dcrat | 4faac7b368c5b46e3a5cc10300e9be5ad85463c29a8d38025c8ec386ed06a9de

Analysis

max time kernel
151s
max time network
160s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/01/2024, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a19d22a2f5989d2e2dc98bb62bfcf9fb.exe
Size 43.9MB
Sample240130-mxtzesede5
SHA256 4faac7b368c5b46e3a5cc10300e9be5ad85463c29a8d38025c8ec386ed06a9de
MD5 a19d22a2f5989d2e2dc98bb62bfcf9fb
SHA1 b8f39041eb1e294b4952197a06d33e8bf885714f
SHA512 553b0365c7eeadc7c38617c865f8845f0d9a7af65f675544e350743327eb81788e36b47d6a5eb44ba353f5db922e867fe3624278e522a6cdc98f9d4cacb782c0
SSDEEP 786432:yLEB9kPgvPAK9UGJ7dcsfh3n9dCmBSIARXSK6dZPpj4HabgRVUv+oIr7IPaDm0zY:EE/ko19UeWsfh3n9lGRCK0h8HygAvjIq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	772	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1148	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	688	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	936	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1380	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1836	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	888	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1228	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2100	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1192	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1408	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1352	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	896	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	852	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1260	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	752	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1568	1796	schtasks.exe	38
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	364	1796	schtasks.exe	38

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000a000000012247-3.dat	dcrat
behavioral1/files/0x000700000001602a-25.dat	dcrat
behavioral1/memory/2616-28-0x00000000003C0000-0x0000000000496000-memory.dmp	dcrat
behavioral1/memory/2920-161-0x0000000000CF0000-0x0000000000DC6000-memory.dmp	dcrat
behavioral1/memory/2920-163-0x000000001B040000-0x000000001B0C0000-memory.dmp	dcrat

Executes dropped EXE 5 IoCs

pid	Process
3068	MinerBot.exe
2684	MineBot3.exe
2616	OneDriveLog.exe
2864	MineBot3.exe
2920	wininit.exe

Loads dropped DLL 7 IoCs

pid	Process
2256	a19d22a2f5989d2e2dc98bb62bfcf9fb.exe
2256	a19d22a2f5989d2e2dc98bb62bfcf9fb.exe
2772	Process not Found
2744	cmd.exe
2744	cmd.exe
2684	MineBot3.exe
2864	MineBot3.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	pastebin.com
5	pastebin.com

