dcrat | 7d85a096494f06ea287c8ea8d6c6174410ebc810ce4df0ba64af2916e81424c3

Analysis

max time kernel
134s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7d85a096494f06ea287c8ea8d6c6174410ebc810ce4df0ba64af2916e81424c3.exe
Size 1.4MB
Sample240510-rem6dadb94
SHA256 7d85a096494f06ea287c8ea8d6c6174410ebc810ce4df0ba64af2916e81424c3
MD5 9e1b66854d9e32ae63aa3751dd970d55
SHA1 7873eddf5cd54e89047b45446fbdf1471bba134c
SHA512 5cdc89f94c99f1e9117aa2830faf1b32eee7be37e119244c34b2fa1ba541dbbe0750bce97114e89353f791c6c0b011a101fafbe67bd82c774c829ee9c568636b
SSDEEP 24576:U2G/nvxW3Ww0tibKk1LiqvTtwFoLvBPed4CDzw59WobSn17zCwZvjRs+d:UbA30i2k1lT58RESntCw9jd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat spyware stealer

Malware Config

Signatures

DcRat 64 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		4680	schtasks.exe
		3876	schtasks.exe
		3224	schtasks.exe
		380	schtasks.exe
		5092	schtasks.exe
		3652	schtasks.exe
		4004	schtasks.exe
		5004	schtasks.exe
		1308	schtasks.exe
		648	schtasks.exe
		1820	schtasks.exe
		4948	schtasks.exe
		1964	schtasks.exe
		924	schtasks.exe
		4328	schtasks.exe
		4796	schtasks.exe
		3596	schtasks.exe
		2924	schtasks.exe
		5000	schtasks.exe
		4332	schtasks.exe
		2204	schtasks.exe
		2864	schtasks.exe
		952	schtasks.exe
		4720	schtasks.exe
		5080	schtasks.exe
		1704	schtasks.exe
		4292	schtasks.exe
		4212	schtasks.exe
		2452	schtasks.exe
		2740	schtasks.exe
		1808	schtasks.exe
		3328	schtasks.exe
		4908	schtasks.exe
		4968	schtasks.exe
		4684	schtasks.exe
		3960	schtasks.exe
		2360	schtasks.exe
		3728	schtasks.exe
		436	schtasks.exe
		1992	schtasks.exe
		3232	schtasks.exe
		4192	schtasks.exe
		4216	schtasks.exe
		4432	schtasks.exe
		1228	schtasks.exe
		3468	schtasks.exe
		784	schtasks.exe
		4716	schtasks.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation		7d85a096494f06ea287c8ea8d6c6174410ebc810ce4df0ba64af2916e81424c3.exe
		3336	schtasks.exe
		5064	schtasks.exe
		3320	schtasks.exe
		3244	schtasks.exe
		4352	schtasks.exe
		3304	schtasks.exe
		4520	schtasks.exe
		1248	schtasks.exe
		2788	schtasks.exe
		3628	schtasks.exe
		1716	schtasks.exe
		3344	schtasks.exe
		2212	schtasks.exe
		216	schtasks.exe
		5080	schtasks.exe

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3224	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1808	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3652	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3468	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4216	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4212	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1228	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3336	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2212	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3244	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1208	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3232	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3328	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4192	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3500	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5080	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4336	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4332	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5064	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	924	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3540	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2452	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2868	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5092	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3628	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4328	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3356	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	436	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5004	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3344	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4520	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4292	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4680	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4948	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3608	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1888	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4184	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4004	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	648	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	216	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4352	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3960	2124	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4720	2124	schtasks.exe	96

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023422-10.dat	dcrat
behavioral2/memory/4944-13-0x00000000003D0000-0x00000000004F6000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	mscomcrt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	7d85a096494f06ea287c8ea8d6c6174410ebc810ce4df0ba64af2916e81424c3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	mscomcrt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	mscomcrt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	mscomcrt.exe

