dcrat | 564da53b4bfb006eab7b88023aec9551d8d68da31dd567442dc35f1ff807e78e

Analysis

max time kernel
133s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2024, 01:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
12b1d0212363628cb57d2379017b94d6bf91029b37b2dcee592a564952855694.exe
Size 13.5MB
Sample240702-b7jqnavhrk
SHA256 12b1d0212363628cb57d2379017b94d6bf91029b37b2dcee592a564952855694
MD5 a26a308a71c3fd57cd4fad9dc8d55fb1
SHA1 3722d8d2b321f72b2e207a8e1f7e408d35c7d607
SHA512 306868bb537ffae0a7cd4de76b0f52079b2aa5f744f50abe3a866f4bb2f17a829cb91537a30c76240798248a0e9da6d5f92591ed1e7101337e2aa0f78e764e55
SSDEEP 393216:n5BbqQ/ThnhIxo1S/Js7D+xZlwRjMAke5F:5P4xy0ADFRYAj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat bootkit infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 33 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4352	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4824	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3172	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3656	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4516	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	212	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5032	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1152	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4712	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1452	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3524	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4444	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4608	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3692	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3240	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	816	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4092	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3964	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4372	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4040	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	436	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3432	1904	schtasks.exe	107
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3744	1904	schtasks.exe	107

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000700000002353d-53.dat	dcrat
behavioral2/files/0x0007000000023546-74.dat	dcrat
behavioral2/memory/3264-77-0x00000000005D0000-0x000000000073A000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	NVIDIA Container.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	NVIDIA Container.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	NVIDIA Container.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	12b1d0212363628cb57d2379017b94d6bf91029b37b2dcee592a564952855694.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Стоны.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Ykraine.exe

