dcrat | 2b599764c1e782b1e499d7b7bc9c12b291c5a19756cf89d4e2cef3193cc6c90b

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2b599764c1e782b1e499d7b7bc9c12b291c5a19756cf89d4e2cef3193cc6c90b.exe
Size 1.4MB
Sample240616-bfbkzasfla
SHA256 2b599764c1e782b1e499d7b7bc9c12b291c5a19756cf89d4e2cef3193cc6c90b
MD5 3bc8b8ad7f36089f72370ea636dbcecd
SHA1 cd3cf1cd1e3fa4b8a5d70fdaf0d144b3876b8ff1
SHA512 e8b8bfadf16e086c944bc9fd641b2ee520b24d9fea70dd442f36a49ff6f7faee48014f171573cfb729976398881c43595a7be7dbd5a7f5c6fb4728a3d7049fcf
SSDEEP 24576:O2G/nvxW3Ws09UK9SePZWzYrLHOdKRTh3heRJXQjxF:ObA3Y9USPZRvHNkrQjr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3708	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3984	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	448	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3500	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	648	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3612	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3632	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4816	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4472	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	632	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3504	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	932	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1300	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2452	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3524	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4044	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	860	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4988	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4088	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1000	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4000	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3900	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3076	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3936	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2336	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4228	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3384	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	764	2920	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1220	2920	schtasks.exe	90

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023453-10.dat	dcrat
behavioral2/memory/740-13-0x0000000000940000-0x0000000000A42000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	2b599764c1e782b1e499d7b7bc9c12b291c5a19756cf89d4e2cef3193cc6c90b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	Intocrtmonitor.exe

Executes dropped EXE 2 IoCs

pid	Process
740	Intocrtmonitor.exe
1728	fontdrvhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
10	pastebin.com
11	pastebin.com