Executes dropped EXE 5 IoCs

pid	Process
4944	mscomcrt.exe
4988	mscomcrt.exe
1732	mscomcrt.exe
228	mscomcrt.exe
348	conhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\5b884080fd4f94	mscomcrt.exe
File created	C:\Program Files\Windows Defender\fr-FR\e1ef82546f0b02	mscomcrt.exe
File created	C:\Program Files (x86)\Common Files\Adobe\9e8d7a4ca61bd9	mscomcrt.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\27d1bcfc3c54e0	mscomcrt.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\fontdrvhost.exe	mscomcrt.exe
File created	C:\Program Files (x86)\Common Files\Adobe\RuntimeBroker.exe	mscomcrt.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\fontdrvhost.exe	mscomcrt.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\dllhost.exe	mscomcrt.exe
File created	C:\Program Files\Windows Defender\fr-FR\SppExtComObj.exe	mscomcrt.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\38384e6a620884	mscomcrt.exe
File created	C:\Program Files (x86)\Windows Media Player\Visualizations\WmiPrvSE.exe	mscomcrt.exe
File created	C:\Program Files (x86)\Windows Media Player\Visualizations\24dbde2999530e	mscomcrt.exe
File created	C:\Program Files (x86)\Windows Media Player\it-IT\1f93f77a7f4778	mscomcrt.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\dllhost.exe	mscomcrt.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\5940a34987c991	mscomcrt.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe	mscomcrt.exe
File created	C:\Program Files (x86)\Windows Media Player\it-IT\MoUsoCoreWorker.exe	mscomcrt.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\csrss.exe	mscomcrt.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\System.exe	mscomcrt.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\Documents\088424020bedd6	mscomcrt.exe
File created	C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\pris\spoolsv.exe	mscomcrt.exe
File created	C:\Windows\Branding\Basebrd\en-US\MoUsoCoreWorker.exe	mscomcrt.exe
File created	C:\Windows\Branding\Basebrd\en-US\1f93f77a7f4778	mscomcrt.exe
File created	C:\Windows\PrintDialog\en-US\MoUsoCoreWorker.exe	mscomcrt.exe
File created	C:\Windows\ServiceProfiles\LocalService\Documents\conhost.exe	mscomcrt.exe
File created	C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\pris\f3b6ecef712a24	mscomcrt.exe
File created	C:\Windows\addins\conhost.exe	mscomcrt.exe
File created	C:\Windows\addins\088424020bedd6	mscomcrt.exe
File created	C:\Windows\L2Schemas\System.exe	mscomcrt.exe
File created	C:\Windows\L2Schemas\27d1bcfc3c54e0	mscomcrt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1616	schtasks.exe
1580	schtasks.exe
3500	schtasks.exe
1716	schtasks.exe
216	schtasks.exe
3876	schtasks.exe
2840	schtasks.exe
2428	schtasks.exe
5080	schtasks.exe
2924	schtasks.exe
4392	schtasks.exe
4348	schtasks.exe
2912	schtasks.exe
2008	schtasks.exe
1308	schtasks.exe
1704	schtasks.exe
1992	schtasks.exe
1248	schtasks.exe
4432	schtasks.exe
2212	schtasks.exe
1964	schtasks.exe
5092	schtasks.exe
1088	schtasks.exe
2204	schtasks.exe
1356	schtasks.exe
1888	schtasks.exe
3596	schtasks.exe
4684	schtasks.exe
1228	schtasks.exe
2788	schtasks.exe
3320	schtasks.exe
4520	schtasks.exe
3304	schtasks.exe
4004	schtasks.exe
