dcrat | f9adac1ef0311f015cbb89d89b24b47dace93d4fafd417af475b09def8034c3f

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 08:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
45ff4bbe10d3e2a0561d19219a4738e2.exe
Size 1.2MB
Sample240912-kbvbyszarm
SHA256 f9adac1ef0311f015cbb89d89b24b47dace93d4fafd417af475b09def8034c3f
MD5 45ff4bbe10d3e2a0561d19219a4738e2
SHA1 2bbb1c2ecf9dd62c9f22253030ae7a7b168d09a4
SHA512 ab2ccf3dce770ac2b9ac7dcb3acc402ecacc951172a4291f8e0fb39cff5caa5e93058c97ecd78e154e415c7ff9b9395549cff5c546f22beaf2627964f05c482f
SSDEEP 24576:RjRu6SPKv/PvX2av85I1eBXJN46S2tYmLvnPlNbsN1owQNrLhEl:lvuKfvms85I1oOMYmLP9aN1zQNa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat xworm discovery infostealer rat trojan

Malware Config

Extracted

Family

xworm

147.185.221.22:8888

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000a0000000233c2-6.dat	family_xworm
behavioral2/memory/1648-21-0x0000000000800000-0x0000000000816000-memory.dmp	family_xworm

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1428	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4260	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3880	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1196	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	392	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3948	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3640	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	668	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1188	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3536	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	832	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3244	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1392	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3716	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4192	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3228	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5000	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	960	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4356	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3724	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3992	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4272	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4124	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4384	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4320	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4708	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4032	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4840	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	692	3316	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4772	3316	schtasks.exe	91

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000800000002340a-17.dat	dcrat
behavioral2/files/0x0007000000023412-35.dat	dcrat
behavioral2/memory/5008-37-0x00000000009B0000-0x0000000000A86000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	45ff4bbe10d3e2a0561d19219a4738e2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	2nd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	1st.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	chainsessionhost.exe

Executes dropped EXE 6 IoCs

pid	Process
1648	1st.exe
3080	2nd.exe
5008	chainsessionhost.exe
4952	WaaSMedicAgent.exe
1448	XClient.exe
4384	XClient.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	ip-api.com

