dcrat | 07ef2eee7e56c2338327d52269e755e7dc2bc82e2fb8781de0c1ea7857003d49

Analysis

max time kernel
149s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/02/2024, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
08ef924d6dc6b7159cf34fb9db4cacac.exe
Size 1.1MB
Sample240205-cszzrsgdc2
SHA256 07ef2eee7e56c2338327d52269e755e7dc2bc82e2fb8781de0c1ea7857003d49
MD5 08ef924d6dc6b7159cf34fb9db4cacac
SHA1 ba2527b88a6b290c1c49649fa66aea144fffbe4d
SHA512 2e9952188a7215d71801785e119149d463238ee238d0327f13aa954ad3e3712583df1d0be2a6e4daa9271f522d6082ef3e45e30df919a387f7484ffe6779cf67
SSDEEP 24576:6T25fx6ZCxiXt5onpL1QkRdSAAS7HrU/:0kfbi0pb3pr2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1296	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	780	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1056	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1268	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1156	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1196	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1044	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	844	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1028	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	608	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	904	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	292	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1580	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2548	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	2680	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	2680	schtasks.exe	37

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/312-0-0x0000000000C50000-0x0000000000D76000-memory.dmp	dcrat
behavioral1/files/0x000b00000001223f-30.dat	dcrat
behavioral1/files/0x0035000000016ce0-48.dat	dcrat
behavioral1/files/0x000e000000016cea-64.dat	dcrat
behavioral1/memory/1620-67-0x000000001ACE0000-0x000000001AD60000-memory.dmp	dcrat
behavioral1/files/0x000500000001968d-134.dat	dcrat
behavioral1/memory/2104-136-0x0000000000E10000-0x0000000000F36000-memory.dmp	dcrat