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Windows NT\Accessories\audiodg.exe	OneDriveLog.exe
File created	C:\Program Files\Windows NT\Accessories\42af1c969fbb7b	OneDriveLog.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\System.exe	OneDriveLog.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\27d1bcfc3c54e0	OneDriveLog.exe
File created	C:\Program Files\DVD Maker\it-IT\audiodg.exe	OneDriveLog.exe
File created	C:\Program Files\DVD Maker\it-IT\42af1c969fbb7b	OneDriveLog.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ModemLogs\conhost.exe	OneDriveLog.exe
File created	C:\Windows\ModemLogs\088424020bedd6	OneDriveLog.exe
File created	C:\Windows\inf\Idle.exe	OneDriveLog.exe
File created	C:\Windows\inf\6ccacd8608530f	OneDriveLog.exe
File created	C:\Windows\ModemLogs\conhost.exe	OneDriveLog.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3036	schtasks.exe
772	schtasks.exe
1148	schtasks.exe
1380	schtasks.exe
2312	schtasks.exe
2496	schtasks.exe
1508	schtasks.exe
756	schtasks.exe
2172	schtasks.exe
936	schtasks.exe
1820	schtasks.exe
896	schtasks.exe
1568	schtasks.exe
1836	schtasks.exe
1228	schtasks.exe
2960	schtasks.exe
2768	schtasks.exe
888	schtasks.exe
2736	schtasks.exe
752	schtasks.exe
2240	schtasks.exe
2204	schtasks.exe
2600	schtasks.exe
1012	schtasks.exe
1192	schtasks.exe
2776	schtasks.exe
2524	schtasks.exe
1664	schtasks.exe
688	schtasks.exe
3028	schtasks.exe
1956	schtasks.exe
2352	schtasks.exe
2344	schtasks.exe
2236	schtasks.exe
3012	schtasks.exe
2788	schtasks.exe
1352	schtasks.exe
2976	schtasks.exe
1260	schtasks.exe
2508	schtasks.exe
2728	schtasks.exe
2824	schtasks.exe
364	schtasks.exe
1676	schtasks.exe
1536	schtasks.exe
1640	schtasks.exe
2416	schtasks.exe
852	schtasks.exe
2624	schtasks.exe
1944	schtasks.exe
1104	schtasks.exe
2100	schtasks.exe
1408	schtasks.exe
2836	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2616	OneDriveLog.exe
2616	OneDriveLog.exe
2616	OneDriveLog.exe
2616	OneDriveLog.exe
2616	OneDriveLog.exe
2616	OneDriveLog.exe
2616	OneDriveLog.exe
2616	OneDriveLog.exe
2616	OneDriveLog.exe
2616	OneDriveLog.exe
2616	OneDriveLog.exe
2616	OneDriveLog.exe
2616	OneDriveLog.exe
2616	OneDriveLog.exe
2616	OneDriveLog.exe
2616	OneDriveLog.exe
2616	OneDriveLog.exe
2920	wininit.exe
2920	wininit.exe
2920	wininit.exe
2920	wininit.exe
2920	wininit.exe
2920	wininit.exe
2920	wininit.exe
2920	wininit.exe
2920	wininit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2920	wininit.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2616	OneDriveLog.exe
Token: SeDebugPrivilege	2920	wininit.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 3068	2256	a19d22a2f5989d2e2dc98bb62bfcf9fb.exe	28
PID 2256 wrote to memory of 3068	2256	a19d22a2f5989d2e2dc98bb62bfcf9fb.exe	28
PID 2256 wrote to memory of 3068	2256	a19d22a2f5989d2e2dc98bb62bfcf9fb.exe	28
PID 2256 wrote to memory of 3068	2256	a19d22a2f5989d2e2dc98bb62bfcf9fb.exe	28
PID 2256 wrote to memory of 2684	2256	a19d22a2f5989d2e2dc98bb62bfcf9fb.exe	29
PID 2256 wrote to memory of 2684	2256	a19d22a2f5989d2e2dc98bb62bfcf9fb.exe	29
PID 2256 wrote to memory of 2684	2256	a19d22a2f5989d2e2dc98bb62bfcf9fb.exe	29
PID 2256 wrote to memory of 2684	2256	a19d22a2f5989d2e2dc98bb62bfcf9fb.exe	29
PID 3068 wrote to memory of 2700	3068	MinerBot.exe	30
PID 3068 wrote to memory of 2700	3068	MinerBot.exe	30
PID 3068 wrote to memory of 2700	3068	MinerBot.exe	30
PID 3068 wrote to memory of 2700	3068	MinerBot.exe	30
PID 2700 wrote to memory of 2744	2700	WScript.exe	33
PID 2700 wrote to memory of 2744	2700	WScript.exe	33
PID 2700 wrote to memory of 2744	2700	WScript.exe	33
PID 2700 wrote to memory of 2744	2700	WScript.exe	33
PID 2744 wrote to memory of 2616	2744	cmd.exe	34
PID 2744 wrote to memory of 2616	2744	cmd.exe	34
PID 2744 wrote to memory of 2616	2744	cmd.exe	34
PID 2744 wrote to memory of 2616	2744	cmd.exe	34
PID 2684 wrote to memory of 2864	2684	MineBot3.exe	36
PID 2684 wrote to memory of 2864	2684	MineBot3.exe	36
PID 2684 wrote to memory of 2864	2684	MineBot3.exe	36
PID 2616 wrote to memory of 1512	2616	OneDriveLog.exe	93
PID 2616 wrote to memory of 1512	2616	OneDriveLog.exe	93
PID 2616 wrote to memory of 1512	2616	OneDriveLog.exe	93
PID 1512 wrote to memory of 2436	1512	cmd.exe	95
PID 1512 wrote to memory of 2436	1512	cmd.exe	95
PID 1512 wrote to memory of 2436	1512	cmd.exe	95
PID 1512 wrote to memory of 2920	1512	cmd.exe	96
PID 1512 wrote to memory of 2920	1512	cmd.exe	96
PID 1512 wrote to memory of 2920	1512	cmd.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a19d22a2f5989d2e2dc98bb62bfcf9fb.exe
"C:\Users\Admin\AppData\Local\Temp\a19d22a2f5989d2e2dc98bb62bfcf9fb.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\MinerBot.exe
  "C:\Users\Admin\AppData\Local\Temp\MinerBot.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\OneDriveTemp\0PcTrXAlD3jypOm6ldYXDSJa4eNj.vbe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\OneDriveTemp\o4YCgrcPxm6nWGgTLNljTukjVfZEoa.bat" "
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2744
    - - C:\OneDriveTemp\OneDriveLog.exe
        
