dcrat | a404a3f5f652da82f09f870d81476a452cae36f4a1378f90ec8ff06d6691e8cb

Analysis

max time kernel
500s
max time network
604s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
12/07/2024, 22:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Modrinth_Installer.exe
Size 6.4MB
Sample240712-11ynnsvbqf
SHA256 a404a3f5f652da82f09f870d81476a452cae36f4a1378f90ec8ff06d6691e8cb
MD5 1dba4e07fc018ea2f1d40969dbba02e6
SHA1 e4b6c58846286c6f3dc5eb51cdb3086a78f25606
SHA512 7add82374742df98c05913bc4c5a8a32fbadc44aa29c4c97f14f5a0ea1887fb04e4385a4a87d958128f5a1f74df449e5164ed5603089a06b40621ced5c57d3c2
SSDEEP 98304:NbjIgtzNT+6HE4ThcGalSS9d+udj3mYcCqQcgT3XV8tEbETvsDHaLqV710ZZ9rPE:NfI+/HMlS2JxmYcmcg7XGqb6Msq51GPE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat 52 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		996	schtasks.exe
		2340	schtasks.exe
		4636	schtasks.exe
		4568	schtasks.exe
		5116	schtasks.exe
		3892	schtasks.exe
		2124	schtasks.exe
		1640	schtasks.exe
		828	schtasks.exe
		2112	schtasks.exe
		4316	schtasks.exe
		5048	schtasks.exe
		4304	schtasks.exe
		4080	schtasks.exe
		2056	schtasks.exe
		708	schtasks.exe
		2052	schtasks.exe
		2496	schtasks.exe
		380	schtasks.exe
		3536	schtasks.exe
		3560	schtasks.exe
		4536	schtasks.exe
		220	schtasks.exe
		3380	schtasks.exe
		1656	schtasks.exe
		888	schtasks.exe
		4780	schtasks.exe
		3152	schtasks.exe
		2396	schtasks.exe
		1088	schtasks.exe
		1536	schtasks.exe
		884	schtasks.exe
		4328	schtasks.exe
		5100	schtasks.exe
		4604	schtasks.exe
		4308	schtasks.exe
		2336	schtasks.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000		Modrinth_Installer.exe
		2016	schtasks.exe
		1428	schtasks.exe
		3300	schtasks.exe
		2544	schtasks.exe
		2360	schtasks.exe
		1660	schtasks.exe
		2408	schtasks.exe
		2120	schtasks.exe
		3004	schtasks.exe
		4280	schtasks.exe
		4144	schtasks.exe
		2688	schtasks.exe
		656	schtasks.exe
		392	schtasks.exe

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	996	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1428	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	656	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5116	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	884	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3560	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3892	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3536	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5048	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4568	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	888	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	220	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3152	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3300	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	828	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2052	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4304	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4080	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4328	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5100	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3380	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4636	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3004	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2336	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4280	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4144	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1088	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	708	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4316	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	392	1380	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	1380	schtasks.exe	81

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sessionbrokerHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sessionbrokerHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sessionbrokerHost.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000900000001ab26-3.dat	dcrat
behavioral1/memory/1104-10-0x0000000000400000-0x0000000000A72000-memory.dmp	dcrat
behavioral1/files/0x000700000001ac14-35.dat	dcrat
behavioral1/memory/716-38-0x0000000000B20000-0x0000000000C0E000-memory.dmp	dcrat

