dcrat | 2b599764c1e782b1e499d7b7bc9c12b291c5a19756cf89d4e2cef3193cc6c90b

Analysis

max time kernel
130s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3bc8b8ad7f36089f72370ea636dbcecd.exe
Size 1.4MB
Sample240615-2fc2xaxckb
SHA256 2b599764c1e782b1e499d7b7bc9c12b291c5a19756cf89d4e2cef3193cc6c90b
MD5 3bc8b8ad7f36089f72370ea636dbcecd
SHA1 cd3cf1cd1e3fa4b8a5d70fdaf0d144b3876b8ff1
SHA512 e8b8bfadf16e086c944bc9fd641b2ee520b24d9fea70dd442f36a49ff6f7faee48014f171573cfb729976398881c43595a7be7dbd5a7f5c6fb4728a3d7049fcf
SSDEEP 24576:O2G/nvxW3Ws09UK9SePZWzYrLHOdKRTh3heRJXQjxF:ObA3Y9USPZRvHNkrQjr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3112	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3140	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4948	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3500	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3904	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4280	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	316	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4592	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	220	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4264	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3108	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4048	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	624	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1376	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3360	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4636	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4816	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4896	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4404	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3760	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5092	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3444	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5000	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4492	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3172	4780	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	4780	schtasks.exe	89

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023415-10.dat	dcrat
behavioral2/memory/1036-13-0x0000000000240000-0x0000000000342000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	3bc8b8ad7f36089f72370ea636dbcecd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	Intocrtmonitor.exe

Executes dropped EXE 2 IoCs

pid	Process
1036	Intocrtmonitor.exe
3512	unsecapp.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
10	pastebin.com
11	pastebin.com

