dcrat | 2f949ec92bdeb2498382e19b8588048fc6ff21aee5a29ade4433f1d6ea3d43aa

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2f949ec92bdeb2498382e19b8588048fc6ff21aee5a29ade4433f1d6ea3d43aa.exe
Size 1.4MB
Sample240528-dplhmsce9v
SHA256 2f949ec92bdeb2498382e19b8588048fc6ff21aee5a29ade4433f1d6ea3d43aa
MD5 0dd0c6f698a708a404a557cbb55b281c
SHA1 974be3c05755714a185b183be657a3c4123767d2
SHA512 b235c5e74eae9d493f625ebd489d99f58dc484c37559d3e5aa65135ceefba3e9950d98429295ff72db7d82a238da4af669740ae0fd1159150c908e3ceef58cdb
SSDEEP 24576:U2G/nvxW3Ww0txuMyTPo5JOeM/ibuPp7GWrGCmxhejeKjn:UbA30xuMy6JOx/GCmmj7D
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	544	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4568	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	636	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	944	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	64	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3628	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4956	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1500	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4416	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4804	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4872	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	464	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4564	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3108	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3492	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	32	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3660	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4656	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	388	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4020	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4636	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	808	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1796	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4720	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	4652	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	4652	schtasks.exe	89

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023405-10.dat	dcrat
behavioral2/memory/4372-13-0x00000000001A0000-0x00000000002C6000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	2f949ec92bdeb2498382e19b8588048fc6ff21aee5a29ade4433f1d6ea3d43aa.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	Hypercomponent.exe

Executes dropped EXE 2 IoCs

pid	Process
4372	Hypercomponent.exe
1768	Registry.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\9e8d7a4ca61bd9	Hypercomponent.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\fontdrvhost.exe	Hypercomponent.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\Registry.exe	Hypercomponent.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\RuntimeBroker.exe	Hypercomponent.exe
File created	C:\Program Files (x86)\WindowsPowerShell\cmd.exe	Hypercomponent.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\TextInputHost.exe	Hypercomponent.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\22eafd247d37c3	Hypercomponent.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\22eafd247d37c3	Hypercomponent.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\5b884080fd4f94	Hypercomponent.exe
File created	C:\Program Files (x86)\Common Files\dllhost.exe	Hypercomponent.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RuntimeBroker.exe	Hypercomponent.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\9e8d7a4ca61bd9	Hypercomponent.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\ee2ad38f3d4382	Hypercomponent.exe
File created	C:\Program Files\dotnet\swidtag\fontdrvhost.exe	Hypercomponent.exe
File created	C:\Program Files\dotnet\swidtag\5b884080fd4f94	Hypercomponent.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\TextInputHost.exe	Hypercomponent.exe
File created	C:\Program Files (x86)\Common Files\5940a34987c991	Hypercomponent.exe
File created	C:\Program Files (x86)\WindowsPowerShell\ebf1f9fa8afd6d	Hypercomponent.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\PrintDialog\en-US\winlogon.exe	Hypercomponent.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
64	schtasks.exe
4656	schtasks.exe
4020	schtasks.exe
544	schtasks.exe
1784	schtasks.exe
4720	schtasks.exe
3628	schtasks.exe
4956	schtasks.exe
1500	schtasks.exe
4780	schtasks.exe
2652	schtasks.exe
1840	schtasks.exe
4564	schtasks.exe
3108	schtasks.exe
32	schtasks.exe
1796	schtasks.exe
1924	schtasks.exe
4568	schtasks.exe
1292	schtasks.exe
2720	schtasks.exe
3492	schtasks.exe
3660	schtasks.exe
636	schtasks.exe
944	schtasks.exe
2084	schtasks.exe
4416	schtasks.exe
4804	schtasks.exe
1096	schtasks.exe
388	schtasks.exe
808	schtasks.exe
2228	schtasks.exe
4648	schtasks.exe
4872	schtasks.exe
464	schtasks.exe
4636	schtasks.exe
2528	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	2f949ec92bdeb2498382e19b8588048fc6ff21aee5a29ade4433f1d6ea3d43aa.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	Hypercomponent.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
4372	Hypercomponent.exe
4372	Hypercomponent.exe
4372	Hypercomponent.exe
4372	Hypercomponent.exe
4372	Hypercomponent.exe
4372	Hypercomponent.exe
4372	Hypercomponent.exe
4372	Hypercomponent.exe
4372	Hypercomponent.exe
4372	Hypercomponent.exe
4372	Hypercomponent.exe
4372	Hypercomponent.exe
4372	Hypercomponent.exe
4372	Hypercomponent.exe
1768	Registry.exe
1768	Registry.exe
1768	Registry.exe
1768	Registry.exe
1768	Registry.exe
1768	Registry.exe
1768	Registry.exe
1768	Registry.exe
1768	Registry.exe
1768	Registry.exe
1768	Registry.exe
1768	Registry.exe
1768	Registry.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1768	Registry.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4372	Hypercomponent.exe
Token: SeDebugPrivilege	1768	Registry.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 3416	1964	2f949ec92bdeb2498382e19b8588048fc6ff21aee5a29ade4433f1d6ea3d43aa.exe	81
PID 1964 wrote to memory of 3416	1964	2f949ec92bdeb2498382e19b8588048fc6ff21aee5a29ade4433f1d6ea3d43aa.exe	81
PID 1964 wrote to memory of 3416	1964	2f949ec92bdeb2498382e19b8588048fc6ff21aee5a29ade4433f1d6ea3d43aa.exe	81
PID 3416 wrote to memory of 1880	3416	WScript.exe	91
PID 3416 wrote to memory of 1880	3416	WScript.exe	91
PID 3416 wrote to memory of 1880	3416	WScript.exe	91
PID 1880 wrote to memory of 4372	1880	cmd.exe	93
PID 1880 wrote to memory of 4372	1880	cmd.exe	93
PID 4372 wrote to memory of 1364	4372	Hypercomponent.exe	130
PID 4372 wrote to memory of 1364	4372	Hypercomponent.exe	130
PID 1364 wrote to memory of 4532	1364	cmd.exe	132
PID 1364 wrote to memory of 4532	1364	cmd.exe	132
PID 1364 wrote to memory of 1768	1364	cmd.exe	135
PID 1364 wrote to memory of 1768	1364	cmd.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2f949ec92bdeb2498382e19b8588048fc6ff21aee5a29ade4433f1d6ea3d43aa.exe
"C:\Users\Admin\AppData\Local\Temp\2f949ec92bdeb2498382e19b8588048fc6ff21aee5a29ade4433f1d6ea3d43aa.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\dllnetcommon\nksvCU.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\dllnetcommon\CZ0AxGh8iI0xX.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\dllnetcommon\Hypercomponent.exe
      "C:\dllnetcommon\Hypercomponent.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4372
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1YxnBIcstf.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1364
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4532
      - C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\Registry.exe
        
