dcrat | 1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee

General

Target

1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Size

2.0MB
MD5

1b4f235c3e17aaf137d6b7f9b2c52edc
SHA1

045ce4c79fa77bcd0224e40b44156536b8f92f4b
SHA256

1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee
SHA512

3c52f5af66758465842be11cc2e3760963c3cfbf660ddab1cf70a8d0d99a6a4458f7acdf6da5622c7fb1d80b5fd7345f5aca36c0a9dd9bae0d4ad79f59f8a1c7
SSDEEP

24576:kn2XTCHM4xT9V3XzsHhVmatCELYIXVelAtgbHHd:SaTUv0jmtEttc

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat 45 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
4588	schtasks.exe
3204	schtasks.exe
1172	schtasks.exe
2024	schtasks.exe
764	schtasks.exe
1140	schtasks.exe
2680	schtasks.exe
3520	schtasks.exe
2896	schtasks.exe
1512	schtasks.exe
2232	schtasks.exe
5032	schtasks.exe
4824	schtasks.exe
5088	schtasks.exe
2196	schtasks.exe
316	schtasks.exe
2124	schtasks.exe
4596	schtasks.exe
3920	schtasks.exe
1188	schtasks.exe
4652	schtasks.exe
4488	schtasks.exe
2432	schtasks.exe
3148	schtasks.exe
3944	schtasks.exe
3104	schtasks.exe
2912	schtasks.exe
4184	schtasks.exe
5008	schtasks.exe
4976	schtasks.exe
5096	schtasks.exe
4448	schtasks.exe
3156	schtasks.exe
2180	schtasks.exe
3080	schtasks.exe
1348	schtasks.exe
1932	schtasks.exe
3136	schtasks.exe
3420	schtasks.exe
2244	schtasks.exe
860	schtasks.exe
3116	schtasks.exe
3540	schtasks.exe
4040	schtasks.exe
4544	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 15 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Windows\\security\\explorer.exe\", \"C:\\Users\\Public\\Pictures\\OfficeClickToRun.exe\", \"C:\\Windows\\SystemApps\\Microsoft.AccountsControl_cw5n1h2txyewy\\pris\\sppsvc.exe\", \"C:\\Windows\\Migration\\WTR\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Users\\Admin\\My Documents\\WmiPrvSE.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\Program Files\\Microsoft Office 15\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Windows\\Downloaded Program Files\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Windows Mail\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Windows\\security\\explorer.exe\", \"C:\\Users\\Public\\Pictures\\OfficeClickToRun.exe\", \"C:\\Windows\\SystemApps\\Microsoft.AccountsControl_cw5n1h2txyewy\\pris\\sppsvc.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Windows\\security\\explorer.exe\", \"C:\\Users\\Public\\Pictures\\OfficeClickToRun.exe\", \"C:\\Windows\\SystemApps\\Microsoft.AccountsControl_cw5n1h2txyewy\\pris\\sppsvc.exe\", \"C:\\Windows\\Migration\\WTR\\fontdrvhost.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Windows\\security\\explorer.exe\", \"C:\\Users\\Public\\Pictures\\OfficeClickToRun.exe\", \"C:\\Windows\\SystemApps\\Microsoft.AccountsControl_cw5n1h2txyewy\\pris\\sppsvc.exe\", \"C:\\Windows\\Migration\\WTR\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Windows\\security\\explorer.exe\", \"C:\\Users\\Public\\Pictures\\OfficeClickToRun.exe\", \"C:\\Windows\\SystemApps\\Microsoft.AccountsControl_cw5n1h2txyewy\\pris\\sppsvc.exe\", \"C:\\Windows\\Migration\\WTR\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Users\\Admin\\My Documents\\WmiPrvSE.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Windows\\security\\explorer.exe\", \"C:\\Users\\Public\\Pictures\\OfficeClickToRun.exe\", \"C:\\Windows\\SystemApps\\Microsoft.AccountsControl_cw5n1h2txyewy\\pris\\sppsvc.exe\", \"C:\\Windows\\Migration\\WTR\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Users\\Admin\\My Documents\\WmiPrvSE.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\Program Files\\Microsoft Office 15\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Windows\\Downloaded Program Files\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Windows\\security\\explorer.exe\", \"C:\\Users\\Public\\Pictures\\OfficeClickToRun.exe\", \"C:\\Windows\\SystemApps\\Microsoft.AccountsControl_cw5n1h2txyewy\\pris\\sppsvc.exe\", \"C:\\Windows\\Migration\\WTR\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Users\\Admin\\My Documents\\WmiPrvSE.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\Program Files\\Microsoft Office 15\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Windows\\Downloaded Program Files\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Windows Mail\\SearchApp.