Executes dropped EXE 9 IoCs

pid	Process
4664	Modrinth Installer.exe
716	sessionbrokerHost.exe
3376	dwm.exe
3000	spoolsv.exe
4880	RuntimeBroker.exe
4560	sppsvc.exe
2504	msiexec.exe
2492	csrss.exe
4628	sihost.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	4428	msiexec.exe
4	4428	msiexec.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sessionbrokerHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sessionbrokerHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Portable Devices\msiexec.exe	sessionbrokerHost.exe
File created	C:\Program Files (x86)\Windows Portable Devices\133006b48fb54b	sessionbrokerHost.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\spoolsv.exe	sessionbrokerHost.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\f3b6ecef712a24	sessionbrokerHost.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\dwm.exe	sessionbrokerHost.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\6cb0b6c459d5d3	sessionbrokerHost.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\csrss.exe	sessionbrokerHost.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\csrss.exe	sessionbrokerHost.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fontdrvhost.exe	sessionbrokerHost.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\886983d96e3d3e	sessionbrokerHost.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\5b884080fd4f94	sessionbrokerHost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Globalization\Sorting\133006b48fb54b	sessionbrokerHost.exe
File created	C:\Windows\Cursors\taskhostw.exe	sessionbrokerHost.exe
File created	C:\Windows\Cursors\ea9f0e6c9e2dcd	sessionbrokerHost.exe
File created	C:\Windows\ImmersiveControlPanel\SystemSettings\Assets\lsass.exe	sessionbrokerHost.exe
File created	C:\Windows\ImmersiveControlPanel\SystemSettings\Assets\6203df4a6bafc7	sessionbrokerHost.exe
File created	C:\Windows\Globalization\Sorting\msiexec.exe	sessionbrokerHost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	Modrinth_Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	Modrinth Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	sessionbrokerHost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4780	schtasks.exe
4080	schtasks.exe
4328	schtasks.exe
4144	schtasks.exe
1428	schtasks.exe
3892	schtasks.exe
2340	schtasks.exe
220	schtasks.exe
4304	schtasks.exe
2544	schtasks.exe
2408	schtasks.exe
996	schtasks.exe
2396	schtasks.exe
828	schtasks.exe
1088	schtasks.exe
2496	schtasks.exe
5116	schtasks.exe
3536	schtasks.exe
2052	schtasks.exe
2016	schtasks.exe
5048	schtasks.exe
5100	schtasks.exe
4308	schtasks.exe
4280	schtasks.exe
1660	schtasks.exe
2336	schtasks.exe
884	schtasks.exe
380	schtasks.exe
3152	schtasks.exe
3300	schtasks.exe
2120	schtasks.exe
2124	schtasks.exe
4568	schtasks.exe
888	schtasks.exe
4636	schtasks.exe
4604	schtasks.exe
708	schtasks.exe
4316	schtasks.exe
656	schtasks.exe
4536	schtasks.exe
2688	schtasks.exe
1640	schtasks.exe
3380	schtasks.exe
392	schtasks.exe
3560	schtasks.exe
3004	schtasks.exe
2360	schtasks.exe
2056	schtasks.exe
2112	schtasks.exe
1656	schtasks.exe
1536	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
716	sessionbrokerHost.exe
716	sessionbrokerHost.exe
716	sessionbrokerHost.exe
716	sessionbrokerHost.exe
716	sessionbrokerHost.exe
716	sessionbrokerHost.exe
716	sessionbrokerHost.exe
