dcrat | 7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-12-2024 13:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
Size

1.8MB
MD5

4f964ada28fa2dde5c75d3c3682e69c4
SHA1

481a0ddc3dfd39147abf684b60b6a0b1dfbbc341
SHA256

7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945
SHA512

ab07c9602776dc062599a89eed9d38be2c95f563a9ed9c906e6c1066f80e5666f119c5a790a120bf626a73edd3cc178924262d41c0f65eb20fcf3b542a83dc68
SSDEEP

24576:cWrCg/r+6/5OZr1A+KnhQaPNcHxIpjgqJ6t1:XrC7G5g0gq

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Local\\updater.exe\""	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	2792	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	2792	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	2792	schtasks.exe	31

DCRat payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2488-1-0x0000000000DB0000-0x0000000000F7A000-memory.dmp	family_dcrat_v2
behavioral1/files/0x001d000000015ccc-53.dat	family_dcrat_v2
behavioral1/memory/2856-54-0x0000000000050000-0x000000000021A000-memory.dmp	family_dcrat_v2
behavioral1/memory/2632-72-0x0000000000EB0000-0x000000000107A000-memory.dmp	family_dcrat_v2

Executes dropped EXE 5 IoCs

Processes:

updater.exeupdater.exeupdater.exeupdater.exeupdater.exe

pid	Process
2856	updater.exe
2632	updater.exe
2168	updater.exe
2804	updater.exe
2852	updater.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\updater = "\"C:\\Users\\Admin\\AppData\\Local\\updater.exe\""	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\updater = "\"C:\\Users\\Admin\\AppData\\Local\\updater.exe\""	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe

Drops file in System32 directory 2 IoCs

Processes:

csc.exe

description	ioc	Process
File created	\??\c:\Windows\System32\CSC5519532ADFA34466AD302D42A5A3A84.TMP	csc.exe
File created	\??\c:\Windows\System32\1woi1z.exe	csc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

PING.EXEPING.EXEPING.EXE

pid	Process
2164	PING.EXE
2300	PING.EXE
1996	PING.EXE

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

Processes:

PING.EXEPING.EXEPING.EXE

pid	Process
2164	PING.EXE
2300	PING.EXE
1996	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid	Process
2696	schtasks.exe
2660	schtasks.exe
2236	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe

pid	Process
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exeupdater.exeupdater.exeupdater.exeupdater.exeupdater.exe

description	pid	Process
Token: SeDebugPrivilege	2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
Token: SeDebugPrivilege	2856	updater.exe
Token: SeDebugPrivilege	2632	updater.exe
Token: SeDebugPrivilege	2168	updater.exe
Token: SeDebugPrivilege	2804	updater.exe
Token: SeDebugPrivilege	2852	updater.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.execsc.execmd.exeupdater.execmd.exeupdater.execmd.exeupdater.execmd.exeupdater.execmd.exe