Executes dropped EXE 9 IoCs

pid	Process
4992	hitler.exe
2920	tin.exe
1028	Ykraine.exe
4956	Стоны.exe
228	NVIDIA Container.exe
2864	NVIDIA Container.exe
3264	NVIDIA Container.exe
2348	NVIDIA Container.exe
748	spoolsv.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	tin.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Media Player\WaaSMedicAgent.exe	NVIDIA Container.exe
File created	C:\Program Files\Windows Media Player\c82b8037eab33d	NVIDIA Container.exe
File created	C:\Program Files (x86)\Windows Defender\dllhost.exe	NVIDIA Container.exe
File created	C:\Program Files (x86)\Windows Defender\5940a34987c991	NVIDIA Container.exe
File created	C:\Program Files\Windows Defender\SppExtComObj.exe	NVIDIA Container.exe
File created	C:\Program Files\Windows Defender\e1ef82546f0b02	NVIDIA Container.exe
File created	C:\Program Files (x86)\Adobe\wininit.exe	NVIDIA Container.exe
File created	C:\Program Files (x86)\Adobe\56085415360792	NVIDIA Container.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	NVIDIA Container.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	NVIDIA Container.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	NVIDIA Container.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4444	schtasks.exe
3240	schtasks.exe
436	schtasks.exe
2756	schtasks.exe
1648	schtasks.exe
2320	schtasks.exe
2312	schtasks.exe
1492	schtasks.exe
816	schtasks.exe
4608	schtasks.exe
4824	schtasks.exe
3656	schtasks.exe
5032	schtasks.exe
1452	schtasks.exe
3048	schtasks.exe
4516	schtasks.exe
212	schtasks.exe
2104	schtasks.exe
3964	schtasks.exe
4372	schtasks.exe
3432	schtasks.exe
3744	schtasks.exe
3172	schtasks.exe
2096	schtasks.exe
1152	schtasks.exe
4712	schtasks.exe
4352	schtasks.exe
2144	schtasks.exe
3692	schtasks.exe
1544	schtasks.exe
3524	schtasks.exe
4092	schtasks.exe
4040	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3264	NVIDIA Container.exe
3264	NVIDIA Container.exe
3264	NVIDIA Container.exe
3264	NVIDIA Container.exe
3264	NVIDIA Container.exe
3264	NVIDIA Container.exe
3264	NVIDIA Container.exe
3264	NVIDIA Container.exe
3264	NVIDIA Container.exe
3264	NVIDIA Container.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2348	NVIDIA Container.exe
Token: SeDebugPrivilege	3264	NVIDIA Container.exe
Token: 33	1412	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1412	AUDIODG.EXE
Token: SeDebugPrivilege	748	spoolsv.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 4992	4892	12b1d0212363628cb57d2379017b94d6bf91029b37b2dcee592a564952855694.exe	89
PID 4892 wrote to memory of 4992	4892	12b1d0212363628cb57d2379017b94d6bf91029b37b2dcee592a564952855694.exe	89
PID 4892 wrote to memory of 2920	4892	12b1d0212363628cb57d2379017b94d6bf91029b37b2dcee592a564952855694.exe	90
PID 4892 wrote to memory of 2920	4892	12b1d0212363628cb57d2379017b94d6bf91029b37b2dcee592a564952855694.exe	90
PID 4892 wrote to memory of 2920	4892	12b1d0212363628cb57d2379017b94d6bf91029b37b2dcee592a564952855694.exe	90
PID 4892 wrote to memory of 1028	4892	12b1d0212363628cb57d2379017b94d6bf91029b37b2dcee592a564952855694.exe	91
PID 4892 wrote to memory of 1028	4892	12b1d0212363628cb57d2379017b94d6bf91029b37b2dcee592a564952855694.exe	91
PID 4892 wrote to memory of 4956	4892	12b1d0212363628cb57d2379017b94d6bf91029b37b2dcee592a564952855694.exe	92
PID 4892 wrote to memory of 4956	4892	12b1d0212363628cb57d2379017b94d6bf91029b37b2dcee592a564952855694.exe	92
PID 4956 wrote to memory of 228	4956	Стоны.exe	93
PID 4956 wrote to memory of 228	4956	Стоны.exe	93
PID 4956 wrote to memory of 228	4956	Стоны.exe	93
PID 1028 wrote to memory of 2864	1028	Ykraine.exe	94
PID 1028 wrote to memory of 2864	1028	Ykraine.exe	94
PID 1028 wrote to memory of 2864	1028	Ykraine.exe	94
PID 2864 wrote to memory of 1412	2864	NVIDIA Container.exe	96
PID 2864 wrote to memory of 1412	2864	NVIDIA Container.exe	96
PID 2864 wrote to memory of 1412	2864	NVIDIA Container.exe	96
PID 228 wrote to memory of 4116	228	NVIDIA Container.exe	97
PID 228 wrote to memory of 4116	228	NVIDIA Container.exe	97
PID 228 wrote to memory of 4116	228	NVIDIA Container.exe	97
PID 1412 wrote to memory of 1652	1412	WScript.exe	100
PID 1412 wrote to memory of 1652	1412	WScript.exe	100
PID 1412 wrote to memory of 1652	1412	WScript.exe	100
PID 4116 wrote to memory of 4832	4116	WScript.exe	102
PID 4116 wrote to memory of 4832	4116	WScript.exe	102
PID 4116 wrote to memory of 4832	4116	WScript.exe	102
PID 4832 wrote to memory of 2348	4832	cmd.exe	106
PID 4832 wrote to memory of 2348	4832	cmd.exe	106
PID 1652 wrote to memory of 3264	1652	cmd.exe	105
PID 1652 wrote to memory of 3264	1652	cmd.exe	105
PID 3264 wrote to memory of 704	3264	NVIDIA Container.exe	141
PID 3264 wrote to memory of 704	3264	NVIDIA Container.exe	141
PID 704 wrote to memory of 532	704	cmd.exe	143
PID 704 wrote to memory of 532	704	cmd.exe	143
PID 704 wrote to memory of 748	704	cmd.exe	148
PID 704 wrote to memory of 748	704	cmd.exe	148