3608	schtasks.exe
3292	schtasks.exe
3356	schtasks.exe
4796	schtasks.exe
4808	schtasks.exe
4660	schtasks.exe
3328	schtasks.exe
3336	schtasks.exe
2244	schtasks.exe
2740	schtasks.exe
4212	schtasks.exe
4336	schtasks.exe
4332	schtasks.exe
4292	schtasks.exe
2360	schtasks.exe
784	schtasks.exe
1592	schtasks.exe
3244	schtasks.exe
4352	schtasks.exe
3960	schtasks.exe
5004	schtasks.exe
1848	schtasks.exe
2808	schtasks.exe
2956	schtasks.exe
5000	schtasks.exe
2452	schtasks.exe
5064	schtasks.exe
4192	schtasks.exe
3656	schtasks.exe
1240	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	7d85a096494f06ea287c8ea8d6c6174410ebc810ce4df0ba64af2916e81424c3.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	mscomcrt.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
4944	mscomcrt.exe
4944	mscomcrt.exe
4944	mscomcrt.exe
4944	mscomcrt.exe
4988	mscomcrt.exe
4988	mscomcrt.exe
4988	mscomcrt.exe
4988	mscomcrt.exe
4988	mscomcrt.exe
4988	mscomcrt.exe
4988	mscomcrt.exe
4988	mscomcrt.exe
4988	mscomcrt.exe
4988	mscomcrt.exe
4988	mscomcrt.exe
1732	mscomcrt.exe
1732	mscomcrt.exe
1732	mscomcrt.exe
1732	mscomcrt.exe
1732	mscomcrt.exe
1732	mscomcrt.exe
1732	mscomcrt.exe
1732	mscomcrt.exe
228	mscomcrt.exe
228	mscomcrt.exe
228	mscomcrt.exe
228	mscomcrt.exe
228	mscomcrt.exe
228	mscomcrt.exe
228	mscomcrt.exe
228	mscomcrt.exe
228	mscomcrt.exe
228	mscomcrt.exe
228	mscomcrt.exe
228	mscomcrt.exe
228	mscomcrt.exe
228	mscomcrt.exe
348	conhost.exe
348	conhost.exe
348	conhost.exe
348	conhost.exe
348	conhost.exe
348	conhost.exe
348	conhost.exe
348	conhost.exe
348	conhost.exe
348	conhost.exe
348	conhost.exe
348	conhost.exe
348	conhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
348	conhost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4944	mscomcrt.exe
Token: SeDebugPrivilege	4988	mscomcrt.exe
Token: SeDebugPrivilege	1732	mscomcrt.exe
Token: SeDebugPrivilege	228	mscomcrt.exe
Token: SeDebugPrivilege	348	conhost.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 1184	1904	7d85a096494f06ea287c8ea8d6c6174410ebc810ce4df0ba64af2916e81424c3.exe	83
PID 1904 wrote to memory of 1184	1904	7d85a096494f06ea287c8ea8d6c6174410ebc810ce4df0ba64af2916e81424c3.exe	83
PID 1904 wrote to memory of 1184	1904	7d85a096494f06ea287c8ea8d6c6174410ebc810ce4df0ba64af2916e81424c3.exe	83
PID 1184 wrote to memory of 2352	1184	WScript.exe	93
PID 1184 wrote to memory of 2352	1184	WScript.exe	93
PID 1184 wrote to memory of 2352	1184	WScript.exe	93
PID 2352 wrote to memory of 4944	2352	cmd.exe	95
PID 2352 wrote to memory of 4944	2352	cmd.exe	95
PID 4944 wrote to memory of 4988	4944	mscomcrt.exe	103
PID 4944 wrote to memory of 4988	4944	mscomcrt.exe	103
PID 4988 wrote to memory of 2984	4988	mscomcrt.exe	141
PID 4988 wrote to memory of 2984	4988	mscomcrt.exe	141
PID 2984 wrote to memory of 2924	2984	cmd.exe	143
PID 2984 wrote to memory of 2924	2984	cmd.exe	143
PID 2984 wrote to memory of 1732	2984	cmd.exe	146
PID 2984 wrote to memory of 1732	2984	cmd.exe	146
PID 1732 wrote to memory of 228	1732	mscomcrt.exe	178
PID 1732 wrote to memory of 228	1732	mscomcrt.exe	178
PID 228 wrote to memory of 348	228	mscomcrt.exe	209
PID 228 wrote to memory of 348	228	mscomcrt.exe	209

