dcrat | 6eb5421bfa171c080165a6fd4a5d87db8f3118cf95669036d273cb16f24d566d

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 07:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1c59cf5aa5dda77c64a7440aeb4f92d4.exe
Size 1.4MB
Sample240227-jh321acb5t
SHA256 6eb5421bfa171c080165a6fd4a5d87db8f3118cf95669036d273cb16f24d566d
MD5 1c59cf5aa5dda77c64a7440aeb4f92d4
SHA1 726fcee1a66aff290e4abbd6f4e5b68aadcb75b1
SHA512 d8784db6254d26f4a8d7fb767cd5eb9f00d2f2d731186f61c7b2a8b5e594a512092d519829d53e956cf28a1dde630ab5c4d9703f65e1cf7a1b3986f6eb2d5e73
SSDEEP 24576:u2G/nvxW3WieCnz6gT9JtaoCRkDuaDQ2BXXr8Rf:ubA3jnz3JuaMsnr8Z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	220	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4824	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3668	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3108	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3532	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3360	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4968	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3676	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	884	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3760	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2404	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	736	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1220	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3996	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1128	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3728	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4144	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3944	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3672	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4516	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3656	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4180	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1276	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3488	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3376	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4896	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4380	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3484	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3368	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5064	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4916	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4796	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4588	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	368	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	3032	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	3032	schtasks.exe	89

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023231-10.dat	dcrat
behavioral2/memory/4820-12-0x0000000000540000-0x0000000000666000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	1c59cf5aa5dda77c64a7440aeb4f92d4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	Sessionruntime.exe

Executes dropped EXE 2 IoCs

pid	Process
4820	Sessionruntime.exe
3516	sihost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Update\Install\{ACF4DFE6-B01C-48BC-BE56-4034216BC3BD}\OfficeClickToRun.exe	Sessionruntime.exe
File created	C:\Program Files (x86)\Windows Defender\fr-FR\csrss.exe	Sessionruntime.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\dwm.exe	Sessionruntime.exe
File created	C:\Program Files (x86)\Google\Update\Install\{ACF4DFE6-B01C-48BC-BE56-4034216BC3BD}\e6c9b481da804f	Sessionruntime.exe
File created	C:\Program Files (x86)\Windows Defender\fr-FR\886983d96e3d3e	Sessionruntime.exe
File created	C:\Program Files\Windows Media Player\e1ef82546f0b02	Sessionruntime.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\66fc9ff0ee96c2	Sessionruntime.exe
File created	C:\Program Files (x86)\Reference Assemblies\sihost.exe	Sessionruntime.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\6cb0b6c459d5d3	Sessionruntime.exe
File created	C:\Program Files (x86)\Windows Mail\spoolsv.exe	Sessionruntime.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\sihost.exe	Sessionruntime.exe
File created	C:\Program Files (x86)\Reference Assemblies\66fc9ff0ee96c2	Sessionruntime.exe
File created	C:\Program Files\Windows Media Player\SppExtComObj.exe	Sessionruntime.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\explorer.exe	Sessionruntime.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\7a0fd90576e088	Sessionruntime.exe
File created	C:\Program Files (x86)\Windows Mail\f3b6ecef712a24	Sessionruntime.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\sihost.exe	Sessionruntime.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\CbsTemp\StartMenuExperienceHost.exe	Sessionruntime.exe
File created	C:\Windows\CbsTemp\55b276f4edf653	Sessionruntime.exe
File created	C:\Windows\appcompat\encapsulation\taskhostw.exe	Sessionruntime.exe
File created	C:\Windows\appcompat\encapsulation\ea9f0e6c9e2dcd	Sessionruntime.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4780	schtasks.exe
2128	schtasks.exe
1876	schtasks.exe
1220	schtasks.exe
1128	schtasks.exe
4796	schtasks.exe
220	schtasks.exe
3532	schtasks.exe
3760	schtasks.exe
4648	schtasks.exe
3728	schtasks.exe
4144	schtasks.exe
4824	schtasks.exe
2544	schtasks.exe
4516	schtasks.exe
3668	schtasks.exe
1708	schtasks.exe
3488	schtasks.exe
368	schtasks.exe
4556	schtasks.exe
4380	schtasks.exe
1760	schtasks.exe
3484	schtasks.exe
4936	schtasks.exe
2584	schtasks.exe
2284	schtasks.exe
4588	schtasks.exe
4916	schtasks.exe
3676	schtasks.exe
4180	schtasks.exe
2140	schtasks.exe
3376	schtasks.exe
3360	schtasks.exe
3368	schtasks.exe
3108	schtasks.exe
2404	schtasks.exe
4896	schtasks.exe
1704	schtasks.exe
2216	schtasks.exe
4892	schtasks.exe
4968	schtasks.exe
736	schtasks.exe
3944	schtasks.exe
3672	schtasks.exe
1820	schtasks.exe
2800	schtasks.exe
3656	schtasks.exe
1276	schtasks.exe
2440	schtasks.exe
3996	schtasks.exe
640	schtasks.exe
2764	schtasks.exe
5064	schtasks.exe
884	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings	1c59cf5aa5dda77c64a7440aeb4f92d4.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4820	Sessionruntime.exe
4820	Sessionruntime.exe
4820	Sessionruntime.exe
3516	sihost.exe
3516	sihost.exe
3516	sihost.exe
3516	sihost.exe
3516	sihost.exe
3516	sihost.exe
3516	sihost.exe
3516	sihost.exe
3516	sihost.exe
3516	sihost.exe
3516	sihost.exe
3516	sihost.exe
3516	sihost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3516	sihost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4820	Sessionruntime.exe
Token: SeDebugPrivilege	3516	sihost.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 1048	3756	1c59cf5aa5dda77c64a7440aeb4f92d4.exe	84
PID 3756 wrote to memory of 1048	3756	1c59cf5aa5dda77c64a7440aeb4f92d4.exe	84
PID 3756 wrote to memory of 1048	3756	1c59cf5aa5dda77c64a7440aeb4f92d4.exe	84
PID 1048 wrote to memory of 540	1048	WScript.exe	86
PID 1048 wrote to memory of 540	1048	WScript.exe	86
PID 1048 wrote to memory of 540	1048	WScript.exe	86
PID 540 wrote to memory of 4820	540	cmd.exe	88
PID 540 wrote to memory of 4820	540	cmd.exe	88
PID 4820 wrote to memory of 3516	4820	Sessionruntime.exe	144
PID 4820 wrote to memory of 3516	4820	Sessionruntime.exe	144

