dcrat | 4da05bfdb0ac4d1beff6054c7b21f319baa27c49f0b3609d0af27109a308e3b6

Analysis

max time kernel
131s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 04:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
Size 2.0MB
Sample240526-em75asec8s
SHA256 4da05bfdb0ac4d1beff6054c7b21f319baa27c49f0b3609d0af27109a308e3b6
MD5 616378dda0b89507badd4b9fe931f840
SHA1 0570d719eac0b4899132b623e87ab33aa558483d
SHA512 5879b632754b458188091130342bbf1a50cbc7cab0618ef2ca0e0689cec722359beaf5600f615bd96d29d016738b3e9299c5286880a7ad3445ecc1e63fd70f9d
SSDEEP 24576:kn2XTCHM4xT9V3XzsHhVmatCELYIXVelAtgbHHd:SaTUv0jmtEttc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Sidebar\\Gadgets\\dllhost.exe\""	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Sidebar\\Gadgets\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\dwm.exe\""	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Sidebar\\Gadgets\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Windows\\PrintDialog\\Assets\\explorer.exe\""	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Sidebar\\Gadgets\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Windows\\PrintDialog\\Assets\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\""	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Sidebar\\Gadgets\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Windows\\PrintDialog\\Assets\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Windows\\schemas\\sppsvc.exe\""	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Sidebar\\Gadgets\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\dwm.exe\", \"C:\\Windows\\PrintDialog\\Assets\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Windows\\schemas\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\SppExtComObj.exe\""	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	632	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	632	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	632	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4176	632	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	632	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	632	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3700	632	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3560	632	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	696	632	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5004	632	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4772	632	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3860	632	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3160	632	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	632	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3868	632	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	632	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3368	632	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	632	schtasks.exe	84

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3032-0-0x0000000000670000-0x000000000087C000-memory.dmp	dcrat
behavioral2/files/0x0007000000023436-23.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
556	SppExtComObj.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files (x86)\\Windows Portable Devices\\SppExtComObj.exe\""	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files (x86)\\Windows Portable Devices\\SppExtComObj.exe\""	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Windows Sidebar\\Gadgets\\dllhost.exe\""	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Recovery\\WindowsRE\\dwm.exe\""	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\PrintDialog\\Assets\\explorer.exe\""	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\WindowsRE\\wininit.exe\""	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\WindowsRE\\wininit.exe\""	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\schemas\\sppsvc.exe\""	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Windows Sidebar\\Gadgets\\dllhost.exe\""	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Recovery\\WindowsRE\\dwm.exe\""	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\PrintDialog\\Assets\\explorer.exe\""	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\schemas\\sppsvc.exe\""	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Portable Devices\e1ef82546f0b02	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RCX3B07.tmp	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCX4571.tmp	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCX4572.tmp	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\SppExtComObj.exe	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\dllhost.exe	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\5940a34987c991	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Portable Devices\SppExtComObj.exe	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RCX3B08.tmp	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\dllhost.exe	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\schemas\sppsvc.exe	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
File opened for modification	C:\Windows\PrintDialog\Assets\RCX3F32.tmp	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
File opened for modification	C:\Windows\schemas\sppsvc.exe	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
File created	C:\Windows\PrintDialog\Assets\explorer.exe	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
File created	C:\Windows\PrintDialog\Assets\7a0fd90576e088	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
File created	C:\Windows\schemas\0a1fd5f707cd16	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
File opened for modification	C:\Windows\PrintDialog\Assets\RCX3F33.tmp	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
File opened for modification	C:\Windows\PrintDialog\Assets\explorer.exe	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
File opened for modification	C:\Windows\schemas\RCX435C.tmp	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
File opened for modification	C:\Windows\schemas\RCX435D.tmp	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2500	schtasks.exe
696	schtasks.exe
3860	schtasks.exe
2640	schtasks.exe
4964	schtasks.exe
2732	schtasks.exe
4176	schtasks.exe
3700	schtasks.exe
5004	schtasks.exe
3368	schtasks.exe
2428	schtasks.exe
4772	schtasks.exe
2668	schtasks.exe
2292	schtasks.exe
3560	schtasks.exe
3160	schtasks.exe
3868	schtasks.exe
3040	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3032	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
3032	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
3032	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
3032	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
3032	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
3032	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
3032	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
556	SppExtComObj.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3032	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
Token: SeDebugPrivilege	556	SppExtComObj.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2832	3032	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe	115
PID 3032 wrote to memory of 2832	3032	616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe	115
PID 2832 wrote to memory of 2936	2832	cmd.exe	117
PID 2832 wrote to memory of 2936	2832	cmd.exe	117
PID 2832 wrote to memory of 556	2832	cmd.exe	121
PID 2832 wrote to memory of 556	2832	cmd.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\616378dda0b89507badd4b9fe931f840_NeikiAnalytics.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IFszAWFu0C.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2936
- - C:\Program Files (x86)\Windows Portable Devices\SppExtComObj.exe
    "C:\Program Files (x86)\Windows Portable Devices\SppExtComObj.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Sidebar\Gadgets\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\Gadgets\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Windows\PrintDialog\Assets\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\PrintDialog\Assets\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Windows\PrintDialog\Assets\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Windows\schemas\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\schemas\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Windows\schemas\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

