dcrat | 0f6215b559b8436f2bd82dacca1a3ea76c1cee35c3f7f526388c0282ecb699db

Resubmissions

30/05/2024, 03:05

240530-dk6b9acb7110

30/05/2024, 03:04

240530-dkymeacb7x10

30/05/2024, 02:59

240530-dgr1fsda3910

Analysis

max time kernel
135s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 02:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
Size 1000KB
Sample240530-dgr1fsda39
SHA256 c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581
MD5 b817873fadd6af466832355a47d1e9ae
SHA1 e06db2031ed495fd73c7c0d60cb581702f668ec4
SHA512 1ed7a3060d0f7298f969152968b18db5211ca087480ef650415b297747576e033151bfb5b6494e0e1b79ddc609b25412a3707c475a8cd12f3fca95894a6e4a77
SSDEEP 24576:jzZgodRLKBXQEyRt7d/bZJfKp491BaDwoA:jz9W29vlp9Ok
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4908	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4968	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3168	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3880	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3920	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3668	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4544	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3392	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3288	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	888	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3124	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1396	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1112	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4508	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5048	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3612	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3764	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3224	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3080	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3576	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	980	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3464	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3480	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4588	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4176	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5096	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3980	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3256	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3944	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1900	1836	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4412	1836	schtasks.exe	83

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4160-0-0x0000000000620000-0x0000000000722000-memory.dmp	dcrat
behavioral2/files/0x0007000000023403-13.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe

Executes dropped EXE 1 IoCs

pid	Process
5104	dwm.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\5940a34987c991	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
File created	C:\Program Files\Google\Chrome\csrss.exe	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\explorer.exe	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\sihost.exe	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
File created	C:\Program Files\Java\55b276f4edf653	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\66fc9ff0ee96c2	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
File created	C:\Program Files\Java\StartMenuExperienceHost.exe	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\sihost.exe	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\66fc9ff0ee96c2	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
File created	C:\Program Files\Google\Chrome\886983d96e3d3e	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\7a0fd90576e088	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\en-US\sihost.exe	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
File created	C:\Program Files (x86)\Google\dllhost.exe	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\LiveKernelReports\SearchApp.exe	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
File created	C:\Windows\LiveKernelReports\38384e6a620884	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
File created	C:\Windows\SoftwareDistribution\PostRebootEventCache.V2\smss.exe	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
File created	C:\Windows\SoftwareDistribution\PostRebootEventCache.V2\69ddcba757bf72	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
File created	C:\Windows\Resources\Themes\aero\StartMenuExperienceHost.exe	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
File created	C:\Windows\Resources\Themes\aero\55b276f4edf653	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
File created	C:\Windows\Speech_OneCore\Idle.exe	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
File created	C:\Windows\Speech_OneCore\6ccacd8608530f	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
888	schtasks.exe
3012	schtasks.exe
3944	schtasks.exe
4780	schtasks.exe
3480	schtasks.exe
4176	schtasks.exe
4412	schtasks.exe
3288	schtasks.exe
1588	schtasks.exe
3764	schtasks.exe
1508	schtasks.exe
3256	schtasks.exe
1520	schtasks.exe
980	schtasks.exe
4588	schtasks.exe
4908	schtasks.exe
4544	schtasks.exe
3920	schtasks.exe
2668	schtasks.exe
2928	schtasks.exe
5096	schtasks.exe
2240	schtasks.exe
4604	schtasks.exe
2864	schtasks.exe
3124	schtasks.exe
1396	schtasks.exe
4508	schtasks.exe
3612	schtasks.exe
4704	schtasks.exe
2552	schtasks.exe
4968	schtasks.exe
1900	schtasks.exe
2356	schtasks.exe
1112	schtasks.exe
5072	schtasks.exe
3168	schtasks.exe
3392	schtasks.exe
5048	schtasks.exe
3224	schtasks.exe
3668	schtasks.exe
5060	schtasks.exe
3080	schtasks.exe
2980	schtasks.exe
5008	schtasks.exe
1736	schtasks.exe
3880	schtasks.exe
3980	schtasks.exe
2508	schtasks.exe
3576	schtasks.exe
2876	schtasks.exe
2892	schtasks.exe
3464	schtasks.exe
1036	schtasks.exe
1628	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
4160	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
4160	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
4160	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
4160	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
4160	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
4160	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
4160	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
4160	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
4160	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
4160	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
4160	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
4160	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
4160	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
4160	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
4160	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
4160	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
4160	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
4160	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
4160	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
4160	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
5104	dwm.exe
5104	dwm.exe
5104	dwm.exe
5104	dwm.exe
5104	dwm.exe
5104	dwm.exe
5104	dwm.exe
5104	dwm.exe
5104	dwm.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5104	dwm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4160	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
Token: SeDebugPrivilege	5104	dwm.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 2596	4160	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe	138
PID 4160 wrote to memory of 2596	4160	c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe	138
PID 2596 wrote to memory of 2004	2596	cmd.exe	140
PID 2596 wrote to memory of 2004	2596	cmd.exe	140
PID 2596 wrote to memory of 5104	2596	cmd.exe	149
PID 2596 wrote to memory of 5104	2596	cmd.exe	149