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\12b1d0212363628cb57d2379017b94d6bf91029b37b2dcee592a564952855694.exe
"C:\Users\Admin\AppData\Local\Temp\12b1d0212363628cb57d2379017b94d6bf91029b37b2dcee592a564952855694.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Users\Admin\AppData\Local\Temp\hitler.exe
  "C:\Users\Admin\AppData\Local\Temp\hitler.exe"
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Users\Admin\AppData\Local\Temp\tin.exe
  "C:\Users\Admin\AppData\Local\Temp\tin.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  PID:2920
- C:\Users\Admin\AppData\Local\Temp\Ykraine.exe
  "C:\Users\Admin\AppData\Local\Temp\Ykraine.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe
    "C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\NVIDIA\DisplayDriver\535.21\zajaYJ4rqwpmDK2a6yrvwdV.vbe"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:1412
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\NVIDIA\DisplayDriver\535.21\mxJne99RtKqQDunPUGdos.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1652
      - C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe
        
        "C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3264
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HZ9NloXtmb.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:704
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:532
        
        C:\NVIDIA\DisplayDriver\535.21\spoolsv.exe
        
        "C:\NVIDIA\DisplayDriver\535.21\spoolsv.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:748
- C:\Users\Admin\AppData\Local\Temp\Стоны.exe
  "C:\Users\Admin\AppData\Local\Temp\Стоны.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe
    "C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:228
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\NVIDIA\DisplayDriver\535.21\zajaYJ4rqwpmDK2a6yrvwdV.vbe"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:4116
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\NVIDIA\DisplayDriver\535.21\mxJne99RtKqQDunPUGdos.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4832
      - C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe
        
        "C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=996,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:8
1⤵
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Default User\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\NVIDIA\DisplayDriver\535.21\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\NVIDIA\DisplayDriver\535.21\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\NVIDIA\DisplayDriver\535.21\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\NVIDIA\DisplayDriver\535.21\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\NVIDIA\DisplayDriver\535.21\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\NVIDIA\DisplayDriver\535.21\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Defender\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Adobe\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\WaaSMedicAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Media Player\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "NVIDIA ContainerN" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\NVIDIA Container.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "NVIDIA Container" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\NVIDIA Container.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "NVIDIA ContainerN" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\NVIDIA Container.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\NVIDIA\DisplayDriver\535.21\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\NVIDIA\DisplayDriver\535.21\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\NVIDIA\DisplayDriver\535.21\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Defender\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3744

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3c4 0x3bc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NVIDIA Container.exe

Path C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe
Size 1.4MB
SHA256 b495e22042b08f27b690da18986ec74d5054a65d05d5cf41fdecd5751482ccbd
MD5 4a591f46c87b49a7de93f5ac771cd4ab
SHA1 e0992350818e5c56d3f2e3a6db340d1f5b8f3314
SHA512 b498445d1e427853690250aebff35cbd7e28e85a89ad868e3483930b16ec13198357cfcd5feb45567b1bc8f3d9f97c5ecf2d242c8a5e9d758a536d0498ba7955
SSDEEP 24576:gi39O3pP/GFPWjOo8hSrOfT4tPSNUIF+lL+FsxQ/MR9Gv6Yv+aX7:gwRVQysEUCHaiy9Gvk
MD5 SHA1 SHA512 SSDEEP

Submit Download

mxJne99RtKqQDunPUGdos.bat

Path C:\NVIDIA\DisplayDriver\535.21\mxJne99RtKqQDunPUGdos.bat
Size 53B
SHA256 0385dbf94fc27705560cf0b6b04e9a37181db486ee8f7573c5ad2217d18f4ca0
MD5 7784d810f5ff3afa8df50e360eb90e7d
SHA1 f04802a991ff6461aa1c35b7c0f68e43d5a114c6
SHA512 80038ae2bfd5f8ca3f4812ab5c342878f98978007125c9dca5edb915701a5383916131cdc3082c054c49c508cd210aff70319ac0fc498cbdd6cee776df672cac
MD5 SHA1 SHA512