3376	dwm.exe
3376	dwm.exe
3376	dwm.exe
3376	dwm.exe
3376	dwm.exe
3376	dwm.exe
3376	dwm.exe
3376	dwm.exe
3376	dwm.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3376	dwm.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4428	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4428	msiexec.exe
Token: SeSecurityPrivilege	4544	msiexec.exe
Token: SeCreateTokenPrivilege	4428	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4428	msiexec.exe
Token: SeLockMemoryPrivilege	4428	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4428	msiexec.exe
Token: SeMachineAccountPrivilege	4428	msiexec.exe
Token: SeTcbPrivilege	4428	msiexec.exe
Token: SeSecurityPrivilege	4428	msiexec.exe
Token: SeTakeOwnershipPrivilege	4428	msiexec.exe
Token: SeLoadDriverPrivilege	4428	msiexec.exe
Token: SeSystemProfilePrivilege	4428	msiexec.exe
Token: SeSystemtimePrivilege	4428	msiexec.exe
Token: SeProfSingleProcessPrivilege	4428	msiexec.exe
Token: SeIncBasePriorityPrivilege	4428	msiexec.exe
Token: SeCreatePagefilePrivilege	4428	msiexec.exe
Token: SeCreatePermanentPrivilege	4428	msiexec.exe
Token: SeBackupPrivilege	4428	msiexec.exe
Token: SeRestorePrivilege	4428	msiexec.exe
Token: SeShutdownPrivilege	4428	msiexec.exe
Token: SeDebugPrivilege	4428	msiexec.exe
Token: SeAuditPrivilege	4428	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4428	msiexec.exe
Token: SeChangeNotifyPrivilege	4428	msiexec.exe
Token: SeRemoteShutdownPrivilege	4428	msiexec.exe
Token: SeUndockPrivilege	4428	msiexec.exe
Token: SeSyncAgentPrivilege	4428	msiexec.exe
Token: SeEnableDelegationPrivilege	4428	msiexec.exe
Token: SeManageVolumePrivilege	4428	msiexec.exe
Token: SeImpersonatePrivilege	4428	msiexec.exe
Token: SeCreateGlobalPrivilege	4428	msiexec.exe
Token: SeDebugPrivilege	716	sessionbrokerHost.exe
Token: SeDebugPrivilege	3376	dwm.exe
Token: SeDebugPrivilege	3000	spoolsv.exe
Token: SeDebugPrivilege	4880	RuntimeBroker.exe
Token: SeDebugPrivilege	4560	sppsvc.exe
Token: SeDebugPrivilege	2504	msiexec.exe
Token: SeDebugPrivilege	2492	csrss.exe
Token: SeDebugPrivilege	4628	sihost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4428	msiexec.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 4664	1104	Modrinth_Installer.exe	73
PID 1104 wrote to memory of 4664	1104	Modrinth_Installer.exe	73
PID 1104 wrote to memory of 4664	1104	Modrinth_Installer.exe	73
PID 1104 wrote to memory of 4428	1104	Modrinth_Installer.exe	74
PID 1104 wrote to memory of 4428	1104	Modrinth_Installer.exe	74
PID 1104 wrote to memory of 4428	1104	Modrinth_Installer.exe	74
PID 4664 wrote to memory of 1452	4664	Modrinth Installer.exe	75
PID 4664 wrote to memory of 1452	4664	Modrinth Installer.exe	75
PID 4664 wrote to memory of 1452	4664	Modrinth Installer.exe	75
PID 1452 wrote to memory of 2068	1452	WScript.exe	78
PID 1452 wrote to memory of 2068	1452	WScript.exe	78
PID 1452 wrote to memory of 2068	1452	WScript.exe	78
PID 2068 wrote to memory of 716	2068	cmd.exe	80
PID 2068 wrote to memory of 716	2068	cmd.exe	80
PID 716 wrote to memory of 1096	716	sessionbrokerHost.exe	133
PID 716 wrote to memory of 1096	716	sessionbrokerHost.exe	133
PID 1096 wrote to memory of 196	1096	cmd.exe	135
PID 1096 wrote to memory of 196	1096	cmd.exe	135
PID 1096 wrote to memory of 3376	1096	cmd.exe	136
PID 1096 wrote to memory of 3376	1096	cmd.exe	136