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1c59cf5aa5dda77c64a7440aeb4f92d4.exe
"C:\Users\Admin\AppData\Local\Temp\1c59cf5aa5dda77c64a7440aeb4f92d4.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\MsCommonitorcommon\rpRldx8nMLSNUCPWCFYqEEN0rQ.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\MsCommonitorcommon\KH2WSOddxtlKKDn1sMng.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:540
  - - C:\MsCommonitorcommon\Sessionruntime.exe
      "C:\MsCommonitorcommon\Sessionruntime.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4820
    - - C:\Program Files\Microsoft Office 15\ClientX64\sihost.exe
        
        "C:\Program Files\Microsoft Office 15\ClientX64\sihost.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:3516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SessionruntimeS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\Sessionruntime.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Sessionruntime" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Sessionruntime.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SessionruntimeS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\Sessionruntime.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Reference Assemblies\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Reference Assemblies\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Media Player\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Windows\CbsTemp\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\CbsTemp\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Windows\CbsTemp\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\odt\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\odt\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\odt\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\odt\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Google\Update\Install\{ACF4DFE6-B01C-48BC-BE56-4034216BC3BD}\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\Install\{ACF4DFE6-B01C-48BC-BE56-4034216BC3BD}\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\Update\Install\{ACF4DFE6-B01C-48BC-BE56-4034216BC3BD}\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\MsCommonitorcommon\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\MsCommonitorcommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\MsCommonitorcommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Windows\appcompat\encapsulation\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\appcompat\encapsulation\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Windows\appcompat\encapsulation\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

KH2WSOddxtlKKDn1sMng.bat

Path C:\MsCommonitorcommon\KH2WSOddxtlKKDn1sMng.bat
Size 42B
SHA256 541604f2b60241a2dc6ae936f2d16affd402bf51a0e40d672d0e6a22287e04e1
MD5 3f7220bb7c8308bfc97f8f659d890c10
SHA1 0dd13f3e33089b41dc92ca0f400592402bd51726
SHA512 8ee0f0a3101bf4b928c0a1652250095770ef734de9b4520a56c0e30737affd5a3910c69fb01b9976f5e6e7272d889cc274e05adaf5ae77bd0b9f84a9940bc581
MD5 SHA1 SHA512

Submit Download

Sessionruntime.exe

Path C:\MsCommonitorcommon\Sessionruntime.exe
Size 1.1MB
SHA256 b0bdfbf0cb514ad80f214b7d68f316ef5d8625c9fc1bca452f3a3a310c93f275
MD5 cbbb4b59b1a2255960f0008d9318e174
SHA1 15ff3084a49b49cfabb412e41f6786bacd269afc
SHA512 f478f5e7f9a2ca2a3e6f94cc560ac1dbb84e612666305e40900d776ae54467e0d29e662c2b7dc2a4e0b9e29021bfd06b2203829b97fad92452acbb4e4a6dd758
SSDEEP 12288:3QC1zF6gT9VXaFxiYA+4KezyLyqohP8fhlHMUaHObWDVSbCZLQkZV7SIjXh1nVGR:Tz6gT9JtaoCRkDuaDQ2BXXr8R
MD5 SHA1 SHA512 SSDEEP

Submit Download

rpRldx8nMLSNUCPWCFYqEEN0rQ.vbe

Path C:\MsCommonitorcommon\rpRldx8nMLSNUCPWCFYqEEN0rQ.vbe
Size 215B
SHA256 3d1c10b6522b7404c5e27b8e427088ca5d809950bb1b853d60cdfc417bc550e1
MD5 f757f1e86fe16f3f5345ee872443656f
SHA1 7c79ea77a50c8c4080fda4596ea9b73fbb9c754a
SHA512 7382e90a4525a5b447b82567eba8535d027a7ffb2a0156ff4c69f1459d6cd46130d3b4c6334540f2f90be85024f99cd857735ee3782fdd6438c335059ea9999d
MD5 SHA1 SHA512

Submit Download

memory/3516-65-0x00007FFE7DD90000-0x00007FFE7E851000-memory.dmp

Download

memory/3516-106-0x00007FFE7DD90000-0x00007FFE7E851000-memory.dmp

Download

memory/3516-67-0x00000000026B0000-0x00000000026C0000-memory.dmp

Download

memory/4820-12-0x0000000000540000-0x0000000000666000-memory.dmp

Download

memory/4820-16-0x000000001B1F0000-0x000000001B240000-memory.dmp

Download

memory/4820-17-0x0000000000EF0000-0x0000000000F06000-memory.dmp

Download

memory/4820-15-0x0000000000ED0000-0x0000000000EEC000-memory.dmp

Download

memory/4820-66-0x00007FFE7DD90000-0x00007FFE7E851000-memory.dmp

Download

memory/4820-14-0x000000001B3E0000-0x000000001B3F0000-memory.dmp

Download

memory/4820-13-0x00007FFE7DD90000-0x00007FFE7E851000-memory.dmp

Download