dcrat | 4c3355cc4f926ad3bc4f84e788068a50cb2a1f504d370aaaacfab6637a5e25cf

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 14:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EX Cheker.exe
Size 1.7MB
Sample240617-rh4yastgkd
SHA256 4c3355cc4f926ad3bc4f84e788068a50cb2a1f504d370aaaacfab6637a5e25cf
MD5 69afbcf3b102264681d1f9998f535e68
SHA1 63376d51e0dee30ac51aa3d8f6fdd6fce7eaf825
SHA512 6187ff7461ea1e3a553c675887dc645e6e7bbab55dc3e883f53fbd46a2191af3f90a6d2f1c66867afe99303dcad924216b33b864f744bc5cee278c9389a5b22a
SSDEEP 24576:U2G/nvxW3Ww0t9vl1hXFgMplxzp/hqve9yrd6bQTiy4qAbemvNIDZIMmkjd8:UbA309vl7pxzqvKodqy4DeoKDO5kjG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat spyware stealer trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1196	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5112	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4428	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3724	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1300	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4460	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4600	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4088	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4132	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4912	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	624	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4452	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4028	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1232	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3624	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3532	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4624	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	412	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	916	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3460	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3556	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	432	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1352	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	848	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4608	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3948	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3456	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3148	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2420	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1988	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2200	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3352	3552	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	3552	schtasks.exe	89

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	blockSurrogatesession.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	blockSurrogatesession.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	blockSurrogatesession.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023424-10.dat	dcrat
behavioral2/memory/5016-12-0x00000000001E0000-0x000000000034C000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	EX Cheker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	blockSurrogatesession.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 2 IoCs

pid	Process
5016	blockSurrogatesession.exe
1332	RuntimeBroker.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	blockSurrogatesession.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	blockSurrogatesession.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\SearchApp.exe	blockSurrogatesession.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\fontdrvhost.exe	blockSurrogatesession.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\5b884080fd4f94	blockSurrogatesession.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\sppsvc.exe	blockSurrogatesession.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\0a1fd5f707cd16	blockSurrogatesession.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\explorer.exe	blockSurrogatesession.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\7a0fd90576e088	blockSurrogatesession.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\38384e6a620884	blockSurrogatesession.exe
File created	C:\Program Files\VideoLAN\VLC\skins\fonts\RuntimeBroker.exe	blockSurrogatesession.exe
File created	C:\Program Files\VideoLAN\VLC\skins\fonts\9e8d7a4ca61bd9	blockSurrogatesession.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4624	schtasks.exe
3148	schtasks.exe
1608	schtasks.exe
4460	schtasks.exe
4428	schtasks.exe
2260	schtasks.exe
4936	schtasks.exe
4132	schtasks.exe
2244	schtasks.exe
5112	schtasks.exe
3460	schtasks.exe
624	schtasks.exe
2388	schtasks.exe
3056	schtasks.exe
4912	schtasks.exe
4028	schtasks.exe
916	schtasks.exe
432	schtasks.exe
1352	schtasks.exe
3724	schtasks.exe
1652	schtasks.exe
2984	schtasks.exe
4608	schtasks.exe
4452	schtasks.exe
1232	schtasks.exe
848	schtasks.exe
3948	schtasks.exe
2420	schtasks.exe
2760	schtasks.exe
2716	schtasks.exe
2164	schtasks.exe
3456	schtasks.exe
1988	schtasks.exe
4600	schtasks.exe
1300	schtasks.exe
3532	schtasks.exe
3556	schtasks.exe
2564	schtasks.exe
1196	schtasks.exe
3624	schtasks.exe
412	schtasks.exe
1708	schtasks.exe
2200	schtasks.exe
3352	schtasks.exe
4088	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings	EX Cheker.exe
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings	RuntimeBroker.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
5016	blockSurrogatesession.exe
5016	blockSurrogatesession.exe
5016	blockSurrogatesession.exe
5016	blockSurrogatesession.exe
5016	blockSurrogatesession.exe
5016	blockSurrogatesession.exe
5016	blockSurrogatesession.exe
5016	blockSurrogatesession.exe
5016	blockSurrogatesession.exe
5016	blockSurrogatesession.exe
5016	blockSurrogatesession.exe
5016	blockSurrogatesession.exe
5016	blockSurrogatesession.exe
5016	blockSurrogatesession.exe
5016	blockSurrogatesession.exe
5016	blockSurrogatesession.exe
5016	blockSurrogatesession.exe
5016	blockSurrogatesession.exe
1332	RuntimeBroker.exe
1332	RuntimeBroker.exe
1332	RuntimeBroker.exe
1332	RuntimeBroker.exe
1332	RuntimeBroker.exe
1332	RuntimeBroker.exe
1332	RuntimeBroker.exe
1332	RuntimeBroker.exe
1332	RuntimeBroker.exe
1332	RuntimeBroker.exe
1332	RuntimeBroker.exe
1332	RuntimeBroker.exe
1332	RuntimeBroker.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1332	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5016	blockSurrogatesession.exe
Token: SeDebugPrivilege	1332	RuntimeBroker.exe
Token: SeBackupPrivilege	1356	vssvc.exe
Token: SeRestorePrivilege	1356	vssvc.exe
Token: SeAuditPrivilege	1356	vssvc.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2392	2224	EX Cheker.exe	83
PID 2224 wrote to memory of 2392	2224	EX Cheker.exe	83
PID 2224 wrote to memory of 2392	2224	EX Cheker.exe	83
PID 2392 wrote to memory of 2320	2392	WScript.exe	86
PID 2392 wrote to memory of 2320	2392	WScript.exe	86
PID 2392 wrote to memory of 2320	2392	WScript.exe	86
PID 2320 wrote to memory of 5016	2320	cmd.exe	88
PID 2320 wrote to memory of 5016	2320	cmd.exe	88
PID 5016 wrote to memory of 1332	5016	blockSurrogatesession.exe	135
PID 5016 wrote to memory of 1332	5016	blockSurrogatesession.exe	135
PID 1332 wrote to memory of 3116	1332	RuntimeBroker.exe	136
PID 1332 wrote to memory of 3116	1332	RuntimeBroker.exe	136
PID 1332 wrote to memory of 1744	1332	RuntimeBroker.exe	137
PID 1332 wrote to memory of 1744	1332	RuntimeBroker.exe	137

