dcrat | f9adac1ef0311f015cbb89d89b24b47dace93d4fafd417af475b09def8034c3f

Analysis

max time kernel
131s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 08:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
45ff4bbe10d3e2a0561d19219a4738e2.exe
Size 1.2MB
Sample240912-kbvbyszarm
SHA256 f9adac1ef0311f015cbb89d89b24b47dace93d4fafd417af475b09def8034c3f
MD5 45ff4bbe10d3e2a0561d19219a4738e2
SHA1 2bbb1c2ecf9dd62c9f22253030ae7a7b168d09a4
SHA512 ab2ccf3dce770ac2b9ac7dcb3acc402ecacc951172a4291f8e0fb39cff5caa5e93058c97ecd78e154e415c7ff9b9395549cff5c546f22beaf2627964f05c482f
SSDEEP 24576:RjRu6SPKv/PvX2av85I1eBXJN46S2tYmLvnPlNbsN1owQNrLhEl:lvuKfvms85I1oOMYmLP9aN1zQNa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat xworm discovery infostealer rat trojan

Malware Config

Extracted

Family

xworm

147.185.221.22:8888

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral1/files/0x000d000000012262-5.dat	family_xworm
behavioral1/memory/2976-7-0x0000000000030000-0x0000000000046000-memory.dmp	family_xworm
behavioral1/memory/1856-80-0x0000000000150000-0x0000000000166000-memory.dmp	family_xworm
behavioral1/memory/2948-82-0x00000000001A0000-0x00000000001B6000-memory.dmp	family_xworm

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1280	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2404	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1324	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	468	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	236	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1988	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	668	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	428	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1344	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1496	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1236	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	528	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2452	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	892	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	284	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1264	2620	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	2620	schtasks.exe	33

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016d92-12.dat	dcrat
behavioral1/files/0x0006000000016d9c-25.dat	dcrat
behavioral1/memory/1596-29-0x0000000000B20000-0x0000000000BF6000-memory.dmp	dcrat
behavioral1/memory/2808-76-0x0000000000CF0000-0x0000000000DC6000-memory.dmp	dcrat

Executes dropped EXE 6 IoCs

pid	Process
2976	1st.exe
2764	2nd.exe
1596	chainsessionhost.exe
2808	dwm.exe
1856	XClient.exe
2948	XClient.exe

