dcrat | e2a1908e50ef159ee1ae5f559b746e1815c81d9d842b9c4107c2e190ec20cbfd

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 06:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
Size 2.7MB
Sample240603-hnsmsage83
SHA256 e2a1908e50ef159ee1ae5f559b746e1815c81d9d842b9c4107c2e190ec20cbfd
MD5 9f537f5beee3ed03ea3454fadbbe2590
SHA1 7dfd75bb82009a2ba9fa46c38997357517f9230a
SHA512 ba9bbd6647771c069b308201fa58154466fa45a369fadd370667703ad230592f4c68fe9963b658c78580c8c10380ff9f0dddde782b769a92e5042197ba298bb9
SSDEEP 49152:YdfMu/b3guqhA2LFxvL17z3jRfgXHoEyVixczPUSy73Aasc7HrxHOrU7:cfx3g1nvL17zzRSoEyViK47OcrtHOr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3672	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4036	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1188	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3168	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1080	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4432	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4768	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	736	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4636	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4264	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4324	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	972	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	888	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3860	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1348	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1236	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4812	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3724	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1228	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	964	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	364	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4132	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4832	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3248	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4532	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5068	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3096	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4000	4908	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	4908	schtasks.exe	85

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/812-1-0x0000000000F40000-0x0000000001204000-memory.dmp	dcrat
behavioral2/files/0x0007000000023448-28.dat	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	dllhost.exe

Executes dropped EXE 5 IoCs

pid	Process
1396	dllhost.exe
4724	dllhost.exe
3276	dllhost.exe
700	dllhost.exe
4036	dllhost.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\OfficeClickToRun.exe	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\e6c9b481da804f	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\smss.exe	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\69ddcba757bf72	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\27d1bcfc3c54e0	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\Registry.exe	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\9e8d7a4ca61bd9	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\ee2ad38f3d4382	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\Oracle\sysmon.exe	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\Oracle\121e5b5079f7c0	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\System.exe	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\RuntimeBroker.exe	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\schemas\EAPMethods\unsecapp.exe	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
File created	C:\Windows\Globalization\Time Zone\dllhost.exe	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
File created	C:\Windows\Globalization\Time Zone\5940a34987c991	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
File created	C:\Windows\rescache\_merged\Registry.exe	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1188	schtasks.exe
3032	schtasks.exe
4432	schtasks.exe
4768	schtasks.exe
1608	schtasks.exe
964	schtasks.exe
4832	schtasks.exe
4532	schtasks.exe
2872	schtasks.exe
2424	schtasks.exe
4000	schtasks.exe
1060	schtasks.exe
2488	schtasks.exe
4812	schtasks.exe
3724	schtasks.exe
3248	schtasks.exe
2172	schtasks.exe
1660	schtasks.exe
548	schtasks.exe
2924	schtasks.exe
3168	schtasks.exe
4932	schtasks.exe
4636	schtasks.exe
4264	schtasks.exe
4324	schtasks.exe
364	schtasks.exe
5068	schtasks.exe
1600	schtasks.exe
1080	schtasks.exe
736	schtasks.exe
2704	schtasks.exe
2292	schtasks.exe
2748	schtasks.exe
1236	schtasks.exe
1228	schtasks.exe
3672	schtasks.exe
868	schtasks.exe
1676	schtasks.exe
2196	schtasks.exe
4036	schtasks.exe
888	schtasks.exe
3860	schtasks.exe
4132	schtasks.exe
3096	schtasks.exe
2592	schtasks.exe
3024	schtasks.exe
972	schtasks.exe
1348	schtasks.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	dllhost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
812	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
812	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
812	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
812	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
812	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
812	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
812	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
812	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
812	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
812	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
812	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
812	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
812	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
812	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
812	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
812	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
812	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
812	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
812	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
812	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
812	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
1396	dllhost.exe
1396	dllhost.exe
1396	dllhost.exe
1396	dllhost.exe
1396	dllhost.exe
1396	dllhost.exe
1396	dllhost.exe
4724	dllhost.exe
4724	dllhost.exe
4724	dllhost.exe
4724	dllhost.exe
4724	dllhost.exe
4724	dllhost.exe
4724	dllhost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	812	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
Token: SeDebugPrivilege	1396	dllhost.exe
Token: SeDebugPrivilege	4724	dllhost.exe
Token: SeDebugPrivilege	3276	dllhost.exe
Token: SeDebugPrivilege	700	dllhost.exe
Token: SeDebugPrivilege	4036	dllhost.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 2012	812	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe	135
PID 812 wrote to memory of 2012	812	9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe	135
PID 2012 wrote to memory of 424	2012	cmd.exe	137
PID 2012 wrote to memory of 424	2012	cmd.exe	137
PID 2012 wrote to memory of 1396	2012	cmd.exe	145
PID 2012 wrote to memory of 1396	2012	cmd.exe	145
PID 1396 wrote to memory of 4920	1396	dllhost.exe	146
PID 1396 wrote to memory of 4920	1396	dllhost.exe	146
PID 1396 wrote to memory of 4636	1396	dllhost.exe	147
PID 1396 wrote to memory of 4636	1396	dllhost.exe	147
PID 4920 wrote to memory of 3324	4920	cmd.exe	149
PID 4920 wrote to memory of 3324	4920	cmd.exe	149
PID 4920 wrote to memory of 4724	4920	cmd.exe	152
PID 4920 wrote to memory of 4724	4920	cmd.exe	152
PID 4636 wrote to memory of 3276	4636	WScript.exe	153
PID 4636 wrote to memory of 3276	4636	WScript.exe	153
PID 4724 wrote to memory of 4424	4724	dllhost.exe	154
PID 4724 wrote to memory of 4424	4724	dllhost.exe	154
PID 4724 wrote to memory of 4700	4724	dllhost.exe	155
PID 4724 wrote to memory of 4700	4724	dllhost.exe	155
PID 4700 wrote to memory of 1592	4700	cmd.exe	157
PID 4700 wrote to memory of 1592	4700	cmd.exe	157
PID 4424 wrote to memory of 700	4424	WScript.exe	158
PID 4424 wrote to memory of 700	4424	WScript.exe	158
PID 4700 wrote to memory of 4036	4700	cmd.exe	159
PID 4700 wrote to memory of 4036	4700	cmd.exe	159