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sessionbrokerHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sessionbrokerHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sessionbrokerHost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Modrinth_Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Modrinth_Installer.exe"
1⤵
- DcRat
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Users\Admin\AppData\Local\Temp\Modrinth Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Modrinth Installer.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Chainserverhostnetcommon\YJTOmpNsmC9R7eL.vbe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1452
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Chainserverhostnetcommon\xvJlHi5CymWgg0Dp0wux5lJOn26p.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2068
    - - C:\Chainserverhostnetcommon\sessionbrokerHost.exe
        
        "C:\Chainserverhostnetcommon\sessionbrokerHost.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:716
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9PJtBgyuun.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1096
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:196
        
        C:\Users\Admin\dwm.exe
        
        "C:\Users\Admin\dwm.exe"
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3376
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Modrinth App_0.7.1_x64_en-US (2).msi"
  2⤵
  - Blocklisted process makes network request
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4428

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msiexecm" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\msiexec.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msiexec" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\msiexec.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msiexecm" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\msiexec.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Windows\Cursors\taskhostw.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\Cursors\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Windows\Cursors\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Windows\ImmersiveControlPanel\SystemSettings\Assets\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\ImmersiveControlPanel\SystemSettings\Assets\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Windows\ImmersiveControlPanel\SystemSettings\Assets\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Videos\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Admin\Videos\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Videos\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Chainserverhostnetcommon\taskhostw.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Chainserverhostnetcommon\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Chainserverhostnetcommon\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msiexecm" /sc MINUTE /mo 9 /tr "'C:\Windows\Globalization\Sorting\msiexec.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msiexec" /sc ONLOGON /tr "'C:\Windows\Globalization\Sorting\msiexec.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msiexecm" /sc MINUTE /mo 12 /tr "'C:\Windows\Globalization\Sorting\msiexec.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Chainserverhostnetcommon\sihost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Chainserverhostnetcommon\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Chainserverhostnetcommon\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Admin\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msiexecm" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\msiexec.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msiexec" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\msiexec.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msiexecm" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\msiexec.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2496

C:\Program Files (x86)\Windows Sidebar\Gadgets\spoolsv.exe
"C:\Program Files (x86)\Windows Sidebar\Gadgets\spoolsv.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3000

C:\Recovery\WindowsRE\RuntimeBroker.exe
C:\Recovery\WindowsRE\RuntimeBroker.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4880

C:\Recovery\WindowsRE\sppsvc.exe
C:\Recovery\WindowsRE\sppsvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4560

C:\Recovery\WindowsRE\msiexec.exe
C:\Recovery\WindowsRE\msiexec.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2504

C:\Recovery\WindowsRE\csrss.exe
C:\Recovery\WindowsRE\csrss.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2492

C:\Chainserverhostnetcommon\sihost.exe
C:\Chainserverhostnetcommon\sihost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

YJTOmpNsmC9R7eL.vbe

Path C:\Chainserverhostnetcommon\YJTOmpNsmC9R7eL.vbe
Size 230B
SHA256 97dba9f4d3e8ba6fa8f6f4534f4ed92bb85849d2da045abc84ef54d8777208db
MD5 d47f398bcb4d7af45368ac7e2b7956e4
SHA1 8acbdd4ae19bcad76b7ed2dfd94fa102df2914a6
SHA512 e63133d63e32081267d71220d54f3277559cf0f74883c6dd34bac8c73a41ef905ff4d66f2d9961af37cf07384f2f383e005d8b1bda8740807f1c295a581f5ee0
MD5 SHA1 SHA512

Submit Download

sessionbrokerHost.exe

Path C:\Chainserverhostnetcommon\sessionbrokerHost.exe
Size 922KB
SHA256 48b84c11bf2ccfe73802565024f5abc589b9bef4c0aece8439baee4f260112e0
MD5 f889fcff1de0857b351474a2e794b7ca
SHA1 c5c9be94d9bf74a382d01374a869b2c34f7179ac
SHA512 1d2bad15de6c57f699a81a13288be968bc0638b7629d741b795b07f608a0d8928d92da5f76d121ea0ed95fbc13c5ece7403fe8accb1aa870acda6414e7b6a561
SSDEEP 12288:rmyRpEZGO+od0l5H0qZ05i6QtQQykS1ZnxWEz5JEhDFQ0BMRn5eR3l:rbOZdy5HL0g3tQ9xWqJE73BS5eR3l
MD5 SHA1 SHA512 SSDEEP