        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\Registry.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\dllnetcommon\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\dllnetcommon\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\dllnetcommon\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\WindowsPowerShell\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:64

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\WindowsPowerShell\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files\dotnet\swidtag\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\dotnet\swidtag\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files\dotnet\swidtag\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\dllnetcommon\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\dllnetcommon\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:32

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\dllnetcommon\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\dllnetcommon\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\dllnetcommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\dllnetcommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Common Files\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1YxnBIcstf.bat

Path C:\Users\Admin\AppData\Local\Temp\1YxnBIcstf.bat
Size 250B
SHA256 45401a5ba68a93308910b15939e590d31155215d554bb6562501a53b649dff04
MD5 7b4ee9b2ef06b5fc82f32aaee896bc66
SHA1 f271c3aa4b49a853b8efcba01c7c29b9a3f9ae81
SHA512 fbb4e729093d1a21be8e95e22cc3a2a8dcd481626bddef935c2e59e9d669bf413d9280218301c6ee85d9c09a62863718619f03d3f1604da45301b7b0202b1d34
MD5 SHA1 SHA512

Submit Download

CZ0AxGh8iI0xX.bat

Path C:\dllnetcommon\CZ0AxGh8iI0xX.bat
Size 36B
SHA256 b6e2d4c42b7e0005c705b98df4fae50ffea17f18bcfa989929bd04cd8acc8dd9
MD5 a7ccb379ea9088b989b98f4b276a6dae
SHA1 8e779da19dc4079fb7756ee39ccb09323ad1c698
SHA512 3b3f24c5631357e6bbc3e61466d613f761ad1311d6be8b516f9917512c99c89e8d734c4651756fef05b52b39d09ef89bce9afbb1fa2aecb5af8af9bda4c68f47
MD5 SHA1 SHA512

Submit Download

Hypercomponent.exe

Path C:\dllnetcommon\Hypercomponent.exe
Size 1.1MB
SHA256 f388054504d405891e096ac309e2f2cd79b31e57d26bd35b656355087d848fcb
MD5 18d11f5deb5b177a7025dea61ac9699f
SHA1 c2b707419d5edc966ed57f5cd517214c01eccc17
SHA512 b97a7d1b5f64aad524de9f1cb71065b9faacaf97063a1c8e9beb3f0a2c3c3a5967b528e90484acd5d0a58e248ea70ba259256474df1318f1b37d7855e6490a87
SSDEEP 24576:yuMyTPo5JOeM/ibuPp7GWrGCmxhejeKj:yuMy6JOx/GCmmj7
MD5 SHA1 SHA512 SSDEEP

Submit Download

nksvCU.vbe

Path C:\dllnetcommon\nksvCU.vbe
Size 202B
SHA256 3f81eb984aae8c8a80bd55857f05c9d83b3983968c82c5548dee13cbd9c93a0e
MD5 db1cd14e32e7c320993c766da747dd0a
SHA1 61772de5539a68e9efcd8a8e4fb838bfc5a41dc8
SHA512 85a9aed69fc747f19971f603b48e64706aa1740f7648ec1798c2ff534a102551b00a921fde27684fb0c63c7c795c6b3c76fc8ddd969a61faf4efee9185a47c29
MD5 SHA1 SHA512

Submit Download

memory/4372-13-0x00000000001A0000-0x00000000002C6000-memory.dmp

Download

memory/4372-12-0x00007FFB45513000-0x00007FFB45515000-memory.dmp

Download

memory/4372-14-0x00000000024E0000-0x00000000024FC000-memory.dmp

Download

memory/4372-15-0x000000001B5A0000-0x000000001B5F0000-memory.dmp

Download

memory/4372-16-0x0000000002510000-0x0000000002526000-memory.dmp

Download