IFszAWFu0C.bat

Path C:\Users\Admin\AppData\Local\Temp\IFszAWFu0C.bat
Size 229B
SHA256 d88d57cdf87b8af8ef861bd8cd4d34cd3b18303ab6a8b8dda125593d8c205ab2
MD5 7f9af2ca15b4663430af282c726f06e2
SHA1 222cf57430ac1f8a257c3daf8a76a17f0a73f0cc
SHA512 29ae63780000afcbb96a976cc99068ef1311bcd3a85155672bc8660565c26be854d836456cbedc2b360829ab108a5b7a1cd4a5f991e63a632d69fb6662310d02
MD5 SHA1 SHA512

Submit Download

sppsvc.exe

Path C:\Windows\schemas\sppsvc.exe
Size 2.0MB
SHA256 4da05bfdb0ac4d1beff6054c7b21f319baa27c49f0b3609d0af27109a308e3b6
MD5 616378dda0b89507badd4b9fe931f840
SHA1 0570d719eac0b4899132b623e87ab33aa558483d
SHA512 5879b632754b458188091130342bbf1a50cbc7cab0618ef2ca0e0689cec722359beaf5600f615bd96d29d016738b3e9299c5286880a7ad3445ecc1e63fd70f9d
SSDEEP 24576:kn2XTCHM4xT9V3XzsHhVmatCELYIXVelAtgbHHd:SaTUv0jmtEttc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3032-8-0x000000001B5E0000-0x000000001B636000-memory.dmp

Download

memory/3032-9-0x000000001B630000-0x000000001B63C000-memory.dmp

Download

memory/3032-4-0x000000001BA50000-0x000000001BAA0000-memory.dmp

Download

memory/3032-6-0x000000001B460000-0x000000001B470000-memory.dmp

Download

memory/3032-5-0x0000000002A70000-0x0000000002A78000-memory.dmp

Download

memory/3032-7-0x000000001B5C0000-0x000000001B5D6000-memory.dmp

Download

memory/3032-0-0x0000000000670000-0x000000000087C000-memory.dmp

Download

memory/3032-3-0x0000000002A50000-0x0000000002A6C000-memory.dmp

Download

memory/3032-10-0x000000001BAA0000-0x000000001BAAC000-memory.dmp

Download

memory/3032-11-0x000000001BAB0000-0x000000001BABC000-memory.dmp

Download

memory/3032-12-0x000000001BAC0000-0x000000001BACE000-memory.dmp

Download

memory/3032-13-0x000000001BAD0000-0x000000001BADE000-memory.dmp

Download

memory/3032-14-0x000000001BAE0000-0x000000001BAEA000-memory.dmp

Download

memory/3032-2-0x00007FFF63EE0000-0x00007FFF649A1000-memory.dmp

Download

memory/3032-111-0x00007FFF63EE0000-0x00007FFF649A1000-memory.dmp

Download

memory/3032-1-0x00007FFF63EE3000-0x00007FFF63EE5000-memory.dmp

Download