Submit Download

xvJlHi5CymWgg0Dp0wux5lJOn26p.bat

Path C:\Chainserverhostnetcommon\xvJlHi5CymWgg0Dp0wux5lJOn26p.bat
Size 51B
SHA256 a154e1f761b72ef3fa982881229ac2ee7d9d358285ee241c911fde570f376bbe
MD5 e9cd2d5648ebb737cc9be7dbdf969056
SHA1 3e34a5cd97ed60e282301025ddca974614d74c5a
SHA512 e61b01bc01ffea738d9e4c7afd400fe815c46ee16223fdb9971b843d55e509b6529cbc0f0d36906b3d12ffc8124ad940499ab318573309bb624544e7bd17ad17
MD5 SHA1 SHA512

Submit Download

csrss.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log
Size 1KB
SHA256 375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12
MD5 d63ff49d7c92016feb39812e4db10419
SHA1 2307d5e35ca9864ffefc93acf8573ea995ba189b
SHA512 00f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a
MD5 SHA1 SHA512

Submit Download

9PJtBgyuun.bat

Path C:\Users\Admin\AppData\Local\Temp\9PJtBgyuun.bat
Size 187B
SHA256 11100bf088b292bbca60dacf176787fda19066ae6bf8dc3c261baa783b99e921
MD5 32b3938545f74a0a532771f9ea41a1da
SHA1 452b4d977416276458ef9b3899fc8f065fdaee67
SHA512 5cf1006de3d0e4fcfce54615e6c30daf2678140fbde5137a7d33cec292be80395fa2d219b8b4e8f5da37d56f3e468aa16ed65d29299d2d6935481cba2d91e380
MD5 SHA1 SHA512

Submit Download

Modrinth App_0.7.1_x64_en-US (2).msi

Path C:\Users\Admin\AppData\Local\Temp\Modrinth App_0.7.1_x64_en-US (2).msi
Size 5.0MB
SHA256 b1ac36000cee14b9c36aea4cef7f53ed2e7c18c9534b4ff66f07da11e8c07b59
MD5 5003486a784143bc96c3577172bbb44a
SHA1 9a960998807126041fae5b4fe9488d7ff3c5ca42
SHA512 3fd871414cffe35ae649dbb02935eddcad75ee094f2d61f2cef48827dfb852ff3b8e4211f913bf65e4619b2a4989a2807d876a920a105735ac3e59362802ee19
SSDEEP 98304:fNT+6HE4ThcGalSS9d+udj3mYcCqQcgT3XV8tEbETvsDHaLqV710ZZ9rPzrPW:1/HMlS2JxmYcmcg7XGqb6Msq51GP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Modrinth Installer.exe

Path C:\Users\Admin\AppData\Local\Temp\Modrinth Installer.exe
Size 1.2MB
SHA256 877d472af519397f8e8be5dcf8c756aed03e5ce022e6eba821f107336154ef81
MD5 f4211bfb02fddddf810c3cc71b249020
SHA1 02bc37e80ad498cd51a4321053d0feb788918aac
SHA512 6ccfb122f9ecb5e945e780d95d0cc0b721e624ac2390df2b36314c0e75d6b37ac71e184003405d898e84c9be462e6714555efb8396b91a617cf51740fb717630
SSDEEP 24576:U2G/nvxW3Ww0tXbOZdy5HL0g3tQ9xWqJE73BS5eR3lS:UbA30XQngo30E
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/716-38-0x0000000000B20000-0x0000000000C0E000-memory.dmp

Download

memory/716-39-0x00000000014C0000-0x00000000014C8000-memory.dmp

Download

memory/716-40-0x00000000014D0000-0x00000000014DA000-memory.dmp

Download

memory/716-41-0x000000001B6F0000-0x000000001B6FC000-memory.dmp

Download

memory/1104-10-0x0000000000400000-0x0000000000A72000-memory.dmp

Download