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\uninstall\9e8d7a4ca61bd9	Intocrtmonitor.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\c5b4cb5e9653cc	Intocrtmonitor.exe
File created	C:\Program Files\MSBuild\e6c9b481da804f	Intocrtmonitor.exe
File created	C:\Program Files (x86)\Internet Explorer\TextInputHost.exe	Intocrtmonitor.exe
File created	C:\Program Files\Windows Media Player\it-IT\9e8d7a4ca61bd9	Intocrtmonitor.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\RuntimeBroker.exe	Intocrtmonitor.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\services.exe	Intocrtmonitor.exe
File created	C:\Program Files\MSBuild\OfficeClickToRun.exe	Intocrtmonitor.exe
File created	C:\Program Files (x86)\Internet Explorer\22eafd247d37c3	Intocrtmonitor.exe
File created	C:\Program Files\Windows Media Player\it-IT\RuntimeBroker.exe	Intocrtmonitor.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Branding\shellbrd\TextInputHost.exe	Intocrtmonitor.exe
File created	C:\Windows\Branding\shellbrd\22eafd247d37c3	Intocrtmonitor.exe
File created	C:\Windows\Resources\Ease of Access Themes\fontdrvhost.exe	Intocrtmonitor.exe
File created	C:\Windows\Resources\Ease of Access Themes\5b884080fd4f94	Intocrtmonitor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3504	schtasks.exe
2452	schtasks.exe
3076	schtasks.exe
2620	schtasks.exe
632	schtasks.exe
2592	schtasks.exe
1300	schtasks.exe
1292	schtasks.exe
764	schtasks.exe
448	schtasks.exe
3524	schtasks.exe
3708	schtasks.exe
2720	schtasks.exe
3900	schtasks.exe
2336	schtasks.exe
4472	schtasks.exe
3612	schtasks.exe
932	schtasks.exe
2332	schtasks.exe
1920	schtasks.exe
1000	schtasks.exe
3936	schtasks.exe
648	schtasks.exe
3632	schtasks.exe
4988	schtasks.exe
1992	schtasks.exe
1220	schtasks.exe
3984	schtasks.exe
3500	schtasks.exe
2444	schtasks.exe
860	schtasks.exe
4088	schtasks.exe
4000	schtasks.exe
1676	schtasks.exe
1620	schtasks.exe
2476	schtasks.exe
3384	schtasks.exe
4816	schtasks.exe
1628	schtasks.exe
4044	schtasks.exe
4228	schtasks.exe
1952	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	2b599764c1e782b1e499d7b7bc9c12b291c5a19756cf89d4e2cef3193cc6c90b.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	Intocrtmonitor.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
740	Intocrtmonitor.exe
740	Intocrtmonitor.exe
740	Intocrtmonitor.exe
740	Intocrtmonitor.exe
740	Intocrtmonitor.exe
740	Intocrtmonitor.exe
740	Intocrtmonitor.exe
740	Intocrtmonitor.exe
740	Intocrtmonitor.exe
740	Intocrtmonitor.exe
740	Intocrtmonitor.exe
740	Intocrtmonitor.exe
740	Intocrtmonitor.exe
740	Intocrtmonitor.exe
740	Intocrtmonitor.exe
740	Intocrtmonitor.exe
740	Intocrtmonitor.exe
740	Intocrtmonitor.exe
740	Intocrtmonitor.exe
740	Intocrtmonitor.exe
740	Intocrtmonitor.exe
740	Intocrtmonitor.exe
740	Intocrtmonitor.exe
1728	fontdrvhost.exe
1728	fontdrvhost.exe
1728	fontdrvhost.exe
1728	fontdrvhost.exe
1728	fontdrvhost.exe
1728	fontdrvhost.exe
1728	fontdrvhost.exe
1728	fontdrvhost.exe
1728	fontdrvhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1728	fontdrvhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	740	Intocrtmonitor.exe
Token: SeDebugPrivilege	1728	fontdrvhost.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 2500	5096	2b599764c1e782b1e499d7b7bc9c12b291c5a19756cf89d4e2cef3193cc6c90b.exe	83
PID 5096 wrote to memory of 2500	5096	2b599764c1e782b1e499d7b7bc9c12b291c5a19756cf89d4e2cef3193cc6c90b.exe	83
PID 5096 wrote to memory of 2500	5096	2b599764c1e782b1e499d7b7bc9c12b291c5a19756cf89d4e2cef3193cc6c90b.exe	83
PID 2500 wrote to memory of 4516	2500	WScript.exe	87
PID 2500 wrote to memory of 4516	2500	WScript.exe	87
PID 2500 wrote to memory of 4516	2500	WScript.exe	87
PID 4516 wrote to memory of 740	4516	cmd.exe	89
PID 4516 wrote to memory of 740	4516	cmd.exe	89
PID 740 wrote to memory of 620	740	Intocrtmonitor.exe	133
PID 740 wrote to memory of 620	740	Intocrtmonitor.exe	133
PID 620 wrote to memory of 3044	620	cmd.exe	135
PID 620 wrote to memory of 3044	620	cmd.exe	135
PID 620 wrote to memory of 1728	620	cmd.exe	136
PID 620 wrote to memory of 1728	620	cmd.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2b599764c1e782b1e499d7b7bc9c12b291c5a19756cf89d4e2cef3193cc6c90b.exe
"C:\Users\Admin\AppData\Local\Temp\2b599764c1e782b1e499d7b7bc9c12b291c5a19756cf89d4e2cef3193cc6c90b.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\SurrogatecontainerAgentsavesdll\istAsVsoqBjp.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\SurrogatecontainerAgentsavesdll\G9tktHbnIT1ESBp2gkPanqMZ.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4516
  - - C:\SurrogatecontainerAgentsavesdll\Intocrtmonitor.exe
      "C:\SurrogatecontainerAgentsavesdll\Intocrtmonitor.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:740
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\S7PtvRZiWa.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:620
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3044
      - C:\Windows\Resources\Ease of Access Themes\fontdrvhost.exe
        