Submit Download

zajaYJ4rqwpmDK2a6yrvwdV.vbe

Path C:\NVIDIA\DisplayDriver\535.21\zajaYJ4rqwpmDK2a6yrvwdV.vbe
Size 225B
SHA256 d3bf5c54de984dd2d1d779494deb8a995cc062eb5f25c465d0de78d99b8cc52b
MD5 d7df2670ad0c6c7b9cc48122f20f086c
SHA1 e69bf8c214d8c4b768125ca03e402e1c871cc233
SHA512 05ed88410790bf74dc7ab880f893e555c4859c133e79a89f28b5e1a68c36f4a4f28d3b7b6532953c04b6d23a21faf53e60107efde9e6acb492a9235d48943f03
MD5 SHA1 SHA512

Submit Download

NVIDIA Container.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\NVIDIA Container.exe.log
Size 1KB
SHA256 29f5645ac14353ac460858f52c856548f3aeb144b09eef672a6b4849bafe742e
MD5 7800fca2323a4130444c572374a030f4
SHA1 40c9b8e0e5e7d72a5293f4010f2ccf21e637b4aa
SHA512 c8a7ad930b8c07007c7a67d8c32a2a4a401dcc34ab966e0e80901655fcbe1f5c95b72a195e6381b1de56c2c987eeab093d8e89891bec9e9684785c5d824b3554
MD5 SHA1 SHA512

Submit Download

HZ9NloXtmb.bat

Path C:\Users\Admin\AppData\Local\Temp\HZ9NloXtmb.bat
Size 207B
SHA256 3984b5cf9ce26fa8b317837d38e04b38cd0035187e60b02c21355177a63dda37
MD5 b6c12433e3e15978d9a03b925500fecd
SHA1 df5348d97178b5a2bfbb250524143dae18510eb1
SHA512 b11edeb813af34e99d723d8b3666da6f95c7dbf13404f46d47f86184d3767381ee623f4bc162212c01f388c58bcaa68f5db7dbd8d517490d7e47894bdfb7969c
MD5 SHA1 SHA512

Submit Download

NVIDIA Container.exe

Path C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe
Size 1.8MB
SHA256 67942630366d114efa35f3f4a79741a4a4eb2c3b0c8ffaac07af527f84d4489a
MD5 531bf67134a7c1fb4096113ca58cc648
SHA1 99e0fc1fb7a07c0685e426b327921d3e6c34498c
SHA512 8facae8335a4f33f54e48c64814946eb8b480800b4453612fffcef64117946a35d493f433d4e27186ee864603da756319f816e70c3bfc08b8bb1861fc7030ff4
SSDEEP 24576:92G/nvxW3WDGkIJ1i39O3pP/GFPWjOo8hSrOfT4tPSNUIF+lL+FsxQ/MR9Gv6Yvg:9bA3gy1wRVQysEUCHaiy9Gvkh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ykraine.exe

Path C:\Users\Admin\AppData\Local\Temp\Ykraine.exe
Size 1.4MB
SHA256 bae4b959e9f74d9d085067b57a805654c86cc45f8c7cd32b9711874504ae59dd
MD5 da5341ed73474db53c94c38f66e210ae
SHA1 49d8d239ac77cde765c8f516be1e52c3d2d37a2e
SHA512 c2c5cf298aa6476b043e9afcd2ca4a2e685b8a96187d69b834f9f3761aa1d525a4b032d19ea03d349ef32a3ba699c3126bc359cb7f117395f5303ebebf310572
SSDEEP 24576:QRiyhSUnZ0oEON48G1LDJlMs8EcOU9qFqmP+hGHU2B5NC13BGJlepJb2wcp4TYz1:QR0Un+oZN47/JLczmhPCPGJleSbpWUpv
MD5 SHA1 SHA512 SSDEEP