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Windows\\security\\explorer.exe\", \"C:\\Users\\Public\\Pictures\\OfficeClickToRun.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Windows\\security\\explorer.exe\", \"C:\\Users\\Public\\Pictures\\OfficeClickToRun.exe\", \"C:\\Windows\\SystemApps\\Microsoft.AccountsControl_cw5n1h2txyewy\\pris\\sppsvc.exe\", \"C:\\Windows\\Migration\\WTR\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Users\\Admin\\My Documents\\WmiPrvSE.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Windows\\security\\explorer.exe\", \"C:\\Users\\Public\\Pictures\\OfficeClickToRun.exe\", \"C:\\Windows\\SystemApps\\Microsoft.AccountsControl_cw5n1h2txyewy\\pris\\sppsvc.exe\", \"C:\\Windows\\Migration\\WTR\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Users\\Admin\\My Documents\\WmiPrvSE.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\Program Files\\Microsoft Office 15\\Registry.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Windows\\security\\explorer.exe\", \"C:\\Users\\Public\\Pictures\\OfficeClickToRun.exe\", \"C:\\Windows\\SystemApps\\Microsoft.AccountsControl_cw5n1h2txyewy\\pris\\sppsvc.exe\", \"C:\\Windows\\Migration\\WTR\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Users\\Admin\\My Documents\\WmiPrvSE.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\Program Files\\Microsoft Office 15\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Windows\\security\\explorer.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Windows\\security\\explorer.exe\", \"C:\\Users\\Public\\Pictures\\OfficeClickToRun.exe\", \"C:\\Windows\\SystemApps\\Microsoft.AccountsControl_cw5n1h2txyewy\\pris\\sppsvc.exe\", \"C:\\Windows\\Migration\\WTR\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Users\\Admin\\My Documents\\WmiPrvSE.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\Program Files\\Microsoft Office 15\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Windows\\Downloaded Program Files\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\backgroundTaskHost.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Windows\\security\\explorer.exe\", \"C:\\Users\\Public\\Pictures\\OfficeClickToRun.exe\", \"C:\\Windows\\SystemApps\\Microsoft.AccountsControl_cw5n1h2txyewy\\pris\\sppsvc.exe\", \"C:\\Windows\\Migration\\WTR\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\", \"C:\\Users\\Admin\\My Documents\\WmiPrvSE.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\Program Files\\Microsoft Office 15\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Windows\\Downloaded Program Files\\RuntimeBroker.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3104	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1512	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5088	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3540	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4184	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4588	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4824	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4040	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4544	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3920	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3136	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5032	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3116	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3520	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3204	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3420	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	764	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1188	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3148	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	316	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3944	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4448	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3156	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3080	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	860	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4976	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5096	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1348	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	3820	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1172	3820	schtasks.exe