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9f537f5beee3ed03ea3454fadbbe2590NeikiAnalytics_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:812
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ypQhCMeWxH.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:424
- - C:\Windows\Globalization\Time Zone\dllhost.exe
    "C:\Windows\Globalization\Time Zone\dllhost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1396
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XaHtVPtwVH.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4920
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:3324
    - - C:\Windows\Globalization\Time Zone\dllhost.exe
        
        "C:\Windows\Globalization\Time Zone\dllhost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4724
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6a5d306c-5b91-4141-a0b5-8841cd92211e.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4424
        
        C:\Windows\Globalization\Time Zone\dllhost.exe
        
        "C:\Windows\Globalization\Time Zone\dllhost.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:700
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cSLzsZ1i8q.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4700
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1592
        
        C:\Windows\Globalization\Time Zone\dllhost.exe
        
        "C:\Windows\Globalization\Time Zone\dllhost.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4036
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\65bb9354-b5b9-4a20-86a3-5c165b29c2b0.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4636
    - - C:\Windows\Globalization\Time Zone\dllhost.exe
        
        "C:\Windows\Globalization\Time Zone\dllhost.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\Globalization\Time Zone\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Globalization\Time Zone\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Windows\Globalization\Time Zone\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\Oracle\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Oracle\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\Oracle\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Documents\My Pictures\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Pictures\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Documents\My Pictures\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Desktop\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\Desktop\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Desktop\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files\Internet Explorer\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files\Internet Explorer\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\WindowsHolographicDevices\SpatialStore\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\All Users\WindowsHolographicDevices\SpatialStore\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\WindowsHolographicDevices\SpatialStore\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sysmon.exe

Path C:\Program Files (x86)\Common Files\Oracle\sysmon.exe
Size 2.7MB
SHA256 e2a1908e50ef159ee1ae5f559b746e1815c81d9d842b9c4107c2e190ec20cbfd
MD5 9f537f5beee3ed03ea3454fadbbe2590
SHA1 7dfd75bb82009a2ba9fa46c38997357517f9230a
SHA512 ba9bbd6647771c069b308201fa58154466fa45a369fadd370667703ad230592f4c68fe9963b658c78580c8c10380ff9f0dddde782b769a92e5042197ba298bb9
SSDEEP 49152:YdfMu/b3guqhA2LFxvL17z3jRfgXHoEyVixczPUSy73Aasc7HrxHOrU7:cfx3g1nvL17zzRSoEyViK47OcrtHOr
MD5 SHA1 SHA512 SSDEEP

Submit Download

dllhost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log
Size 1KB
SHA256 2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77
MD5 49b64127208271d8f797256057d0b006
SHA1 b99bd7e2b4e9ed24de47fb3341ea67660b84cca1
SHA512 f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e
MD5 SHA1 SHA512

Submit Download

65bb9354-b5b9-4a20-86a3-5c165b29c2b0.vbs

Path C:\Users\Admin\AppData\Local\Temp\65bb9354-b5b9-4a20-86a3-5c165b29c2b0.vbs
Size 722B
SHA256 8776c2e3b01a7f4d5aa68930bf808c34954e799a58abdd26b8746b150a72852a
MD5 3826fe867fc3381abdb0b9cbedcdc7c8
SHA1 afaf55ee994dca6b02d3172ee88e91c79895e77f
SHA512 0bbd212d0c953264a0a3fcd53fc8785fc26a6babcd611f0a28cb5e1b01ad270b1e7c87d3b4263b0114fffb7c212a6f0660ea6cbb631c097776666f738c1b83b5
MD5 SHA1 SHA512