Executes dropped EXE 2 IoCs

pid	Process
1620	08ef924d6dc6b7159cf34fb9db4cacac.exe
2104	lsm.exe

Drops file in Program Files directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\es-ES\audiodg.exe	08ef924d6dc6b7159cf34fb9db4cacac.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\27d1bcfc3c54e0	08ef924d6dc6b7159cf34fb9db4cacac.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\csrss.exe	08ef924d6dc6b7159cf34fb9db4cacac.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\886983d96e3d3e	08ef924d6dc6b7159cf34fb9db4cacac.exe
File created	C:\Program Files (x86)\Google\Temp\6cb0b6c459d5d3	08ef924d6dc6b7159cf34fb9db4cacac.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\es-ES\42af1c969fbb7b	08ef924d6dc6b7159cf34fb9db4cacac.exe
File opened for modification	C:\Program Files\Internet Explorer\smss.exe	08ef924d6dc6b7159cf34fb9db4cacac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\System.exe	08ef924d6dc6b7159cf34fb9db4cacac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\RCX2D69.tmp	08ef924d6dc6b7159cf34fb9db4cacac.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\modules\lsm.exe	08ef924d6dc6b7159cf34fb9db4cacac.exe
File created	C:\Program Files\Google\Chrome\27d1bcfc3c54e0	08ef924d6dc6b7159cf34fb9db4cacac.exe
File created	C:\Program Files\Internet Explorer\69ddcba757bf72	08ef924d6dc6b7159cf34fb9db4cacac.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\System.exe	08ef924d6dc6b7159cf34fb9db4cacac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\RCX2D6A.tmp	08ef924d6dc6b7159cf34fb9db4cacac.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\modules\lsm.exe	08ef924d6dc6b7159cf34fb9db4cacac.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\es-ES\audiodg.exe	08ef924d6dc6b7159cf34fb9db4cacac.exe
File opened for modification	C:\Program Files\Google\Chrome\System.exe	08ef924d6dc6b7159cf34fb9db4cacac.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\csrss.exe	08ef924d6dc6b7159cf34fb9db4cacac.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\dwm.exe	08ef924d6dc6b7159cf34fb9db4cacac.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\modules\101b941d020240	08ef924d6dc6b7159cf34fb9db4cacac.exe
File created	C:\Program Files\Google\Chrome\System.exe	08ef924d6dc6b7159cf34fb9db4cacac.exe
File created	C:\Program Files\Internet Explorer\smss.exe	08ef924d6dc6b7159cf34fb9db4cacac.exe
File created	C:\Program Files (x86)\Google\Temp\dwm.exe	08ef924d6dc6b7159cf34fb9db4cacac.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\taskhost.exe	08ef924d6dc6b7159cf34fb9db4cacac.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2784	schtasks.exe
2960	schtasks.exe
2676	schtasks.exe
780	schtasks.exe
3008	schtasks.exe
2740	schtasks.exe
2244	schtasks.exe
1868	schtasks.exe
1028	schtasks.exe
292	schtasks.exe
2756	schtasks.exe
2792	schtasks.exe
1156	schtasks.exe
2388	schtasks.exe
1580	schtasks.exe
1044	schtasks.exe
2524	schtasks.exe
844	schtasks.exe
2464	schtasks.exe
2360	schtasks.exe
2008	schtasks.exe
2652	schtasks.exe
608	schtasks.exe
904	schtasks.exe
2256	schtasks.exe
1652	schtasks.exe
2608	schtasks.exe
1608	schtasks.exe
1748	schtasks.exe
1048	schtasks.exe
1760	schtasks.exe
2588	schtasks.exe
2568	schtasks.exe
2292	schtasks.exe
1296	schtasks.exe
2736	schtasks.exe
2188	schtasks.exe
1716	schtasks.exe
2932	schtasks.exe
1268	schtasks.exe
2160	schtasks.exe
2500	schtasks.exe
1484	schtasks.exe
2016	schtasks.exe
2384	schtasks.exe
2760	schtasks.exe
2448	schtasks.exe
1660	schtasks.exe
2356	schtasks.exe
1056	schtasks.exe
1588	schtasks.exe
2548	schtasks.exe
2300	schtasks.exe
1196	schtasks.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
312	08ef924d6dc6b7159cf34fb9db4cacac.exe
312	08ef924d6dc6b7159cf34fb9db4cacac.exe
312	08ef924d6dc6b7159cf34fb9db4cacac.exe
312	08ef924d6dc6b7159cf34fb9db4cacac.exe
312	08ef924d6dc6b7159cf34fb9db4cacac.exe
1620	08ef924d6dc6b7159cf34fb9db4cacac.exe
1620	08ef924d6dc6b7159cf34fb9db4cacac.exe
1620	08ef924d6dc6b7159cf34fb9db4cacac.exe
1620	08ef924d6dc6b7159cf34fb9db4cacac.exe
1620	08ef924d6dc6b7159cf34fb9db4cacac.exe
1620	08ef924d6dc6b7159cf34fb9db4cacac.exe
1620	08ef924d6dc6b7159cf34fb9db4cacac.exe
2104	lsm.exe
2104	lsm.exe
2104	lsm.exe
2104	lsm.exe
2104	lsm.exe
2104	lsm.exe
2104	lsm.exe
2104	lsm.exe
2104	lsm.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2104	lsm.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	312	08ef924d6dc6b7159cf34fb9db4cacac.exe
Token: SeDebugPrivilege	1620	08ef924d6dc6b7159cf34fb9db4cacac.exe
Token: SeDebugPrivilege	2104	lsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 312 wrote to memory of 1620	312	08ef924d6dc6b7159cf34fb9db4cacac.exe	38
PID 312 wrote to memory of 1620	312	08ef924d6dc6b7159cf34fb9db4cacac.exe	38
PID 312 wrote to memory of 1620	312	08ef924d6dc6b7159cf34fb9db4cacac.exe	38
PID 1620 wrote to memory of 2104	1620	08ef924d6dc6b7159cf34fb9db4cacac.exe	84
PID 1620 wrote to memory of 2104	1620	08ef924d6dc6b7159cf34fb9db4cacac.exe	84
PID 1620 wrote to memory of 2104	1620	08ef924d6dc6b7159cf34fb9db4cacac.exe	84
PID 2104 wrote to memory of 2828	2104	lsm.exe	86
PID 2104 wrote to memory of 2828	2104	lsm.exe	86
PID 2104 wrote to memory of 2828	2104	lsm.exe	86
PID 2104 wrote to memory of 336	2104	lsm.exe	85
PID 2104 wrote to memory of 336	2104	lsm.exe	85
PID 2104 wrote to memory of 336	2104	lsm.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\08ef924d6dc6b7159cf34fb9db4cacac.exe
"C:\Users\Admin\AppData\Local\Temp\08ef924d6dc6b7159cf34fb9db4cacac.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:312
- C:\Users\Admin\AppData\Local\Temp\08ef924d6dc6b7159cf34fb9db4cacac.exe
  "C:\Users\Admin\AppData\Local\Temp\08ef924d6dc6b7159cf34fb9db4cacac.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Users\Admin\Music\lsm.exe
    "C:\Users\Admin\Music\lsm.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2104
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f4897b3c-8835-4e75-9e49-571d2821ba81.vbs"
      4⤵
      PID:336
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0accb1a3-e6d2-4c77-b5df-2c8b2ef82b95.vbs"
      4⤵
      PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Java\jdk1.7.0_80\jre\System.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Java\jdk1.7.0_80\jre\System.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Creates scheduled task(s)
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\lsm.exe'" /f
1⤵
- Creates scheduled task(s)
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Java\jdk1.7.0_80\jre\System.exe'" /f
1⤵
- Creates scheduled task(s)
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Program Files\VideoLAN\VLC\lua\intf\modules\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Recovery\463aa442-9b96-11ee-b087-e6b52eba4e86\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\463aa442-9b96-11ee-b087-e6b52eba4e86\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Recovery\463aa442-9b96-11ee-b087-e6b52eba4e86\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Program Files\VideoLAN\VLC\lua\intf\modules\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\lua\intf\modules\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\463aa442-9b96-11ee-b087-e6b52eba4e86\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Google\Chrome\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files\Internet Explorer\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files\Internet Explorer\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Google\Chrome\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Recovery\463aa442-9b96-11ee-b087-e6b52eba4e86\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Favorites\Links\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Admin\Favorites\Links\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\Temp\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\Temp\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Favorites\Links\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Recovery\463aa442-9b96-11ee-b087-e6b52eba4e86\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\Public\Pictures\Sample Pictures\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Pictures\Sample Pictures\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\es-ES\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Pictures\Sample Pictures\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Music\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "08ef924d6dc6b7159cf34fb9db4cacac0" /sc MINUTE /mo 5 /tr "'C:\Recovery\463aa442-9b96-11ee-b087-e6b52eba4e86\08ef924d6dc6b7159cf34fb9db4cacac.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "08ef924d6dc6b7159cf34fb9db4cacac" /sc ONLOGON /tr "'C:\Recovery\463aa442-9b96-11ee-b087-e6b52eba4e86\08ef924d6dc6b7159cf34fb9db4cacac.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "08ef924d6dc6b7159cf34fb9db4cacac0" /sc MINUTE /mo 11 /tr "'C:\Recovery\463aa442-9b96-11ee-b087-e6b52eba4e86\08ef924d6dc6b7159cf34fb9db4cacac.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\Device Stage\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Microsoft\Device Stage\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Microsoft\Device Stage\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\Admin\Music\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Music\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\es-ES\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\es-ES\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX2F6F.tmp