Loads dropped DLL 2 IoCs

pid	Process
1720	cmd.exe
1720	cmd.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Photo Viewer\5940a34987c991	chainsessionhost.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\services.exe	chainsessionhost.exe
File created	C:\Program Files (x86)\Common Files\Services\conhost.exe	chainsessionhost.exe
File created	C:\Program Files (x86)\Internet Explorer\fr-FR\ebf1f9fa8afd6d	chainsessionhost.exe
File created	C:\Program Files\Windows Photo Viewer\dllhost.exe	chainsessionhost.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\56085415360792	chainsessionhost.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\c5b4cb5e9653cc	chainsessionhost.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\wininit.exe	chainsessionhost.exe
File created	C:\Program Files (x86)\Google\CrashReports\chainsessionhost.exe	chainsessionhost.exe
File created	C:\Program Files (x86)\Google\CrashReports\7be879be6c0afb	chainsessionhost.exe
File created	C:\Program Files (x86)\Common Files\Services\088424020bedd6	chainsessionhost.exe
File created	C:\Program Files (x86)\Internet Explorer\fr-FR\cmd.exe	chainsessionhost.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\audiodg.exe	chainsessionhost.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\42af1c969fbb7b	chainsessionhost.exe
File created	C:\Program Files\Uninstall Information\services.exe	chainsessionhost.exe
File created	C:\Program Files\Uninstall Information\c5b4cb5e9653cc	chainsessionhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SchCache\6cb0b6c459d5d3	chainsessionhost.exe
File created	C:\Windows\SchCache\dwm.exe	chainsessionhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2nd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 55 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2900	schtasks.exe
2020	schtasks.exe
2540	schtasks.exe
3016	schtasks.exe
2672	schtasks.exe
2188	schtasks.exe
892	schtasks.exe
236	schtasks.exe
1712	schtasks.exe
2360	schtasks.exe
2728	schtasks.exe
1264	schtasks.exe
2872	schtasks.exe
1940	schtasks.exe
1948	schtasks.exe
1144	schtasks.exe
2724	schtasks.exe
2776	schtasks.exe
2088	schtasks.exe
2712	schtasks.exe
2564	schtasks.exe
1496	schtasks.exe
1236	schtasks.exe
1576	schtasks.exe
284	schtasks.exe
2060	schtasks.exe
2152	schtasks.exe
2244	schtasks.exe
1924	schtasks.exe
1752	schtasks.exe
1604	schtasks.exe
2404	schtasks.exe
468	schtasks.exe
528	schtasks.exe
1704	schtasks.exe
1988	schtasks.exe
668	schtasks.exe
1160	schtasks.exe
1280	schtasks.exe
2912	schtasks.exe
1932	schtasks.exe
2748	schtasks.exe
536	schtasks.exe
1344	schtasks.exe
2452	schtasks.exe
2960	schtasks.exe
2116	schtasks.exe
2992	schtasks.exe
1528	schtasks.exe
2412	schtasks.exe
1544	schtasks.exe
952	schtasks.exe
1324	schtasks.exe
428	schtasks.exe
1732	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1596	chainsessionhost.exe
1596	chainsessionhost.exe
1596	chainsessionhost.exe
1596	chainsessionhost.exe
1596	chainsessionhost.exe
2808	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2976	1st.exe
Token: SeDebugPrivilege	1596	chainsessionhost.exe
Token: SeDebugPrivilege	2976	1st.exe
Token: SeDebugPrivilege	2808	dwm.exe
Token: SeDebugPrivilege	1856	XClient.exe
Token: SeDebugPrivilege	2948	XClient.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2976	2716	45ff4bbe10d3e2a0561d19219a4738e2.exe	30
PID 2716 wrote to memory of 2976	2716	45ff4bbe10d3e2a0561d19219a4738e2.exe	30
PID 2716 wrote to memory of 2976	2716	45ff4bbe10d3e2a0561d19219a4738e2.exe	30
PID 2716 wrote to memory of 2764	2716	45ff4bbe10d3e2a0561d19219a4738e2.exe	31
PID 2716 wrote to memory of 2764	2716	45ff4bbe10d3e2a0561d19219a4738e2.exe	31
PID 2716 wrote to memory of 2764	2716	45ff4bbe10d3e2a0561d19219a4738e2.exe	31
PID 2716 wrote to memory of 2764	2716	45ff4bbe10d3e2a0561d19219a4738e2.exe	31
PID 2764 wrote to memory of 2772	2764	2nd.exe	32
PID 2764 wrote to memory of 2772	2764	2nd.exe	32
PID 2764 wrote to memory of 2772	2764	2nd.exe	32
PID 2764 wrote to memory of 2772	2764	2nd.exe	32
PID 2772 wrote to memory of 1720	2772	WScript.exe	34
PID 2772 wrote to memory of 1720	2772	WScript.exe	34
PID 2772 wrote to memory of 1720	2772	WScript.exe	34
PID 2772 wrote to memory of 1720	2772	WScript.exe	34
PID 1720 wrote to memory of 1596	1720	cmd.exe	36
PID 1720 wrote to memory of 1596	1720	cmd.exe	36
PID 1720 wrote to memory of 1596	1720	cmd.exe	36
PID 1720 wrote to memory of 1596	1720	cmd.exe	36
PID 1596 wrote to memory of 1800	1596	chainsessionhost.exe	91
PID 1596 wrote to memory of 1800	1596	chainsessionhost.exe	91
PID 1596 wrote to memory of 1800	1596	chainsessionhost.exe	91
PID 2976 wrote to memory of 1704	2976	1st.exe	93
PID 2976 wrote to memory of 1704	2976	1st.exe	93
PID 2976 wrote to memory of 1704	2976	1st.exe	93
PID 1800 wrote to memory of 2908	1800	cmd.exe	95
PID 1800 wrote to memory of 2908	1800	cmd.exe	95
PID 1800 wrote to memory of 2908	1800	cmd.exe	95
PID 1800 wrote to memory of 2808	1800	cmd.exe	96
PID 1800 wrote to memory of 2808	1800	cmd.exe	96
PID 1800 wrote to memory of 2808	1800	cmd.exe	96
PID 2160 wrote to memory of 1856	2160	taskeng.exe	99
PID 2160 wrote to memory of 1856	2160	taskeng.exe	99
PID 2160 wrote to memory of 1856	2160	taskeng.exe	99
PID 2160 wrote to memory of 2948	2160	taskeng.exe	100
PID 2160 wrote to memory of 2948	2160	taskeng.exe	100
PID 2160 wrote to memory of 2948	2160	taskeng.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\45ff4bbe10d3e2a0561d19219a4738e2.exe
"C:\Users\Admin\AppData\Local\Temp\45ff4bbe10d3e2a0561d19219a4738e2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Users\Public\1st.exe
  "C:\Users\Public\1st.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1704
- C:\Users\Public\2nd.exe
  "C:\Users\Public\2nd.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\serverWinintoBroker\Oj5kLF2mexK7.vbe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\serverWinintoBroker\7KYjb.bat" "
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1720
    - - C:\serverWinintoBroker\chainsessionhost.exe
        