        "C:\OneDriveTemp\OneDriveLog.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2616
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\q4Cr32Gle0.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1512
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2436
        
        C:\Users\All Users\wininit.exe
        
        "C:\Users\All Users\wininit.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:2920
- C:\Users\Admin\AppData\Local\Temp\MineBot3.exe
  "C:\Users\Admin\AppData\Local\Temp\MineBot3.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Users\Admin\AppData\Local\Temp\onefile_2684_133510855086468000\MineBot3.exe
    "C:\Users\Admin\AppData\Local\Temp\MineBot3.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Windows\ModemLogs\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\ModemLogs\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Windows\ModemLogs\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MineBot3M" /sc MINUTE /mo 5 /tr "'C:\Recovery\7156ad82-9b8d-11ee-a45c-bce704e297ea\MineBot3.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MineBot3" /sc ONLOGON /tr "'C:\Recovery\7156ad82-9b8d-11ee-a45c-bce704e297ea\MineBot3.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MineBot3M" /sc MINUTE /mo 7 /tr "'C:\Recovery\7156ad82-9b8d-11ee-a45c-bce704e297ea\MineBot3.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows NT\Accessories\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows NT\Accessories\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Users\Default\NetHood\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Default\NetHood\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Users\Default\NetHood\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\OneDriveTemp\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\OneDriveTemp\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\OneDriveTemp\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Recovery\7156ad82-9b8d-11ee-a45c-bce704e297ea\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\7156ad82-9b8d-11ee-a45c-bce704e297ea\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Recovery\7156ad82-9b8d-11ee-a45c-bce704e297ea\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Program Files\DVD Maker\it-IT\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\DVD Maker\it-IT\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Program Files\DVD Maker\it-IT\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\All Users\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MineBot3M" /sc MINUTE /mo 12 /tr "'C:\Recovery\7156ad82-9b8d-11ee-a45c-bce704e297ea\MineBot3.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MineBot3" /sc ONLOGON /tr "'C:\Recovery\7156ad82-9b8d-11ee-a45c-bce704e297ea\MineBot3.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MineBot3M" /sc MINUTE /mo 12 /tr "'C:\Recovery\7156ad82-9b8d-11ee-a45c-bce704e297ea\MineBot3.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Admin\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Windows\inf\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\inf\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Windows\inf\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0PcTrXAlD3jypOm6ldYXDSJa4eNj.vbe

Path C:\OneDriveTemp\0PcTrXAlD3jypOm6ldYXDSJa4eNj.vbe
Size 219B
SHA256 79a3d650f34f3234d94f37cb23ffd9bca863425dda71bf963631e096c19fb174
MD5 75bdf40cdcf8dfbf3329c3b0110a2328
SHA1 f40c69d2361e91b48fac0d735e35891a1672c45e
SHA512 7deea3e8427abd463b91b7dde9c490507c588c785af4ddfed5b3a4796a053e6d2e9d68388696adb20dce6ca8c776fe08564424405f3a91f5da145127d72e17a3
MD5 SHA1 SHA512

Submit Download

OneDriveLog.exe

Path C:\OneDriveTemp\OneDriveLog.exe
Size 827KB
SHA256 9ace8ea40d1fc5da2ad3e67f505d7f979b37361c5b26063b046f66494c4c2c86
MD5 e346e79487c81c66925dc1d757aa694b
SHA1 8a33b240b0c6221c67447c1ec7774c89379345ac
SHA512 181c0095b65c79ce4bc4941ff01ad4e48bf2546b8b024300cda643d8b8c796b87062f467151059135478191926317a1f83b5f0ff132f9d85391ec88a5ebf402d
SSDEEP 12288:NeAL6oznJG+1QjNSKVKofpg7DqHsYv004MsGqGDAr6+/jSSw:Tn0+1i5VKofpcqf004xr6aw
MD5 SHA1 SHA512 SSDEEP