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral2/memory/3992-0-0x0000000000670000-0x000000000087C000-memory.dmp	dcrat
C:\Windows\Migration\WTR\fontdrvhost.exe	dcrat
C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\pris\sppsvc.exe	dcrat
C:\Recovery\WindowsRE\fontdrvhost.exe	dcrat
C:\Program Files (x86)\Windows Multimedia Platform\backgroundTaskHost.exe	dcrat
C:\Recovery\WindowsRE\sihost.exe	dcrat
behavioral2/memory/4484-283-0x0000000000430000-0x000000000063C000-memory.dmp	dcrat

Detects executables containing bas64 encoded gzip files 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3992-0-0x0000000000670000-0x000000000087C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
C:\Windows\Migration\WTR\fontdrvhost.exe	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\pris\sppsvc.exe	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
C:\Recovery\WindowsRE\fontdrvhost.exe	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
C:\Program Files (x86)\Windows Multimedia Platform\backgroundTaskHost.exe	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
C:\Recovery\WindowsRE\sihost.exe	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
behavioral2/memory/4484-283-0x0000000000430000-0x000000000063C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File

Detects executables packed with SmartAssembly 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3992-6-0x000000001B3A0000-0x000000001B3B0000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3992-11-0x000000001B5A0000-0x000000001B5AC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3992-14-0x000000001B5D0000-0x000000001B5DA000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe

Executes dropped EXE 1 IoCs

Processes:

backgroundTaskHost.exe

pid process

4484 backgroundTaskHost.exe

pid	process
4484	backgroundTaskHost.exe

Adds Run key to start application 2 TTPs 30 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\security\\explorer.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Program Files\\Microsoft Office 15\\Registry.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\Downloaded Program Files\\RuntimeBroker.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\security\\explorer.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\SystemApps\\Microsoft.AccountsControl_cw5n1h2txyewy\\pris\\sppsvc.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Users\\Public\\Pictures\\OfficeClickToRun.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Users\\Public\\Pictures\\OfficeClickToRun.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\SystemApps\\Microsoft.AccountsControl_cw5n1h2txyewy\\pris\\sppsvc.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Users\\Admin\\My Documents\\WmiPrvSE.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Program Files (x86)\\Windows Mail\\SearchApp.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Recovery\\WindowsRE\\sihost.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\WindowsRE\\wininit.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\Migration\\WTR\\fontdrvhost.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\backgroundTaskHost.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Recovery\\WindowsRE\\sihost.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Program Files\\Microsoft Office 15\\Registry.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\Migration\\WTR\\fontdrvhost.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\RuntimeBroker.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\Downloaded Program Files\\RuntimeBroker.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Program Files (x86)\\Windows Mail\\SearchApp.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\WindowsRE\\wininit.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Users\\Admin\\My Documents\\WmiPrvSE.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\backgroundTaskHost.exe\""	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe

Drops file in Program Files directory 25 IoCs

Processes:

1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\RCX489F.tmp	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\RCX5908.tmp	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCX5B0E.tmp	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File opened for modification	C:\Program Files\Microsoft Office 15\Registry.exe	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File created	C:\Program Files\Microsoft Office 15\ee2ad38f3d4382	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\RCX489E.tmp	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\backgroundTaskHost.exe	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCX5B0D.tmp	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\03f474c94aa989	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File created	C:\Program Files (x86)\Windows Mail\SearchApp.exe	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\SearchApp.exe	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\9e8d7a4ca61bd9	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File created	C:\Program Files\Microsoft Office 15\Registry.exe	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\RCX5666.tmp	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\RCX5667.tmp	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File opened for modification	C:\Program Files\Microsoft Office 15\RCX4F4B.tmp	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File opened for modification	C:\Program Files\Microsoft Office 15\RCX4F4C.tmp	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\eddb19405b7ce1	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File created	C:\Program Files (x86)\Windows Mail\38384e6a620884	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\backgroundTaskHost.exe	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\RCX588A.tmp	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe

Drops file in Windows directory 20 IoCs

Processes:

1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe

description	ioc	process
File opened for modification	C:\Windows\security\explorer.exe	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\pris\RCX43F7.tmp	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\pris\sppsvc.exe	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File opened for modification	C:\Windows\Migration\WTR\RCX460C.tmp	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File opened for modification	C:\Windows\Migration\WTR\RCX460D.tmp	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File created	C:\Windows\security\explorer.exe	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File created	C:\Windows\Downloaded Program Files\9e8d7a4ca61bd9	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File opened for modification	C:\Windows\security\RCX3F4F.tmp	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File opened for modification	C:\Windows\Downloaded Program Files\RuntimeBroker.exe	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File created	C:\Windows\security\7a0fd90576e088	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File opened for modification	C:\Windows\security\RCX3F50.tmp	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File opened for modification	C:\Windows\Migration\WTR\fontdrvhost.exe	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File opened for modification	C:\Windows\Downloaded Program Files\RCX53E3.tmp	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File created	C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\pris\sppsvc.exe	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File created	C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\pris\0a1fd5f707cd16	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\pris\RCX4379.tmp	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File opened for modification	C:\Windows\Downloaded Program Files\RCX53E4.tmp	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File created	C:\Windows\Migration\WTR\fontdrvhost.exe	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File created	C:\Windows\Migration\WTR\5b884080fd4f94	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
File created	C:\Windows\Downloaded Program Files\RuntimeBroker.exe	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
4488	schtasks.exe
2896	schtasks.exe
5088	schtasks.exe
4040	schtasks.exe
3136	schtasks.exe
1140	schtasks.exe
4652	schtasks.exe
4448	schtasks.exe
3080	schtasks.exe
860	schtasks.exe
1932	schtasks.exe
2432	schtasks.exe
3420	schtasks.exe
2196	schtasks.exe
3204	schtasks.exe
3148	schtasks.exe
2912	schtasks.exe
3540	schtasks.exe
5008	schtasks.exe
3116	schtasks.exe
1348	schtasks.exe
4184	schtasks.exe
4824	schtasks.exe
3920	schtasks.exe
3156	schtasks.exe
2124	schtasks.exe
1512	schtasks.exe
2232	schtasks.exe
5032	schtasks.exe
1188	schtasks.exe
316	schtasks.exe
2180	schtasks.exe
2680	schtasks.exe
4976	schtasks.exe
4544	schtasks.exe
3520	schtasks.exe
764	schtasks.exe
5096	schtasks.exe
2244	schtasks.exe
1172	schtasks.exe
3104	schtasks.exe
4588	schtasks.exe
4596	schtasks.exe
2024	schtasks.exe
3944	schtasks.exe

Modifies registry class 1 IoCs

Processes:

1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exebackgroundTaskHost.exe

pid	process
3992	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
3992	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
3992	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
3992	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
3992	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
3992	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
3992	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
3992	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
3992	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
3992	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
4484	backgroundTaskHost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exebackgroundTaskHost.exe

description	pid	process
Token: SeDebugPrivilege	3992	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
Token: SeDebugPrivilege	4484	backgroundTaskHost.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe

description	pid	process	target process
PID 3992 wrote to memory of 4484	3992	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe	backgroundTaskHost.exe
PID 3992 wrote to memory of 4484	3992	1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe	backgroundTaskHost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe
"C:\Users\Admin\AppData\Local\Temp\1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3992

C:\Program Files (x86)\Windows Multimedia Platform\backgroundTaskHost.exe
"C:\Program Files (x86)\Windows Multimedia Platform\backgroundTaskHost.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Windows\security\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\security\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Windows\security\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Pictures\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Public\Pictures\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Pictures\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\pris\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\pris\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\pris\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Windows\Migration\WTR\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Windows\Migration\WTR\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\My Documents\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Admin\My Documents\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\My Documents\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office 15\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office 15\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\Downloaded Program Files\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Downloaded Program Files\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Windows\Downloaded Program Files\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee1" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee1" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Mail\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1172

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

Scheduled Task/Job

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Multimedia Platform\backgroundTaskHost.exe
Filesize
2.0MB

MD5
7303426ffee1ba56604466586413d313

SHA1
8366768ea69ca763c63a0d1876ceded959e97410

SHA256
f56382afefe83b71f7e2ec1d4750a120390264fa0ef150420232880fbbc8b5e2

SHA512
a9366eb8b0d58d4b163eb206f256203b805f8790900fb00aad81eab92dfa1c8eed1ea87f4663a3869632f0b492f43551a6d63b4e82e7a91988af2141f6bd9169

Download Submit
C:\Recovery\WindowsRE\fontdrvhost.exe
Filesize
2.0MB

MD5
018d6b44ed74b074e1ae75e61141c111

SHA1
6130c664275c31429a8ec4e64abb64599eb6a944

SHA256
2ea60eb19024ac584f75f1d355538a79dd548a0a70e654cdd48b3c4aae42235e

SHA512
f5488e89eea05fb2d384a244a6117a31909d58be368159ebd0b37198d70119c1c01f96eebb4da9adc5924652c778681da96f2111d346f77aa3e50fa1823ae45c