Path C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\RCX2F6F.tmp
Size 1.1MB
SHA256 a68d5d689ccc020d9638b482469f50d6e187615def2f75cdab1aef8f2bad379e
MD5 93827ff3805836fc40ac730860538748
SHA1 e7b0f7903651910174c5a903b19d3b1d12c6c4f7
SHA512 63108ead6a7f6510cb8f163d8c2e1499b6eda6c13e3cf0e31daea3374ecf7748cb40ee0fd4be4a5af2d7e1b25e7ddecada02068a3f577b4a3ee30a26d94f42a0
SSDEEP 24576:6T25fx6ZCxiXt5onpL1QkRdSAAS7HrU/:0kfbi0pb3pr2
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.exe

Path C:\Program Files\Java\jdk1.7.0_80\jre\System.exe
Size 512KB
SHA256 0d13d5a8b4c86cebd049b689909b43920d702804bc1e47c55d6f1ffd62b6bdb2
MD5 5673ffe2a42635d382f6cec63ddcf244
SHA1 a3cbd65391b3bea253f62508d29b7bbdb9d41180
SHA512 e1eee2b5ff34c9485b88820e96e7549f6adc276126610b60b87ed36f3ae803e30ca5075e9ee402b0ba326c492e42418a41f25c97aa0c07f38c4ab0758d4c47d2
SSDEEP 12288:6T2N78W8u1tF6RdHB8dxM0gbmCtlQ7bG9/3Vb:6T25fx6ZCxiXt5L
MD5 SHA1 SHA512 SSDEEP

Submit Download

08ef924d6dc6b7159cf34fb9db4cacac.exe

Path C:\Users\Admin\AppData\Local\Temp\08ef924d6dc6b7159cf34fb9db4cacac.exe
Size 1.1MB
SHA256 07ef2eee7e56c2338327d52269e755e7dc2bc82e2fb8781de0c1ea7857003d49
MD5 08ef924d6dc6b7159cf34fb9db4cacac
SHA1 ba2527b88a6b290c1c49649fa66aea144fffbe4d
SHA512 2e9952188a7215d71801785e119149d463238ee238d0327f13aa954ad3e3712583df1d0be2a6e4daa9271f522d6082ef3e45e30df919a387f7484ffe6779cf67
SSDEEP 24576:6T25fx6ZCxiXt5onpL1QkRdSAAS7HrU/:0kfbi0pb3pr2
MD5 SHA1 SHA512 SSDEEP