Submit Download

o4YCgrcPxm6nWGgTLNljTukjVfZEoa.bat

Path C:\OneDriveTemp\o4YCgrcPxm6nWGgTLNljTukjVfZEoa.bat
Size 33B
SHA256 51e888338c9770af37062c9c0ad4bd8064d339ed45fa898edc0b1f6cd25da21c
MD5 ec67fd4c0945d111932499961d629e3b
SHA1 01ddb1ced9cb65a2b1cb4afe4d1ef16f86e26783
SHA512 785d08fec99a7b0ff90dd4c050c8297838beb6071a6b84519e38fc35805feee9eddd4222637c3d52b94908d096ff1012dd95329fa8755a5ae4053546c0193902
MD5 SHA1 SHA512

Submit Download

Cab42DC.tmp

Path C:\Users\Admin\AppData\Local\Temp\Cab42DC.tmp
Size 65KB
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
MD5 SHA1 SHA512 SSDEEP

Submit Download

MineBot3.exe

Path C:\Users\Admin\AppData\Local\Temp\MineBot3.exe
Size 18.4MB
SHA256 08f41082914388107039741e9f15dc1eba9b19a26fdb65cc931179f152125729
MD5 e55f3d9a47feb1fa2b4952031a0b349f
SHA1 1f22a93f6a8a3d9b290ad8ec4361e7e5c4dcae4b
SHA512 a65771df5c8c5c76ac31c6aca1d1da6fc017aaec8134541f77359493a0fe558ebf6a711b2280d8c553a54513a5b9ab7e859b6de4edbb6c1ea2e15cdde6b0e5a3
SSDEEP 393216:wKUaE/2dPRfTFmqY5CdiaVQPfOw2zs6kQ50YV:g5/wFTFQQgV2jky0c
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar435C.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar435C.tmp
Size 171KB
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
SSDEEP 1536:+AuJ+lCUs0RvWqgCyPW5BXNWdm1wpyru2/3EwjYoz0VDTrubmt6mJp:+9J+q0RuXCyfdmAyru2/RAKtgp
MD5 SHA1 SHA512 SSDEEP

Submit Download

MineBot3.exe

Path C:\Users\Admin\AppData\Local\Temp\onefile_2684_133510855086468000\MineBot3.exe
Size 4.0MB
SHA256 4d82f6bb3c27f4bc1afd840a5156758a79476f7af88d86eb1ce678baea9fcd74
MD5 d8d53d40ddb469f8adf3655fc340c7d3
SHA1 195b62fba2884929c2859f88279db41f10f69e50
SHA512 e55d4fab1c96513a67d719b7c50b6614f412b3dc2c9e6eadb6f2553f2d32793d428d39bff036ecc9cb076b1bf661eada294eb6bf4365f558e4e0e78dab34808d
SSDEEP 49152:0hQz4/8agNN4IRH1FTsT7l553bh/yjJ60vGFGbDphx7u:eWBD+8Ju
MD5 SHA1 SHA512 SSDEEP

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2684_133510855086468000\python310.dll
Size 3.2MB
SHA256 c16f301e3136e9ccdcee17f1e698344a49b0edbc4c612c5df617ce19fa919223
MD5 258c468d36a03c274732cd6625d700e2
SHA1 3bf2ba8ff6a4c5c3898d9f50556dab3f188b8f49
SHA512 249d1599474c029b2fbe232db653648d740d3a8f2b23672786f555440d786c4d317b14ac2ed3bda1beb98fcb7c4186416e3d15a73f7b9a7be3a048231e7de0fc
SSDEEP 49152:myrXfGIy+Bqk5c5Ad2nwZT3Q6wsV136cR2DZvbK30xLNZcAgVBvcpYcvl1IDWbHX:Uw5tVBlicWdvoDkHUMF7Pn
MD5 SHA1 SHA512 SSDEEP

Submit Download

q4Cr32Gle0.bat

Path C:\Users\Admin\AppData\Local\Temp\q4Cr32Gle0.bat
Size 195B
SHA256 bfa5f30cec31d78e798fc92c204829f830016b41135b4f9833d50ac6fd0286ce
MD5 d856fd3a897d0ab81b1f54fe3de72986
SHA1 618d32de28cfed55f8fff06a62a80774bcdb4eda
SHA512 d3257f56a83e63d5196808e11f4baec0afec31e994637ff6acd768ac0de103f4cca5992c6e9fe76ff454c428f5a5560c111e442aa1046dc9c6b2aae48335afe7
MD5 SHA1 SHA512