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7d85a096494f06ea287c8ea8d6c6174410ebc810ce4df0ba64af2916e81424c3.exe
"C:\Users\Admin\AppData\Local\Temp\7d85a096494f06ea287c8ea8d6c6174410ebc810ce4df0ba64af2916e81424c3.exe"
1⤵
- DcRat
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\winmonitor\qvgoz2yaDM2PerVDcCbglrZwIyN.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\winmonitor\ouuZc7zYGWzB0T04CVk.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2352
  - - C:\winmonitor\mscomcrt.exe
      "C:\winmonitor\mscomcrt.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4944
    - - C:\winmonitor\mscomcrt.exe
        
        "C:\winmonitor\mscomcrt.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4988
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7MAvJXwgPG.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2984
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2924
        
        C:\winmonitor\mscomcrt.exe
        
        "C:\winmonitor\mscomcrt.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1732
        
        C:\winmonitor\mscomcrt.exe
        
        "C:\winmonitor\mscomcrt.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:228
        
        C:\Windows\addins\conhost.exe
        
        "C:\Windows\addins\conhost.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\USOShared\Logs\User\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:3224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\All Users\USOShared\Logs\User\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:1808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\USOShared\Logs\User\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:3652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:3468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:4216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\winmonitor\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\winmonitor\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\winmonitor\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:3232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:5080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Windows\L2Schemas\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\L2Schemas\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Windows\L2Schemas\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\fr-FR\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\fr-FR\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Defender\fr-FR\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\winmonitor\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:3540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\winmonitor\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\winmonitor\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\Adobe\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Adobe\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\Adobe\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Desktop\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Public\Desktop\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:3628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Desktop\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:4328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\winmonitor\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\winmonitor\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\winmonitor\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\winmonitor\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:3344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\winmonitor\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\winmonitor\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:4680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Application Data\upfc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:4948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Application Data\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 10 /tr "'C:\Windows\Branding\Basebrd\en-US\MoUsoCoreWorker.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\Windows\Branding\Basebrd\en-US\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 5 /tr "'C:\Windows\Branding\Basebrd\en-US\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\winmonitor\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\winmonitor\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\winmonitor\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\Visualizations\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Visualizations\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Media Player\Visualizations\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Pictures\sihost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:4720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Default\Pictures\sihost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Pictures\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Creates scheduled task(s)
PID:5080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\MoUsoCoreWorker.exe'" /f
1⤵
- DcRat
- Creates scheduled task(s)
PID:4796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Creates scheduled task(s)
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\winmonitor\dllhost.exe'" /f
1⤵
PID:452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\winmonitor\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Creates scheduled task(s)
PID:3304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\winmonitor\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
1⤵
- DcRat
- Creates scheduled task(s)
PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Creates scheduled task(s)
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\sppsvc.exe'" /f
1⤵
PID:3248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\All Users\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Windows\ServiceProfiles\LocalService\Documents\conhost.exe'" /f
1⤵
- Creates scheduled task(s)
PID:3292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\LocalService\Documents\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:4968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Windows\ServiceProfiles\LocalService\Documents\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Creates scheduled task(s)
PID:3596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\TrustedInstaller.exe'" /f
1⤵
- DcRat
PID:3728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Creates scheduled task(s)
PID:784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Creates scheduled task(s)
PID:5004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- DcRat
- Creates scheduled task(s)
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:4908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Creates scheduled task(s)
PID:3876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\System.exe'" /f
1⤵
- Creates scheduled task(s)
PID:3656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\System.exe'" /rl HIGHEST /f
1⤵
PID:1416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\System.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\pris\spoolsv.exe'" /f
1⤵
- Creates scheduled task(s)
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\pris\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Creates scheduled task(s)
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\pris\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:4716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\sppsvc.exe'" /f
1⤵
PID:4616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Creates scheduled task(s)
PID:4684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Creates scheduled task(s)
PID:3320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Windows\addins\conhost.exe'" /f
1⤵
- Creates scheduled task(s)
PID:4660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\addins\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Creates scheduled task(s)
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Windows\addins\conhost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Creates scheduled task(s)
PID:1088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Creates scheduled task(s)
PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9e8d7a4ca61bd9

Path C:\Recovery\WindowsRE\9e8d7a4ca61bd9
Size 189B
SHA256 e78d82f55f0403b85e6ab6c6f09c948a9f0cbe97663ebf1022caab6ac81983a5
MD5 ac2476367e7083de4e311cb4d49c2ff6
SHA1 41fd51dcc39d1a01832f661c2133f5ab84ed146e
SHA512 92d981e9fe5e61b6d5e364986fd4f743e66f3c3f967c8a1647779ebf194e528dc2856d08fbb082f1c984644957ba4a58ae6e07d42bcde6a2e1173ff69c633144
MD5 SHA1 SHA512

Submit Download

mscomcrt.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\mscomcrt.exe.log
Size 1KB
SHA256 29f5645ac14353ac460858f52c856548f3aeb144b09eef672a6b4849bafe742e
MD5 7800fca2323a4130444c572374a030f4
SHA1 40c9b8e0e5e7d72a5293f4010f2ccf21e637b4aa
SHA512 c8a7ad930b8c07007c7a67d8c32a2a4a401dcc34ab966e0e80901655fcbe1f5c95b72a195e6381b1de56c2c987eeab093d8e89891bec9e9684785c5d824b3554
MD5 SHA1 SHA512