        "C:\serverWinintoBroker\chainsessionhost.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1596
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1bL0VFZKky.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1800
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2908
        
        C:\Windows\SchCache\dwm.exe
        
        "C:\Windows\SchCache\dwm.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files\Uninstall Information\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Program Files\Uninstall Information\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Program Files\Reference Assemblies\Microsoft\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Program Files\Reference Assemblies\Microsoft\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Application Data\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Application Data\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\serverWinintoBroker\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\serverWinintoBroker\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\serverWinintoBroker\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Windows\SchCache\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\SchCache\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Windows\SchCache\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chainsessionhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\CrashReports\chainsessionhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chainsessionhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\chainsessionhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chainsessionhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\CrashReports\chainsessionhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Users\Default\SendTo\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default\SendTo\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Users\Default\SendTo\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Recovery\53190a62-69f6-11ef-9f57-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Services\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Services\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Common Files\Services\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Photo Viewer\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Photo Viewer\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:952

C:\Windows\system32\taskeng.exe
taskeng.exe {E9C382B8-41B1-4A69-972C-A33CA32C607A} S-1-5-21-457978338-2990298471-2379561640-1000:WOUOSVRD\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Users\Admin\AppData\Roaming\XClient.exe
  C:\Users\Admin\AppData\Roaming\XClient.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1856
- C:\Users\Admin\AppData\Roaming\XClient.exe
  C:\Users\Admin\AppData\Roaming\XClient.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1bL0VFZKky.bat

Path C:\Users\Admin\AppData\Local\Temp\1bL0VFZKky.bat
Size 192B
SHA256 1f248227f2d7b37a778ebd46218855f290faa6a5e34d7c0a6df47896e0924dd2
MD5 b6f1c10e8f12854aa22b0aa7078cb16d
SHA1 da97702c6f1fbe3fcd3b21d2ecaa10039ee86423
SHA512 481d2792a40f110db90abfde633e0d7093f9e63df3e95d788e4000130f635903b7aca98b49a6abcb315dd6a7f58c902f0ea53c7c5a41165c385ef1a0993674d8
MD5 SHA1 SHA512

Submit Download

1st.exe

Path C:\Users\Public\1st.exe
Size 62KB
SHA256 9aa9d49c412501e6f05950fe139d53928b1dbe93f632756e99a621ef4cfa2f26
MD5 edc20de154cc2615068f2e2e20abc6c3
SHA1 5fb88bef0e516d3c2cc88dded59909d6e0feb10e
SHA512 003bb213ae4a9829fc476e5399da43372829b6eb97f6ab68014351ff859a34fac964970849d1122c8bed1e8930772f9fb6099ff74ee8733b7f10769156c87f42
SSDEEP 1536:miaA2hElWR236wDgFqu9bn/NN7g+sbxTOrdYy:mKFKXwkFqu9bn/f+xTOrSy
MD5 SHA1 SHA512 SSDEEP