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe
"C:\Users\Admin\AppData\Local\Temp\c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DIOz5UKby6.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2004
- - C:\Users\All Users\Package Cache\dwm.exe
    "C:\Users\All Users\Package Cache\dwm.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:5104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Package Cache\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\All Users\Package Cache\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Package Cache\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Documents\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\Documents\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Documents\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Windows\LiveKernelReports\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Windows\LiveKernelReports\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\SoftwareDistribution\PostRebootEventCache.V2\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\PostRebootEventCache.V2\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\SoftwareDistribution\PostRebootEventCache.V2\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Program Files\Java\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Java\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Java\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\All Users\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Windows\Resources\Themes\aero\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\Resources\Themes\aero\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Windows\Resources\Themes\aero\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Saved Games\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\Saved Games\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Saved Games\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Google\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Google\Chrome\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Google\Chrome\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Windows\Speech_OneCore\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Speech_OneCore\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Windows\Speech_OneCore\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DIOz5UKby6.bat

Path C:\Users\Admin\AppData\Local\Temp\DIOz5UKby6.bat
Size 205B
SHA256 1b600efd41b97164f91ec6449ac0a2baa5a788f57f1433f2137f9126e877a723
MD5 c67460e90c8a5e9c6d549bbbaa9897b6
SHA1 3d0182157ad886137b088795766ef3f0b79a0ddc
SHA512 9b09e4fbf8fc5296aca0d3feab4de6d24698591f0e39a4e36982750d95fe8f705e4cb1aabb0e28125c7b5849412e5e5035cf527dc2b634ceb8784040cb304f0d
MD5 SHA1 SHA512

Submit Download

smss.exe

Path C:\Windows\SoftwareDistribution\PostRebootEventCache.V2\smss.exe
Size 1000KB
SHA256 c4c83b1a077e713337ea9f76248e9115cebfa105b3338747e3284cd610254581
MD5 b817873fadd6af466832355a47d1e9ae
SHA1 e06db2031ed495fd73c7c0d60cb581702f668ec4
SHA512 1ed7a3060d0f7298f969152968b18db5211ca087480ef650415b297747576e033151bfb5b6494e0e1b79ddc609b25412a3707c475a8cd12f3fca95894a6e4a77
SSDEEP 24576:jzZgodRLKBXQEyRt7d/bZJfKp491BaDwoA:jz9W29vlp9Ok
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4160-1-0x00007FF894C93000-0x00007FF894C95000-memory.dmp

Download

memory/4160-0-0x0000000000620000-0x0000000000722000-memory.dmp

Download

memory/4160-2-0x0000000001320000-0x000000000133C000-memory.dmp

Download

memory/4160-4-0x000000001B460000-0x000000001B4B0000-memory.dmp

Download

memory/4160-3-0x00007FF894C90000-0x00007FF895751000-memory.dmp

Download

memory/4160-46-0x00007FF894C90000-0x00007FF895751000-memory.dmp

Download