        "C:\Windows\Resources\Ease of Access Themes\fontdrvhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\MSBuild\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files\MSBuild\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\SurrogatecontainerAgentsavesdll\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\SurrogatecontainerAgentsavesdll\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\SurrogatecontainerAgentsavesdll\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Internet Explorer\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\SurrogatecontainerAgentsavesdll\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\SurrogatecontainerAgentsavesdll\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\SurrogatecontainerAgentsavesdll\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\SurrogatecontainerAgentsavesdll\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\SurrogatecontainerAgentsavesdll\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\SurrogatecontainerAgentsavesdll\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Windows\Branding\shellbrd\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\Branding\shellbrd\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Windows\Branding\shellbrd\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Windows\Resources\Ease of Access Themes\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Resources\Ease of Access Themes\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Windows\Resources\Ease of Access Themes\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IntocrtmonitorI" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Intocrtmonitor.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Intocrtmonitor" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Intocrtmonitor.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IntocrtmonitorI" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\Intocrtmonitor.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Media Player\it-IT\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\it-IT\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Media Player\it-IT\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Users\Public\AccountPictures\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Users\Public\AccountPictures\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\SurrogatecontainerAgentsavesdll\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\SurrogatecontainerAgentsavesdll\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\SurrogatecontainerAgentsavesdll\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Mozilla Firefox\uninstall\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\uninstall\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Mozilla Firefox\uninstall\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Sidebar\Gadgets\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Sidebar\Gadgets\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

G9tktHbnIT1ESBp2gkPanqMZ.bat

Path C:\SurrogatecontainerAgentsavesdll\G9tktHbnIT1ESBp2gkPanqMZ.bat
Size 55B
SHA256 aad154470e8ab1277a31d000af06c0f5281444d9d447779cfd37cea754a48bf1
MD5 74b96e1b4814887e264cae2975cdc1d1
SHA1 0f445c85a45fec3acfe12a20dc470e58355995e5
SHA512 6b081b689f4eca26257f3f570a14f50590e2d204e1a18bd986dcee56072d3322c4d8bcf2e068cc5f54e691ee9e66584b1110353bdf1f158ac08719e851c4a320
MD5 SHA1 SHA512

Submit Download

Intocrtmonitor.exe

Path C:\SurrogatecontainerAgentsavesdll\Intocrtmonitor.exe
Size 1001KB
SHA256 1eb7992ca97e8bb0b65faeaf69b30d9ac84406b1f35d6a900f8de748ab6a6a64
MD5 3146f2002112e5ba7562a28ff1883f9a
SHA1 9bd64b0954d746395e8080e563dbb39b254fac7d
SHA512 08e1e8c002269a4d611d21de3d037879abcbbf59f8f3744f27ee62b296adf61664f4f7afe0dc36bcdd4b5070fe6b7bf146ff94b0c682fee09e61bfa0935c3cfa
SSDEEP 12288:BiqbUK9S2Jhb/PZWzR6keiZAHOVEAKNZCKTh3VnGFOeRJmuHwj3x:hUK9SePZWzYrLHOdKRTh3heRJXQjx
MD5 SHA1 SHA512 SSDEEP

Submit Download

istAsVsoqBjp.vbe

Path C:\SurrogatecontainerAgentsavesdll\istAsVsoqBjp.vbe
Size 232B
SHA256 4a1b81c97b3d014b286d0a740c00819f65ef8366c89d5c0c264e7a6c634c4747
MD5 d217f6360486fb0b2015e036b2bda7ae
SHA1 ee4ad1ad7f0594f8727d0d0cea1a0fb70388e058
SHA512 78aa16897c7a2e9100a0e89300aff54c73f77e68fabe999f6b021d14c7bd4d7b732ee445c54381333396104002c86bf165e37a45e5669b0a05ffe4a791ed7d22
MD5 SHA1 SHA512

Submit Download

S7PtvRZiWa.bat

Path C:\Users\Admin\AppData\Local\Temp\S7PtvRZiWa.bat
Size 223B
SHA256 02d45f31f8749c31b4fd52fe70ee922a4eaa1f1f2816179cbe5bbd61c80e0607
MD5 7aa6b84a0e0269e64e1deebd21f5b355
SHA1 ac4c4e7f62764d898934df2b2091cae2ed3f2ce6
SHA512 5479c1b1f10e287094e2e5a8cddbf55fb43f2a6241c10caf4f9107ba0de374e7f7d12c2a40a41ad92abf704962187f6c90e03cd8b0a4420dae11538079fc3560
MD5 SHA1 SHA512

Submit Download

memory/740-12-0x00007FFA94813000-0x00007FFA94815000-memory.dmp

Download

memory/740-13-0x0000000000940000-0x0000000000A42000-memory.dmp

Download

memory/740-14-0x0000000002C30000-0x0000000002C4C000-memory.dmp

Download

memory/740-15-0x000000001B6F0000-0x000000001B740000-memory.dmp

Download