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	blockSurrogatesession.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	blockSurrogatesession.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	blockSurrogatesession.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\EX Cheker.exe
"C:\Users\Admin\AppData\Local\Temp\EX Cheker.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\SavesCommon\Rykk8j79.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\SavesCommon\aj3oL98d.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2320
  - - C:\SavesCommon\blockSurrogatesession.exe
      "C:\SavesCommon\blockSurrogatesession.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:5016
    - - C:\Program Files\VideoLAN\VLC\skins\fonts\RuntimeBroker.exe
        
        "C:\Program Files\VideoLAN\VLC\skins\fonts\RuntimeBroker.exe"
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1332
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\04801d5a-46ac-4ec5-8647-098b3751923e.vbs"
        6⤵
        
        PID:3116
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4b8ea4ed-6d38-44c6-931a-1940b331acef.vbs"
        6⤵
        
        PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Microsoft OneDrive\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft OneDrive\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Microsoft OneDrive\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\SavesCommon\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\SavesCommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\SavesCommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\SavesCommon\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\SavesCommon\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\SavesCommon\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Common Files\microsoft shared\Source Engine\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\Source Engine\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Common Files\microsoft shared\Source Engine\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Videos\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Admin\Videos\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Videos\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\SavesCommon\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\SavesCommon\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\SavesCommon\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Downloads\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Public\Downloads\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Downloads\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\SavesCommon\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\SavesCommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\SavesCommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2760

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rykk8j79.vbe

Path C:\SavesCommon\Rykk8j79.vbe
Size 196B
SHA256 68e1f913ef22c414344c15bd15ecf25155dd751c83ced00e930c305ebf3954b3
MD5 8175d3e3a77ac089e12ed87b88918cba
SHA1 ecbf23a03bee2713701f848d3f2f84b50a8c34a3
SHA512 8cfc2bd383e1983264010d15f1d9c2851947d2e978b5996b81b19f67a79c6485e0e60020267fdf89571a0523d2a7d69ac93089e2c0f5e871c8845ff34361b3f5
MD5 SHA1 SHA512