Submit Download

MineBot3.exe

Path \Users\Admin\AppData\Local\Temp\MineBot3.exe
Size 6.5MB
SHA256 d242005f692d2c0467049259e423a531f975b848a02d3cbbbed00b98af959f67
MD5 b966d0361e937288064796b0fb906f11
SHA1 972aede2105a45acc9fe5a1c31301f8700e52419
SHA512 3bbcb69b16ed0f243767c86ca8fbb56b6b41bef2f305c78c38cb8b43e9ab19e1007eb2ddcf154fc712a1833a9a7542c5bb9ca4ed78327aa2a034765dd93b2cba
SSDEEP 98304:a//FwsMmX+diwCpEEM+UMx7JVlAMDV1GwWsu8Jph65iJnt5EPthviuj:a3Fwzi7aE/UmlLii2PV
MD5 SHA1 SHA512 SSDEEP

Submit Download

MineBot3.exe

Path \Users\Admin\AppData\Local\Temp\MineBot3.exe
Size 12.8MB
SHA256 51b8eb35510a761a30979535bd295e58ed61e06e66df95e98263f6c79cc2a985
MD5 1d22cb711a2d99d69f485d3d6e5c82ba
SHA1 b283c69c23c0b797e4308c6f95c003c766b42e25
SHA512 d5e5c5548e84e7216b4e2b19254e2e18838bc4afc21bf3735c3599a81ec767dba4b98ff04361aa98cfdc0a9d2f86617b3761321bd303fddc68fb71002c5747fa
SSDEEP 196608:a3Fwzi7aE/UmlLii2PRfTE6sFQWz1Lm+4VXG8eQI9f4diaVE+:wKUaE/2dPRfTFmqY5CdiaX
MD5 SHA1 SHA512 SSDEEP

Submit Download

MinerBot.exe

Path \Users\Admin\AppData\Local\Temp\MinerBot.exe
Size 1.1MB
SHA256 76772befea48f9929e6f02059e7c3fa0f8e98580bc8f6f8cc168aadb3bc46f90
MD5 de2267227bfc881ae3a8390abe2938ca
SHA1 cf969d2ab211496fc1efcd7b8c1ebc13cf3a4acb
SHA512 b5151e425c409f0b5faf9da25332da72883c9fdcaaeff9f8c990d97387364aa270a703ea355244c9ea8009824713c54273ead7ff24545a10a9ed2c62f48d32d4
SSDEEP 24576:E2G/nvxW3WQH2n0+1i5VKofpcqf004xr6awX:EbA3PoC501B4
MD5 SHA1 SHA512 SSDEEP

Submit Download

MineBot3.exe

Path \Users\Admin\AppData\Local\Temp\onefile_2684_133510855086468000\MineBot3.exe
Size 768KB
SHA256 653cbec223234d0691c2e26b129bb5d88769e373d9f765db3ee86af0758e0884
MD5 d973c3c4ce50ba8a56917f0ae7163d41
SHA1 c21357c3221ee627f015ba15befbf09c13621b16
SHA512 8daa4c7d5e54b55f22afb259e9b6e05a321edc19a596ad402297ccd0b3bf99a56909c9efd6cba416f184f10f25265e97c257e27ce663b9700c0e7d6c9a842854
SSDEEP 6144:wGX+ogDFxH9+M9PtrN3RKzLJPjOzLUwKdEjlB06s:B+oeGwr5QzJazLULaL06s
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2616-76-0x000000001AFA0000-0x000000001B020000-memory.dmp

Download

memory/2616-158-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

Download

memory/2616-45-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

Download

memory/2616-28-0x00000000003C0000-0x0000000000496000-memory.dmp

Download

memory/2920-161-0x0000000000CF0000-0x0000000000DC6000-memory.dmp

Download

memory/2920-162-0x000007FEF4A70000-0x000007FEF545C000-memory.dmp

Download

memory/2920-163-0x000000001B040000-0x000000001B0C0000-memory.dmp

Download

memory/2920-198-0x000007FEF4A70000-0x000007FEF545C000-memory.dmp

Download

memory/2920-199-0x000000001B040000-0x000000001B0C0000-memory.dmp

Download