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Media Player\ja-JP\SearchApp.exe	chainsessionhost.exe
File created	C:\Program Files (x86)\Windows Media Player\ja-JP\38384e6a620884	chainsessionhost.exe
File created	C:\Program Files\Windows Multimedia Platform\088424020bedd6	chainsessionhost.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RuntimeBroker.exe	chainsessionhost.exe
File created	C:\Program Files\MSBuild\Microsoft\SppExtComObj.exe	chainsessionhost.exe
File created	C:\Program Files\Windows Multimedia Platform\conhost.exe	chainsessionhost.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\9e8d7a4ca61bd9	chainsessionhost.exe
File created	C:\Program Files\Windows NT\Accessories\en-US\chainsessionhost.exe	chainsessionhost.exe
File created	C:\Program Files\Windows NT\Accessories\en-US\7be879be6c0afb	chainsessionhost.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\upfc.exe	chainsessionhost.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\ea1d8f6d871115	chainsessionhost.exe
File created	C:\Program Files\MSBuild\Microsoft\e1ef82546f0b02	chainsessionhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Globalization\ELS\Transliteration\smss.exe	chainsessionhost.exe
File created	C:\Windows\Globalization\ELS\Transliteration\69ddcba757bf72	chainsessionhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2nd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	2nd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 49 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4260	schtasks.exe
3716	schtasks.exe
4032	schtasks.exe
1188	schtasks.exe
1940	schtasks.exe
4512	schtasks.exe
4192	schtasks.exe
2512	schtasks.exe
1428	schtasks.exe
3948	schtasks.exe
4360	schtasks.exe
392	schtasks.exe
1792	schtasks.exe
2908	schtasks.exe
4320	schtasks.exe
3880	schtasks.exe
3640	schtasks.exe
2972	schtasks.exe
208	schtasks.exe
2820	schtasks.exe
1556	schtasks.exe
4708	schtasks.exe
3244	schtasks.exe
3228	schtasks.exe
3536	schtasks.exe
960	schtasks.exe
3724	schtasks.exe
1392	schtasks.exe
4124	schtasks.exe
3012	schtasks.exe
692	schtasks.exe
1196	schtasks.exe
2716	schtasks.exe
668	schtasks.exe
832	schtasks.exe
1140	schtasks.exe
4772	schtasks.exe
5000	schtasks.exe
4556	schtasks.exe
4384	schtasks.exe
2640	schtasks.exe
4356	schtasks.exe
3992	schtasks.exe
4272	schtasks.exe
2240	schtasks.exe
2224	schtasks.exe
4704	schtasks.exe
4840	schtasks.exe
2252	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5008	chainsessionhost.exe
5008	chainsessionhost.exe
5008	chainsessionhost.exe
5008	chainsessionhost.exe
5008	chainsessionhost.exe
5008	chainsessionhost.exe
5008	chainsessionhost.exe
5008	chainsessionhost.exe
5008	chainsessionhost.exe
5008	chainsessionhost.exe
5008	chainsessionhost.exe
5008	chainsessionhost.exe
5008	chainsessionhost.exe
4952	WaaSMedicAgent.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1648	1st.exe
Token: SeDebugPrivilege	5008	chainsessionhost.exe
Token: SeDebugPrivilege	1648	1st.exe
Token: SeDebugPrivilege	4952	WaaSMedicAgent.exe
Token: SeDebugPrivilege	1448	XClient.exe
Token: SeDebugPrivilege	4384	XClient.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 1648	3280	45ff4bbe10d3e2a0561d19219a4738e2.exe	83
PID 3280 wrote to memory of 1648	3280	45ff4bbe10d3e2a0561d19219a4738e2.exe	83
PID 3280 wrote to memory of 3080	3280	45ff4bbe10d3e2a0561d19219a4738e2.exe	84
PID 3280 wrote to memory of 3080	3280	45ff4bbe10d3e2a0561d19219a4738e2.exe	84
PID 3280 wrote to memory of 3080	3280	45ff4bbe10d3e2a0561d19219a4738e2.exe	84
PID 3080 wrote to memory of 1588	3080	2nd.exe	88
PID 3080 wrote to memory of 1588	3080	2nd.exe	88
PID 3080 wrote to memory of 1588	3080	2nd.exe	88
PID 1588 wrote to memory of 2584	1588	WScript.exe	93
PID 1588 wrote to memory of 2584	1588	WScript.exe	93
PID 1588 wrote to memory of 2584	1588	WScript.exe	93
PID 2584 wrote to memory of 5008	2584	cmd.exe	95
PID 2584 wrote to memory of 5008	2584	cmd.exe	95
PID 1648 wrote to memory of 2972	1648	1st.exe	119
PID 1648 wrote to memory of 2972	1648	1st.exe	119
PID 5008 wrote to memory of 4952	5008	chainsessionhost.exe	146
PID 5008 wrote to memory of 4952	5008	chainsessionhost.exe	146

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\45ff4bbe10d3e2a0561d19219a4738e2.exe
"C:\Users\Admin\AppData\Local\Temp\45ff4bbe10d3e2a0561d19219a4738e2.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Users\Public\1st.exe
  "C:\Users\Public\1st.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2972
- C:\Users\Public\2nd.exe
  "C:\Users\Public\2nd.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3080
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\serverWinintoBroker\Oj5kLF2mexK7.vbe"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1588
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\serverWinintoBroker\7KYjb.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2584
    - - C:\serverWinintoBroker\chainsessionhost.exe
        
        "C:\serverWinintoBroker\chainsessionhost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5008
      - C:\Users\Admin\Music\WaaSMedicAgent.exe
        
        "C:\Users\Admin\Music\WaaSMedicAgent.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "1st1" /sc MINUTE /mo 5 /tr "'C:\serverWinintoBroker\1st.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "1st" /sc ONLOGON /tr "'C:\serverWinintoBroker\1st.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "1st1" /sc MINUTE /mo 6 /tr "'C:\serverWinintoBroker\1st.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Multimedia Platform\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Multimedia Platform\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\serverWinintoBroker\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\serverWinintoBroker\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\serverWinintoBroker\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Oracle\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\All Users\Oracle\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Oracle\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\serverWinintoBroker\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\serverWinintoBroker\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\serverWinintoBroker\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chainsessionhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows NT\Accessories\en-US\chainsessionhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chainsessionhost" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\en-US\chainsessionhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chainsessionhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows NT\Accessories\en-US\chainsessionhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Music\WaaSMedicAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Users\Admin\Music\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Music\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chainsessionhostc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\chainsessionhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chainsessionhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\chainsessionhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chainsessionhostc" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\chainsessionhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Program Files\MSBuild\Microsoft\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Program Files\MSBuild\Microsoft\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Links\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default\Links\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Links\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\Globalization\ELS\Transliteration\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Globalization\ELS\Transliteration\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Windows\Globalization\ELS\Transliteration\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4772