Submit Download

hitler.exe

Path C:\Users\Admin\AppData\Local\Temp\hitler.exe
Size 10.4MB
SHA256 1b2a026beda12eff88e2397931018031e4358de05aa449e3441434e6cf5dad6c
MD5 3a1733f19b9ca74fe793df23700c3519
SHA1 31cf4474f0ac00d45c19b7e31e7dc9fde3054091
SHA512 0cd23dce1880c0b11d19f7d58102020baba7033e828aee233f8ed6b7d11c622d1dcec38c4a3e6c4691e07f7a1609fe550a30517e662236e164e550e87bea777b
SSDEEP 196608:PzFUayJ3rXjYHfYVEo51LUd5vKUcrqj/PvvYj5pFF7hlQgu5:Pyp3rXjS7cNU5vK5rq3vvYN/Ogu
MD5 SHA1 SHA512 SSDEEP

Submit Download

tin.exe

Path C:\Users\Admin\AppData\Local\Temp\tin.exe
Size 439KB
SHA256 c9fffa589040d8a6d22285255604948ff3bb3efa7077c776b6b09272bc293b7d
MD5 b3edc0708fb191e2d3016c68585ed31e
SHA1 ab1ce0cb2a819b82206dc1e922e97b284b585d17
SHA512 77b67f4cf6344f56e20172357831497c6ae4ff57c5a852762437419a7e5819805e10098dc87f90e937cf7603b72a94e6cf66681e1602974355fae8644b2a42dc
SSDEEP 12288:WHt2oRiGYi03velDeWJcqLofSfAuyOrC:c7zoWJchf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Стоны.exe

Path C:\Users\Admin\AppData\Local\Temp\Стоны.exe
Size 1.5MB
SHA256 8e9e6d72b2a39b62c7341bdc0f529a070f25b2c33bfefe5b6cc6e5d3c86590e9
MD5 90132dd5e5a65801d56cb0b20c92d724
SHA1 bec1e6ef261f88b0aca2cb0aca2ea1eaf5f9aae7
SHA512 e8c0bb9a9390558a117bdf5518a136a41b84417b01b835d092202b3e2d644bf997bd344e2a3f2a971aae5b5bcdeb85865250be5fcf86e840d854cbc7791e5f33
SSDEEP 24576:hqab4rQZbQuYQp1dKoTnp5C1jN5MbScld8YCjSPdNXj3Y5mJpHFWRhiq4/Kmaw5i:lZb7lTD8jDKJdecT7Y4HFKiq4Cmaij
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1028-43-0x0000000000CA0000-0x0000000000E18000-memory.dmp

Download

memory/2920-44-0x0000000000E50000-0x0000000000EED000-memory.dmp

Download

memory/3264-81-0x0000000002700000-0x0000000002710000-memory.dmp

Download

memory/3264-83-0x00000000028C0000-0x00000000028CE000-memory.dmp

Download

memory/3264-84-0x00000000028D0000-0x00000000028DC000-memory.dmp

Download

memory/3264-82-0x00000000028B0000-0x00000000028BE000-memory.dmp

Download

memory/3264-79-0x000000001B3E0000-0x000000001B430000-memory.dmp

Download

memory/3264-80-0x00000000026E0000-0x00000000026F6000-memory.dmp

Download

memory/3264-77-0x00000000005D0000-0x000000000073A000-memory.dmp

Download

memory/3264-78-0x00000000026B0000-0x00000000026CC000-memory.dmp

Download

memory/4892-0-0x00007FF94B923000-0x00007FF94B925000-memory.dmp

Download

memory/4892-1-0x00000000009E0000-0x000000000176A000-memory.dmp

Download

memory/4892-4-0x00007FF94B920000-0x00007FF94C3E1000-memory.dmp

Download

memory/4892-50-0x00007FF94B920000-0x00007FF94C3E1000-memory.dmp

Download

memory/4956-49-0x0000000000E40000-0x0000000000FC8000-memory.dmp

Download

memory/4992-68-0x00007FF94B920000-0x00007FF94C3E1000-memory.dmp

Download

memory/4992-40-0x0000000000670000-0x00000000010D0000-memory.dmp

Download

memory/4992-34-0x00007FF94B920000-0x00007FF94C3E1000-memory.dmp

Download