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Registry.exe	Intocrtmonitor.exe
File created	C:\Program Files (x86)\Google\ea9f0e6c9e2dcd	Intocrtmonitor.exe
File created	C:\Program Files (x86)\Microsoft\ea1d8f6d871115	Intocrtmonitor.exe
File created	C:\Program Files\7-Zip\Lang\OfficeClickToRun.exe	Intocrtmonitor.exe
File created	C:\Program Files\7-Zip\Lang\e6c9b481da804f	Intocrtmonitor.exe
File created	C:\Program Files (x86)\Windows Portable Devices\unsecapp.exe	Intocrtmonitor.exe
File created	C:\Program Files (x86)\Windows Portable Devices\29c1c3cc0f7685	Intocrtmonitor.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\RuntimeBroker.exe	Intocrtmonitor.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\ee2ad38f3d4382	Intocrtmonitor.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\dllhost.exe	Intocrtmonitor.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\5940a34987c991	Intocrtmonitor.exe
File created	C:\Program Files (x86)\Microsoft\upfc.exe	Intocrtmonitor.exe
File created	C:\Program Files (x86)\Google\taskhostw.exe	Intocrtmonitor.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\9e8d7a4ca61bd9	Intocrtmonitor.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Sun\Java\services.exe	Intocrtmonitor.exe
File opened for modification	C:\Windows\Sun\Java\services.exe	Intocrtmonitor.exe
File created	C:\Windows\Sun\Java\c5b4cb5e9653cc	Intocrtmonitor.exe
File created	C:\Windows\Sun\Java\Deployment\cmd.exe	Intocrtmonitor.exe
File created	C:\Windows\Sun\Java\Deployment\ebf1f9fa8afd6d	Intocrtmonitor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2012	schtasks.exe
4896	schtasks.exe
2876	schtasks.exe
5092	schtasks.exe
1664	schtasks.exe
3112	schtasks.exe
3904	schtasks.exe
2748	schtasks.exe
2400	schtasks.exe
4816	schtasks.exe
2896	schtasks.exe
2912	schtasks.exe
5000	schtasks.exe
4892	schtasks.exe
2580	schtasks.exe
4264	schtasks.exe
4492	schtasks.exe
4648	schtasks.exe
2820	schtasks.exe
316	schtasks.exe
4048	schtasks.exe
1376	schtasks.exe
4636	schtasks.exe
3760	schtasks.exe
2008	schtasks.exe
220	schtasks.exe
624	schtasks.exe
3108	schtasks.exe
3140	schtasks.exe
1144	schtasks.exe
2436	schtasks.exe
1520	schtasks.exe
3044	schtasks.exe
3444	schtasks.exe
4948	schtasks.exe
3500	schtasks.exe
4280	schtasks.exe
3172	schtasks.exe
1064	schtasks.exe
2676	schtasks.exe
2240	schtasks.exe
2808	schtasks.exe
2816	schtasks.exe
2108	schtasks.exe
2120	schtasks.exe
4592	schtasks.exe
3360	schtasks.exe
4404	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings	3bc8b8ad7f36089f72370ea636dbcecd.exe
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings	Intocrtmonitor.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
1036	Intocrtmonitor.exe
1036	Intocrtmonitor.exe
1036	Intocrtmonitor.exe
1036	Intocrtmonitor.exe
1036	Intocrtmonitor.exe
1036	Intocrtmonitor.exe
1036	Intocrtmonitor.exe
1036	Intocrtmonitor.exe
1036	Intocrtmonitor.exe
1036	Intocrtmonitor.exe
1036	Intocrtmonitor.exe
1036	Intocrtmonitor.exe
1036	Intocrtmonitor.exe
1036	Intocrtmonitor.exe
1036	Intocrtmonitor.exe
1036	Intocrtmonitor.exe
1036	Intocrtmonitor.exe
1036	Intocrtmonitor.exe
1036	Intocrtmonitor.exe
3512	unsecapp.exe
3512	unsecapp.exe
3512	unsecapp.exe
3512	unsecapp.exe
3512	unsecapp.exe
3512	unsecapp.exe
3512	unsecapp.exe
3512	unsecapp.exe
3512	unsecapp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3512	unsecapp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1036	Intocrtmonitor.exe
Token: SeDebugPrivilege	3512	unsecapp.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2572	1720	3bc8b8ad7f36089f72370ea636dbcecd.exe	81
PID 1720 wrote to memory of 2572	1720	3bc8b8ad7f36089f72370ea636dbcecd.exe	81
PID 1720 wrote to memory of 2572	1720	3bc8b8ad7f36089f72370ea636dbcecd.exe	81
PID 2572 wrote to memory of 4212	2572	WScript.exe	86
PID 2572 wrote to memory of 4212	2572	WScript.exe	86
PID 2572 wrote to memory of 4212	2572	WScript.exe	86
PID 4212 wrote to memory of 1036	4212	cmd.exe	88
PID 4212 wrote to memory of 1036	4212	cmd.exe	88
PID 1036 wrote to memory of 5048	1036	Intocrtmonitor.exe	138
PID 1036 wrote to memory of 5048	1036	Intocrtmonitor.exe	138
PID 5048 wrote to memory of 4860	5048	cmd.exe	140
PID 5048 wrote to memory of 4860	5048	cmd.exe	140
PID 5048 wrote to memory of 3512	5048	cmd.exe	141
PID 5048 wrote to memory of 3512	5048	cmd.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3bc8b8ad7f36089f72370ea636dbcecd.exe
"C:\Users\Admin\AppData\Local\Temp\3bc8b8ad7f36089f72370ea636dbcecd.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\SurrogatecontainerAgentsavesdll\istAsVsoqBjp.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\SurrogatecontainerAgentsavesdll\G9tktHbnIT1ESBp2gkPanqMZ.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4212
  - - C:\SurrogatecontainerAgentsavesdll\Intocrtmonitor.exe
      "C:\SurrogatecontainerAgentsavesdll\Intocrtmonitor.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1036
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ql2ne0wKIa.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5048
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4860
      - C:\SurrogatecontainerAgentsavesdll\unsecapp.exe
        