Download Submit
C:\Recovery\WindowsRE\sihost.exe
Filesize
2.0MB

MD5
b6bfa31615828698c28e0b411391df81

SHA1
97f9381ac150135a2a96eae212bde14b3ba6ef04

SHA256
626fac4203f6eacb617da4486f90ed6573ed26893a62a60a98d2b5c2e0e8f4bc

SHA512
9cd584611082c69172db61c2fb5fbe597afa9bb71b2037a3cc53eb69603a27a6c59eeb87d3c5e56fa63e105ba3817102dce57e82fda63ac965c71d931e238199

Download Submit
C:\Windows\Migration\WTR\fontdrvhost.exe
Filesize
2.0MB

MD5
1b4f235c3e17aaf137d6b7f9b2c52edc

SHA1
045ce4c79fa77bcd0224e40b44156536b8f92f4b

SHA256
1c2f57889f877f43050288b06f044339713ed427a6ec909ab57330203cb905ee

SHA512
3c52f5af66758465842be11cc2e3760963c3cfbf660ddab1cf70a8d0d99a6a4458f7acdf6da5622c7fb1d80b5fd7345f5aca36c0a9dd9bae0d4ad79f59f8a1c7

Download Submit
C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\pris\sppsvc.exe
Filesize
2.0MB

MD5
327e8fe24e66252153fb45e39cf5ef7e

SHA1
9b875f8a880d23c4bcca770580b16da444b4a479

SHA256
c2d1c126157ae09c8fba9624f0c752198fcb52aa04e808917ff30917dd6d7647

SHA512
eae231c284d675f78b5260db82cdae46a90da5768e2cb5126036fedd4b08b2710860ebac9df961ca0fc37c1f3f7a91af78a32a42748cf08bf11edad7bf572441

Download Submit
memory/3992-6-0x000000001B3A0000-0x000000001B3B0000-memory.dmp

Filesize
64KB

Download
memory/3992-4-0x000000001B530000-0x000000001B580000-memory.dmp

Filesize
320KB

Download
memory/3992-7-0x000000001B3B0000-0x000000001B3C6000-memory.dmp

Filesize
88KB

Download
memory/3992-8-0x000000001B3D0000-0x000000001B426000-memory.dmp

Filesize
344KB

Download
memory/3992-9-0x000000001B580000-0x000000001B58C000-memory.dmp

Filesize
48KB

Download
memory/3992-10-0x000000001B590000-0x000000001B59C000-memory.dmp

Filesize
48KB

Download
memory/3992-11-0x000000001B5A0000-0x000000001B5AC000-memory.dmp

Filesize
48KB

Download
memory/3992-12-0x000000001B5B0000-0x000000001B5BE000-memory.dmp

Filesize
56KB

Download
memory/3992-14-0x000000001B5D0000-0x000000001B5DA000-memory.dmp

Filesize
40KB

Download
memory/3992-13-0x000000001B5C0000-0x000000001B5CE000-memory.dmp

Filesize
56KB

Download
memory/3992-5-0x000000001B390000-0x000000001B398000-memory.dmp

Filesize
32KB

Download
memory/3992-0-0x0000000000670000-0x000000000087C000-memory.dmp

Filesize
2.0MB

Download
memory/3992-3-0x000000001B370000-0x000000001B38C000-memory.dmp

Filesize
112KB

Download
memory/3992-2-0x000000001B5E0000-0x000000001B5F0000-memory.dmp

Filesize
64KB

Download
memory/3992-1-0x00007FFDC9E50000-0x00007FFDCA911000-memory.dmp

Filesize
10.8MB

Download
memory/3992-284-0x00007FFDC9E50000-0x00007FFDCA911000-memory.dmp

Filesize
10.8MB

Download
memory/4484-283-0x0000000000430000-0x000000000063C000-memory.dmp

Filesize
2.0MB

Download
memory/4484-285-0x00007FFDC9E50000-0x00007FFDCA911000-memory.dmp

Filesize
10.8MB

Download
memory/4484-286-0x000000001B3B0000-0x000000001B3C0000-memory.dmp

Filesize
64KB

Download
memory/4484-287-0x000000001B810000-0x000000001B866000-memory.dmp

Filesize
344KB

Download
memory/4484-289-0x00007FFDC9E50000-0x00007FFDCA911000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads