXSIh:W3sRCvyRg5q
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1484-58-0x00007FFC38060000-0x00007FFC38B21000-memory.dmp

Download

memory/1484-56-0x000000001AE60000-0x000000001AE70000-memory.dmp

Download

memory/1484-55-0x00007FFC38060000-0x00007FFC38B21000-memory.dmp

Download

memory/3148-15-0x0000000002260000-0x000000000227C000-memory.dmp

Download

memory/3148-17-0x0000000002290000-0x00000000022A6000-memory.dmp

Download

memory/3148-18-0x00000000022B0000-0x00000000022BC000-memory.dmp

Download

memory/3148-50-0x00007FFC38060000-0x00007FFC38B21000-memory.dmp

Download

memory/3148-16-0x00000000022E0000-0x0000000002330000-memory.dmp

Download

memory/3148-14-0x000000001AF50000-0x000000001AF60000-memory.dmp

Download

memory/3148-13-0x00007FFC38060000-0x00007FFC38B21000-memory.dmp

Download

memory/3148-12-0x0000000000010000-0x0000000000144000-memory.dmp

Download