Submit Download

aj3oL98d.bat

Path C:\SavesCommon\aj3oL98d.bat
Size 42B
SHA256 6a9463daf129066a367e794a57eff4eb7b4632945fa3f2869ab63fb218199071
MD5 26c7d82b1d69a346f7b6f20bd53ad1aa
SHA1 0e340e2fb78c2f6e82633a29a9eec8b6a80f2403
SHA512 60c71bc970d9b236fe4ce0093634a51b144cd4cea7a6a7e4fc9493338f14529d0ad1e24fc927494d6aecebc06078340f9b725ced57fdbd0d751beef9211af991
MD5 SHA1 SHA512

Submit Download

blockSurrogatesession.exe

Path C:\SavesCommon\blockSurrogatesession.exe
Size 1.4MB
SHA256 27841168a182b17e08a67b67a48467f970ab70a25975c6e8e8c68e38fcfbce36
MD5 ccf723c2a4e53539affeb430b0afc5c5
SHA1 257dbd6c98f74502cd70c526b94c33c52930286c
SHA512 083eae82fc45ce1d22c4bb2b0e21e3242d199690608d1e9c52a4e7e93bd59ee46c3beb0c38554513ec06bf9ec4c3d584334ed316cef0b5e4c00cebe27c5ae971
SSDEEP 24576:Cvl1hXFgMplxzp/hqve9yrd6bQTiy4qAbemvNIDZIMmkjd:Cvl7pxzqvKodqy4DeoKDO5kj
MD5 SHA1 SHA512 SSDEEP

Submit Download

04801d5a-46ac-4ec5-8647-098b3751923e.vbs

Path C:\Users\Admin\AppData\Local\Temp\04801d5a-46ac-4ec5-8647-098b3751923e.vbs
Size 735B
SHA256 0fdae8d1af320c82150d2403d7aeeeabcfeb48f24034144ea9247f1d0a74d0f5
MD5 31a68ce092a399f11a8e9d5a4242961c
SHA1 9d09455cfbd8e6158ea233dd45fa15427f5dd27f
SHA512 5e6cff19197e4100af10a34819df567790fc3681e8cc6d239b485e6eea052a8699a1818038f299719293d143de2b44bb7d38420ba1c40c987b30ebcaa0814466
MD5 SHA1 SHA512

Submit Download

4b8ea4ed-6d38-44c6-931a-1940b331acef.vbs

Path C:\Users\Admin\AppData\Local\Temp\4b8ea4ed-6d38-44c6-931a-1940b331acef.vbs
Size 511B
SHA256 6430aafc4887d3844fe064fc6713918b0cb229977923725ac60e45648683e7c4
MD5 7e69e8580ae4016d06974a4715a2cbac
SHA1 6a2de28b7933129f89dd3dcdaef6d5447ff8e254
SHA512 7d50bf0b4501eaf6dafc16dbb3ea13ba428aac7df43f96ce3ca4153a5f493b39f68c7701ffcdb2aab877d6732b1d4c62cb4c5b46b534496735a00731b4fc18ce
MD5 SHA1 SHA512

Submit Download

memory/1332-111-0x000000001E400000-0x000000001E5A9000-memory.dmp

Download

memory/5016-17-0x0000000002490000-0x00000000024A0000-memory.dmp

Download

memory/5016-16-0x00000000024E0000-0x0000000002530000-memory.dmp

Download

memory/5016-15-0x0000000002470000-0x000000000248C000-memory.dmp

Download

memory/5016-18-0x00000000024A0000-0x00000000024B6000-memory.dmp

Download

memory/5016-19-0x00000000024C0000-0x00000000024CA000-memory.dmp

Download

memory/5016-20-0x00000000024D0000-0x00000000024DA000-memory.dmp

Download

memory/5016-22-0x000000001B020000-0x000000001B02C000-memory.dmp

Download

memory/5016-21-0x000000001B010000-0x000000001B018000-memory.dmp

Download

memory/5016-14-0x0000000002460000-0x000000000246E000-memory.dmp

Download

memory/5016-12-0x00000000001E0000-0x000000000034C000-memory.dmp

Download

memory/5016-13-0x00007FFEC06F3000-0x00007FFEC06F5000-memory.dmp

Download