Submit Download

7MAvJXwgPG.bat

Path C:\Users\Admin\AppData\Local\Temp\7MAvJXwgPG.bat
Size 191B
SHA256 45b18b31265de894fc992dade29232d2d54dbf3aa961b549ca8bf640adcfc05e
MD5 148142a5c12b1c18f990ad6674162c1d
SHA1 a77ba7827b8d080aaa6cf60d7a285f6941cf8560
SHA512 f00e77329f2f4451d264cc66c88c939fa4c824d6250c5003d03b0a0aade3edbedc706955d2aa7225b51a78fedbe6c3f81811bbf4ddb881de0cc4b22b880b6cbe
MD5 SHA1 SHA512

Submit Download

5940a34987c991

Path C:\winmonitor\5940a34987c991
Size 864B
SHA256 1aa92fb16a433454a920971369acf3240a19f1f354172b5bd57fee63cd7ca3c0
MD5 e49332c5533f6eeafead432ea383882e
SHA1 c2eda6326461a3a8a60907fb3ee8969b83d5c8a4
SHA512 71d68da655ab3d71e68ee59a7393e8299b0d4ec4ff93baf94d34ce10b78dd636b722142e3c5f988812bfd3b25d217e8d3fd31533456451511bdfaea4b20c1d08
MD5 SHA1 SHA512

Submit Download

mscomcrt.exe

Path C:\winmonitor\mscomcrt.exe
Size 1.1MB
SHA256 d36dd29d39313cd499de688a6a7c314947dc992cb9e8804ba1cc089931615246
MD5 4714a92bbf66f902bdfad5b79aac1eca
SHA1 14cde3dfb02e6c1b57a7ae2f2b7ba2a7adfe7d5b
SHA512 c1251b5e94caaa19ab3021263d18e15c9b2637b44d56775ba93f2916234e58fb506d1fee1665ad9d2961e8559a0211f3fa3043f001e3b228a051d9864fef1208
SSDEEP 24576:jbKk1LiqvTtwFoLvBPed4CDzw59WobSn17zCwZvjRs+:j2k1lT58RESntCw9j
MD5 SHA1 SHA512 SSDEEP

Submit Download

ouuZc7zYGWzB0T04CVk.bat

Path C:\winmonitor\ouuZc7zYGWzB0T04CVk.bat
Size 28B
SHA256 3b88b8793aa5149721824b99f29d16e9532fe4a5010664daf0aa04f3afb240a4
MD5 c0093c699eb061f5a6364cf9fdc2ccbd
SHA1 5872b5c1a57521e5c6b4cf62a16f22df5f39483b
SHA512 d0440a3bf5e00afbbf807bbe96010a87148fabe71d4e07cbf99953bafb4daef2b5b32acb2acb3cf933bd15e3b3ed803fec393ee0d23d0032cb2c106d1f14f12a
MD5 SHA1 SHA512

Submit Download

qvgoz2yaDM2PerVDcCbglrZwIyN.vbe

Path C:\winmonitor\qvgoz2yaDM2PerVDcCbglrZwIyN.vbe
Size 206B
SHA256 95970616e8925153d71327286eb60aafef98ed6f11a4167fcb4a5d6d13566d1c
MD5 b3de21d370883f21350a1d89b439aef6
SHA1 bbb5100f015e9ff27739469b1d35ef97b1d3bebf
SHA512 46edaf8dd696d6da36a45b40cf0603a1d3a42a7fdab46fedc733b911a00153f194841d565b3adde6615a380dc535067dda7bc7d116d9d826980ce1d6a2e4d3dd
MD5 SHA1 SHA512

Submit Download

memory/4944-12-0x00007FFE97533000-0x00007FFE97535000-memory.dmp

Download

memory/4944-13-0x00000000003D0000-0x00000000004F6000-memory.dmp

Download

memory/4944-14-0x0000000000E30000-0x0000000000E4C000-memory.dmp

Download

memory/4944-16-0x000000001B110000-0x000000001B126000-memory.dmp

Download

memory/4944-15-0x000000001B7E0000-0x000000001B830000-memory.dmp

Download