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1448

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XClient.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XClient.exe.log
Size 654B
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
MD5 SHA1 SHA512

Submit Download

1st.exe

Path C:\Users\Public\1st.exe
Size 62KB
SHA256 9aa9d49c412501e6f05950fe139d53928b1dbe93f632756e99a621ef4cfa2f26
MD5 edc20de154cc2615068f2e2e20abc6c3
SHA1 5fb88bef0e516d3c2cc88dded59909d6e0feb10e
SHA512 003bb213ae4a9829fc476e5399da43372829b6eb97f6ab68014351ff859a34fac964970849d1122c8bed1e8930772f9fb6099ff74ee8733b7f10769156c87f42
SSDEEP 1536:miaA2hElWR236wDgFqu9bn/NN7g+sbxTOrdYy:mKFKXwkFqu9bn/f+xTOrSy
MD5 SHA1 SHA512 SSDEEP

Submit Download

2nd.exe

Path C:\Users\Public\2nd.exe
Size 1.1MB
SHA256 53f7dece7d888074d85ba73f921777e5efcd4e5165328da1798f7bd356dd8517
MD5 d089650f51da656f315daf90306d530b
SHA1 8082c293b01e8c98f2b8dd7851391d90294e1f36
SHA512 696808437a1424699fbd0f98152b7ca67fc0b89993b81b93ebceb94f7aaac7a222b3e8d651ade6bfb50841318c755452f77d67d28985e7fb51e5ed44551807e4
SSDEEP 24576:U2G/nvxW3Ww0tOnIpvU2Ahh/epUhCIOyGk89v:UbA30TBm/J5u
MD5 SHA1 SHA512 SSDEEP

Submit Download

7KYjb.bat

Path C:\serverWinintoBroker\7KYjb.bat
Size 45B
SHA256 1fc54510ebdd75cd960b6036ed1a7d1463c5a314b9000220962d5bba628a33e2
MD5 a688336edf65429274a43fadd3b24dae
SHA1 3ef8f2f185b6de605aec2901b427e8c55e610e9f
SHA512 7ffd715b62b4a1890a60e14730cec351754e5cb3880465663f9b067754c99d593600195c4ec94efb5772ee6cda2475e0776297496f79854b3178753267177f04
MD5 SHA1 SHA512

Submit Download

Oj5kLF2mexK7.vbe

Path C:\serverWinintoBroker\Oj5kLF2mexK7.vbe
Size 201B
SHA256 8dd25fba83047e910ef22e90fed09893e9ed3cf4575931b0701f03f8821c87fe
MD5 62ac2132a0f5c3b05298b1c508730f0a
SHA1 45f0eb71c9face8303e6c384d4b367073fb6c56b
SHA512 d1d85c070836ea480e52ba419f2c78d548874dae7b0b53da456a92a2b9ebc922c1af51ea7b233f100e3e8ce6f2796dea3eabb6cd27f8081d8db0ec2ce52d469a
MD5 SHA1 SHA512

Submit Download

chainsessionhost.exe

Path C:\serverWinintoBroker\chainsessionhost.exe
Size 828KB
SHA256 8fba98cb04b406c1821b81d862f8c858292a482fade480d4e7c0ce4dfad79a00
MD5 e1d2ecc766a6ee4fb283f4eb4c8919b0
SHA1 c32df3bd3fece4d034aca22afac6b8ead14ef7b3
SHA512 8791730ed6e4acad7ab679ce4cb55891fa66070b1892e7418f507587af37ab431549cd896e7051aa63efb958ff049f5031f615f772340b5b2d2f83e8331f5eed
SSDEEP 12288:zsbbIpvUuHtQyAJjh/eZ+Q7dUhl0ZzFGOyGk89:onIpvU2Ahh/epUhCIOyGk89
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1648-22-0x00007FFF2CB40000-0x00007FFF2D601000-memory.dmp

Download

memory/1648-32-0x00007FFF2CB40000-0x00007FFF2D601000-memory.dmp

Download

memory/1648-21-0x0000000000800000-0x0000000000816000-memory.dmp

Download

memory/1648-82-0x00007FFF2CB40000-0x00007FFF2D601000-memory.dmp

Download

memory/1648-83-0x00007FFF2CB40000-0x00007FFF2D601000-memory.dmp

Download

memory/3280-0-0x00007FFF2CB43000-0x00007FFF2CB45000-memory.dmp

Download

memory/3280-1-0x0000000000010000-0x0000000000146000-memory.dmp

Download

memory/5008-37-0x00000000009B0000-0x0000000000A86000-memory.dmp

Download