        "C:\SurrogatecontainerAgentsavesdll\unsecapp.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:3512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Windows\Sun\Java\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Sun\Java\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Windows\Sun\Java\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Windows\Sun\Java\Deployment\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\Sun\Java\Deployment\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Windows\Sun\Java\Deployment\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\SurrogatecontainerAgentsavesdll\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\SurrogatecontainerAgentsavesdll\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\SurrogatecontainerAgentsavesdll\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Libraries\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Public\Libraries\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Libraries\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\SurrogatecontainerAgentsavesdll\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\SurrogatecontainerAgentsavesdll\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\SurrogatecontainerAgentsavesdll\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Default\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Users\Default\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Program Files\7-Zip\Lang\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Program Files\7-Zip\Lang\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\SurrogatecontainerAgentsavesdll\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\SurrogatecontainerAgentsavesdll\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\SurrogatecontainerAgentsavesdll\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\SurrogatecontainerAgentsavesdll\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\SurrogatecontainerAgentsavesdll\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\SurrogatecontainerAgentsavesdll\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Google\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Mozilla Firefox\uninstall\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\uninstall\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Mozilla Firefox\uninstall\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

G9tktHbnIT1ESBp2gkPanqMZ.bat

Path C:\SurrogatecontainerAgentsavesdll\G9tktHbnIT1ESBp2gkPanqMZ.bat
Size 55B
SHA256 aad154470e8ab1277a31d000af06c0f5281444d9d447779cfd37cea754a48bf1
MD5 74b96e1b4814887e264cae2975cdc1d1
SHA1 0f445c85a45fec3acfe12a20dc470e58355995e5
SHA512 6b081b689f4eca26257f3f570a14f50590e2d204e1a18bd986dcee56072d3322c4d8bcf2e068cc5f54e691ee9e66584b1110353bdf1f158ac08719e851c4a320
MD5 SHA1 SHA512

Submit Download

Intocrtmonitor.exe

Path C:\SurrogatecontainerAgentsavesdll\Intocrtmonitor.exe
Size 1001KB
SHA256 1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64
MD5 3146f2002112e5ba7562a28ff1883f9a
SHA1 9bd64b0954d746395e8080e563dbb39b254fac7d
SHA512 08e1e8c002269a4d611d21de3d037879abcbbf59f8f3744f27ee62b296adf61664f4f7afe0dc36bcdd4b5070fe6b7bf146ff94b0c682fee09e61bfa0935c3cfa
SSDEEP 12288:BiqbUK9S2Jhb/PZWzR6keiZAHOVEAKNZCKTh3VnGFOeRJmuHwj3x:hUK9SePZWzYrLHOdKRTh3heRJXQjx
MD5 SHA1 SHA512 SSDEEP

Submit Download

istAsVsoqBjp.vbe

Path C:\SurrogatecontainerAgentsavesdll\istAsVsoqBjp.vbe
Size 232B
SHA256 4a1b81c97b3d014b286d0a740c00819f65ef8366c89d5c0c264e7a6c634c4747
MD5 d217f6360486fb0b2015e036b2bda7ae
SHA1 ee4ad1ad7f0594f8727d0d0cea1a0fb70388e058
SHA512 78aa16897c7a2e9100a0e89300aff54c73f77e68fabe999f6b021d14c7bd4d7b732ee445c54381333396104002c86bf165e37a45e5669b0a05ffe4a791ed7d22
MD5 SHA1 SHA512

Submit Download

Ql2ne0wKIa.bat

Path C:\Users\Admin\AppData\Local\Temp\Ql2ne0wKIa.bat
Size 212B
SHA256 234b4c27343d1fdb58b09fdcf521e9792a3de9ad5d4c6ee9e140b0da5dfbe703
MD5 55a94831fff41b41e1d7a84ea61fe1a7
SHA1 2c5bec45ded374ce881a7f1d99197bafb91e5804
SHA512 374c47552bcfb2ebfe8ef3f758172be2a7cda7c464cef9e33ee8bfa7372c0ea748dc27ad3045500ef42a9977f8dd14bf5f3c29ae3ec9f4cf698f32347d32f170
MD5 SHA1 SHA512

Submit Download

memory/1036-12-0x00007FFB0C193000-0x00007FFB0C195000-memory.dmp

Download

memory/1036-13-0x0000000000240000-0x0000000000342000-memory.dmp

Download

memory/1036-14-0x0000000002480000-0x000000000249C000-memory.dmp

Download

memory/1036-15-0x000000001B600000-0x000000001B650000-memory.dmp

Download