Submit Download

6a5d306c-5b91-4141-a0b5-8841cd92211e.vbs

Path C:\Users\Admin\AppData\Local\Temp\6a5d306c-5b91-4141-a0b5-8841cd92211e.vbs
Size 722B
SHA256 d6041739d452882def3584a2ca13537616261a9c1cdeb722cffcf926d9aec267
MD5 d4ec19bc775915779bd9febeab34dfe5
SHA1 f5dc313b9117020f9b8eb2dc278a0fd594739589
SHA512 bff09aecf41da17470ca77b0f7acdecbf30cbf1470dbfc94eae50b0af59cde0e1afadf3f7a389960b12feb96213eca2cf3bf4d532a49137f0e146aa065a627f8
MD5 SHA1 SHA512

Submit Download

XaHtVPtwVH.bat

Path C:\Users\Admin\AppData\Local\Temp\XaHtVPtwVH.bat
Size 211B
SHA256 887fd9ab3ba4f3b5bb744a15c1d45154f68e841575f1bf7ea6b506183f43a193
MD5 f869d82ffdce28883ed12c01ec666d7d
SHA1 7ac61292d66c8967637dc98bab43e28563e82996
SHA512 fa3249d3e5506d26f6eca88d02cd812ed5478e305c8aca1a214447ac08346bac1af4aa2865c942dbc62a061a3c76ea389fefc812d92f165d41017db5b6c41dc7
MD5 SHA1 SHA512

Submit Download

cSLzsZ1i8q.bat

Path C:\Users\Admin\AppData\Local\Temp\cSLzsZ1i8q.bat
Size 211B
SHA256 8c4e91b6f07d399ae58c9768b7960cb8c51f04c37a7e3ef4b7f48e38630b0269
MD5 54b6bbdb80c46f40d82568dc0cf9d3fb
SHA1 a2958c1242072a24d8e857318e7740eacca537e6
SHA512 f5126e2e1d557ccf0333b5816ca75f2e6aec4465ea5a16a1f9c2276165470517c697e70a4ec892ff84dacb74585ef1e8da8ccc8752dfddb55ed764394e82b90d
MD5 SHA1 SHA512

Submit Download

ypQhCMeWxH.bat

Path C:\Users\Admin\AppData\Local\Temp\ypQhCMeWxH.bat
Size 211B
SHA256 3d4eefdbe1964f075aefcc390e52c4622bc7e2ffebe3759dac0c2a45e67f9034
MD5 0b053850de8523e6063e823c752635c8
SHA1 eb1093d6cf7e3ad69ccd55c2d4dd38e86935cb67
SHA512 31d11fea40f30b66e850ccdaef1f3e4a33a8296bcab6a662193db23ec8ace4dd7752dc72307f1d85ce59d584c2205fc52d1dc13b356a9d86a220c1e66f2e20fd
MD5 SHA1 SHA512

Submit Download

memory/812-15-0x000000001C790000-0x000000001C79E000-memory.dmp

Download

memory/812-6-0x000000001BD50000-0x000000001BD66000-memory.dmp

Download

memory/812-9-0x000000001C4A0000-0x000000001C4F6000-memory.dmp

Download

memory/812-10-0x000000001BD70000-0x000000001BD7C000-memory.dmp

Download

memory/812-11-0x000000001C640000-0x000000001C652000-memory.dmp

Download

memory/812-12-0x000000001CBA0000-0x000000001D0C8000-memory.dmp

Download

memory/812-13-0x000000001C670000-0x000000001C67C000-memory.dmp

Download

memory/812-18-0x000000001C8C0000-0x000000001C8CA000-memory.dmp

Download

memory/812-16-0x000000001C7A0000-0x000000001C7A8000-memory.dmp

Download

memory/812-0-0x00007FFB552B3000-0x00007FFB552B5000-memory.dmp

Download

memory/812-14-0x000000001C780000-0x000000001C78A000-memory.dmp

Download

memory/812-19-0x000000001C8D0000-0x000000001C8DC000-memory.dmp

Download

memory/812-17-0x000000001C8B0000-0x000000001C8B8000-memory.dmp

Download

memory/812-8-0x000000001BD80000-0x000000001BD90000-memory.dmp

Download

memory/812-7-0x0000000003400000-0x0000000003412000-memory.dmp

Download

memory/812-58-0x00007FFB552B0000-0x00007FFB55D71000-memory.dmp

Download

memory/812-1-0x0000000000F40000-0x0000000001204000-memory.dmp

Download

memory/812-2-0x00007FFB552B0000-0x00007FFB55D71000-memory.dmp

Download

memory/812-3-0x00000000033E0000-0x00000000033EE000-memory.dmp

Download

memory/812-5-0x000000001C4F0000-0x000000001C540000-memory.dmp

Download

memory/812-4-0x000000001BD30000-0x000000001BD4C000-memory.dmp

Download

memory/1396-64-0x000000001B270000-0x000000001B282000-memory.dmp

Download

memory/1396-63-0x000000001B210000-0x000000001B266000-memory.dmp

Download

memory/1396-62-0x000000001B1F0000-0x000000001B202000-memory.dmp

Download

memory/4724-78-0x0000000002F20000-0x0000000002F32000-memory.dmp

Download