Submit Download

0accb1a3-e6d2-4c77-b5df-2c8b2ef82b95.vbs

Path C:\Users\Admin\AppData\Local\Temp\0accb1a3-e6d2-4c77-b5df-2c8b2ef82b95.vbs
Size 704B
SHA256 c37df2ee155a26efa1ee2c34a9a84c14bdbaed4e51265342ca89ed6eb4c7f4fc
MD5 09d70a5051592cb496eeacc210093605
SHA1 249ac4fb02516de28c01fd878749f79b5c41419b
SHA512 ff6875b0e399bcbf0a9eb708a14512711ee679c0d185da378e3b4797e30731b449d797bbbd1076ac71441dd4bad09d2d5eb6fa7dd1c9091003f8627577159343
MD5 SHA1 SHA512

Submit Download

f4897b3c-8835-4e75-9e49-571d2821ba81.vbs

Path C:\Users\Admin\AppData\Local\Temp\f4897b3c-8835-4e75-9e49-571d2821ba81.vbs
Size 480B
SHA256 ce2c9208c6fccd36cb7268a2e1b41a0aab7864d0bc5a604108ff1fc6adbdfc44
MD5 7437a68f5c2712f6170a844745246cb7
SHA1 79b85e0f8f6922bf79c8be7a85067c647fc90ce6
SHA512 17f78cbb97221dc1df23d9a460d6705cfeeee65fa3eb5389839c187cb07060d47506fc7158a87eb902f25e2d3cd7fc5c884d329c352c158c7c9ff7bba5d7a070
MD5 SHA1 SHA512

Submit Download

lsm.exe

Path C:\Users\Admin\Music\lsm.exe
Size 847KB
SHA256 99c86f8aa732f95aaf3f30400c310e884cb011795768c1dbd90d27cb34cea02c
MD5 9e4960333c2dfab5df63a7ca8e835d8e
SHA1 09ba9430ae881f6fb558638f252eec31d5933d7f
SHA512 88c162fb82af0dc553bf4ac516ed284be5fb93b694488eacf645f44358dbfa5bc3a03bde3ee82a1646bff0d197084b93ea59dc6c06a55e036190541e09fee257
SSDEEP 12288:6T2N78W8u1tF6RdHB8dxM0gbmCtlQ7bG9/3VYVdc/YaNpPga1uhLFU9sQkQF0ddY:6T25fx6ZCxiXt5onpL1QkRd+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/312-9-0x00000000004D0000-0x00000000004DC000-memory.dmp

Download

memory/312-4-0x0000000000370000-0x0000000000378000-memory.dmp

Download

memory/312-0-0x0000000000C50000-0x0000000000D76000-memory.dmp

Download

memory/312-15-0x0000000000C20000-0x0000000000C2E000-memory.dmp

Download

memory/312-16-0x0000000000C40000-0x0000000000C4C000-memory.dmp

Download

memory/312-14-0x0000000000C30000-0x0000000000C3A000-memory.dmp

Download

memory/312-13-0x0000000000B90000-0x0000000000B98000-memory.dmp

Download

memory/312-12-0x0000000000B80000-0x0000000000B88000-memory.dmp

Download

memory/312-11-0x0000000000B70000-0x0000000000B7C000-memory.dmp

Download

memory/312-8-0x0000000000440000-0x0000000000448000-memory.dmp

Download

memory/312-3-0x0000000000150000-0x000000000016C000-memory.dmp

Download

memory/312-6-0x0000000000390000-0x00000000003A6000-memory.dmp

Download

memory/312-7-0x00000000003B0000-0x00000000003BC000-memory.dmp

Download

memory/312-10-0x00000000004E0000-0x00000000004F2000-memory.dmp

Download

memory/312-66-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Download

memory/312-1-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Download

memory/312-2-0x000000001B060000-0x000000001B0E0000-memory.dmp

Download

memory/312-5-0x0000000000380000-0x0000000000390000-memory.dmp

Download

memory/1620-68-0x0000000000C00000-0x0000000000C12000-memory.dmp

Download

memory/1620-135-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Download

memory/1620-65-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Download

memory/1620-67-0x000000001ACE0000-0x000000001AD60000-memory.dmp

Download

memory/2104-137-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Download

memory/2104-136-0x0000000000E10000-0x0000000000F36000-memory.dmp

Download

memory/2104-138-0x000000001B250000-0x000000001B2D0000-memory.dmp

Download

memory/2104-139-0x0000000000C20000-0x0000000000C32000-memory.dmp

Download

memory/2104-149-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Download

memory/2104-150-0x000000001B250000-0x000000001B2D0000-memory.dmp

Download