Submit Download

2nd.exe

Path C:\Users\Public\2nd.exe
Size 1.1MB
SHA256 53f7dece7d888074d85ba73f921777e5efcd4e5165328da1798f7bd356dd8517
MD5 d089650f51da656f315daf90306d530b
SHA1 8082c293b01e8c98f2b8dd7851391d90294e1f36
SHA512 696808437a1424699fbd0f98152b7ca67fc0b89993b81b93ebceb94f7aaac7a222b3e8d651ade6bfb50841318c755452f77d67d28985e7fb51e5ed44551807e4
SSDEEP 24576:U2G/nvxW3Ww0tOnIpvU2Ahh/epUhCIOyGk89v:UbA30TBm/J5u
MD5 SHA1 SHA512 SSDEEP

Submit Download

7KYjb.bat

Path C:\serverWinintoBroker\7KYjb.bat
Size 45B
SHA256 1fc54510ebdd75cd960b6036ed1a7d1463c5a314b9000220962d5bba628a33e2
MD5 a688336edf65429274a43fadd3b24dae
SHA1 3ef8f2f185b6de605aec2901b427e8c55e610e9f
SHA512 7ffd715b62b4a1890a60e14730cec351754e5cb3880465663f9b067754c99d593600195c4ec94efb5772ee6cda2475e0776297496f79854b3178753267177f04
MD5 SHA1 SHA512

Submit Download

Oj5kLF2mexK7.vbe

Path C:\serverWinintoBroker\Oj5kLF2mexK7.vbe
Size 201B
SHA256 8dd25fba83047e910ef22e90fed09893e9ed3cf4575931b0701f03f8821c87fe
MD5 62ac2132a0f5c3b05298b1c508730f0a
SHA1 45f0eb71c9face8303e6c384d4b367073fb6c56b
SHA512 d1d85c070836ea480e52ba419f2c78d548874dae7b0b53da456a92a2b9ebc922c1af51ea7b233f100e3e8ce6f2796dea3eabb6cd27f8081d8db0ec2ce52d469a
MD5 SHA1 SHA512

Submit Download

chainsessionhost.exe

Path \serverWinintoBroker\chainsessionhost.exe
Size 828KB
SHA256 8fba98cb04b406c1821b81d862f8c858292a482fade480d4e7c0ce4dfad79a00
MD5 e1d2ecc766a6ee4fb283f4eb4c8919b0
SHA1 c32df3bd3fece4d034aca22afac6b8ead14ef7b3
SHA512 8791730ed6e4acad7ab679ce4cb55891fa66070b1892e7418f507587af37ab431549cd896e7051aa63efb958ff049f5031f615f772340b5b2d2f83e8331f5eed
SSDEEP 12288:zsbbIpvUuHtQyAJjh/eZ+Q7dUhl0ZzFGOyGk89:onIpvU2Ahh/epUhCIOyGk89
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1596-29-0x0000000000B20000-0x0000000000BF6000-memory.dmp

Download

memory/1856-80-0x0000000000150000-0x0000000000166000-memory.dmp

Download

memory/2716-0-0x000007FEF5E93000-0x000007FEF5E94000-memory.dmp

Download

memory/2716-1-0x0000000000B40000-0x0000000000C76000-memory.dmp

Download

memory/2808-76-0x0000000000CF0000-0x0000000000DC6000-memory.dmp

Download

memory/2948-82-0x00000000001A0000-0x00000000001B6000-memory.dmp

Download

memory/2976-23-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Download

memory/2976-73-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Download

memory/2976-72-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Download

memory/2976-7-0x0000000000030000-0x0000000000046000-memory.dmp

Download

memory/2976-22-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Download