description	pid	Process	procid_target
PID 2488 wrote to memory of 2564	2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe	35
PID 2488 wrote to memory of 2564	2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe	35
PID 2488 wrote to memory of 2564	2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe	35
PID 2564 wrote to memory of 1316	2564	csc.exe	37
PID 2564 wrote to memory of 1316	2564	csc.exe	37
PID 2564 wrote to memory of 1316	2564	csc.exe	37
PID 2488 wrote to memory of 2600	2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe	38
PID 2488 wrote to memory of 2600	2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe	38
PID 2488 wrote to memory of 2600	2488	7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe	38
PID 2600 wrote to memory of 2988	2600	cmd.exe	40
PID 2600 wrote to memory of 2988	2600	cmd.exe	40
PID 2600 wrote to memory of 2988	2600	cmd.exe	40
PID 2600 wrote to memory of 2164	2600	cmd.exe	41
PID 2600 wrote to memory of 2164	2600	cmd.exe	41
PID 2600 wrote to memory of 2164	2600	cmd.exe	41
PID 2600 wrote to memory of 2856	2600	cmd.exe	42
PID 2600 wrote to memory of 2856	2600	cmd.exe	42
PID 2600 wrote to memory of 2856	2600	cmd.exe	42
PID 2856 wrote to memory of 3036	2856	updater.exe	43
PID 2856 wrote to memory of 3036	2856	updater.exe	43
PID 2856 wrote to memory of 3036	2856	updater.exe	43
PID 3036 wrote to memory of 2132	3036	cmd.exe	45
PID 3036 wrote to memory of 2132	3036	cmd.exe	45
PID 3036 wrote to memory of 2132	3036	cmd.exe	45
PID 3036 wrote to memory of 2300	3036	cmd.exe	46
PID 3036 wrote to memory of 2300	3036	cmd.exe	46
PID 3036 wrote to memory of 2300	3036	cmd.exe	46
PID 3036 wrote to memory of 2632	3036	cmd.exe	47
PID 3036 wrote to memory of 2632	3036	cmd.exe	47
PID 3036 wrote to memory of 2632	3036	cmd.exe	47
PID 2632 wrote to memory of 872	2632	updater.exe	48
PID 2632 wrote to memory of 872	2632	updater.exe	48
PID 2632 wrote to memory of 872	2632	updater.exe	48
PID 872 wrote to memory of 2152	872	cmd.exe	50
PID 872 wrote to memory of 2152	872	cmd.exe	50
PID 872 wrote to memory of 2152	872	cmd.exe	50
PID 872 wrote to memory of 1808	872	cmd.exe	51
PID 872 wrote to memory of 1808	872	cmd.exe	51
PID 872 wrote to memory of 1808	872	cmd.exe	51
PID 872 wrote to memory of 2168	872	cmd.exe	52
PID 872 wrote to memory of 2168	872	cmd.exe	52
PID 872 wrote to memory of 2168	872	cmd.exe	52
PID 2168 wrote to memory of 1400	2168	updater.exe	54
PID 2168 wrote to memory of 1400	2168	updater.exe	54
PID 2168 wrote to memory of 1400	2168	updater.exe	54
PID 1400 wrote to memory of 2044	1400	cmd.exe	56
PID 1400 wrote to memory of 2044	1400	cmd.exe	56
PID 1400 wrote to memory of 2044	1400	cmd.exe	56
PID 1400 wrote to memory of 1996	1400	cmd.exe	57
PID 1400 wrote to memory of 1996	1400	cmd.exe	57
PID 1400 wrote to memory of 1996	1400	cmd.exe	57
PID 1400 wrote to memory of 2804	1400	cmd.exe	58
PID 1400 wrote to memory of 2804	1400	cmd.exe	58
PID 1400 wrote to memory of 2804	1400	cmd.exe	58
PID 2804 wrote to memory of 1716	2804	updater.exe	59
PID 2804 wrote to memory of 1716	2804	updater.exe	59
PID 2804 wrote to memory of 1716	2804	updater.exe	59
PID 1716 wrote to memory of 3000	1716	cmd.exe	61
PID 1716 wrote to memory of 3000	1716	cmd.exe	61
PID 1716 wrote to memory of 3000	1716	cmd.exe	61
PID 1716 wrote to memory of 1960	1716	cmd.exe	62
PID 1716 wrote to memory of 1960	1716	cmd.exe	62
PID 1716 wrote to memory of 1960	1716	cmd.exe	62
PID 1716 wrote to memory of 2852	1716	cmd.exe	63

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe
"C:\Users\Admin\AppData\Local\Temp\7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3hpd3qqa\3hpd3qqa.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE09F.tmp" "c:\Windows\System32\CSC5519532ADFA34466AD302D42A5A3A84.TMP"
    3⤵
    PID:1316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ToEuusmL27.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2988
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2164
- - C:\Users\Admin\AppData\Local\updater.exe
    "C:\Users\Admin\AppData\Local\updater.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2856
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cRBFrjfuSR.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3036
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2132
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2300
    - - C:\Users\Admin\AppData\Local\updater.exe
        
        "C:\Users\Admin\AppData\Local\updater.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2632
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9VsmEYMPZS.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:872
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:2152
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\updater.exe
        
        "C:\Users\Admin\AppData\Local\updater.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2168
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zjPPW8Mczj.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1400
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:2044
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\updater.exe
        
        "C:\Users\Admin\AppData\Local\updater.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2804
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9rsY8ZYMRr.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1716
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:3000
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\updater.exe
        
        "C:\Users\Admin\AppData\Local\updater.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "updateru" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\AppData\Local\updater.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "updater" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\updater.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "updateru" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\AppData\Local\updater.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9VsmEYMPZS.bat

Filesize
216B

MD5
b64fbc7faf164210c3a5ee089dc99aa1

SHA1
ebf96319c706d8527acb92f0c7e4f97e0ac21fb6

SHA256
2b292215f55754d97930ef0fc5494254a2aa2845f819b727dc01aff452b47ff4

SHA512
c181cca7c26913798403ab76accc8975b42175a939cdc0058e8f5ddb700218ac41df28dced2b4157a0b34011bc43304491a75ada27027f95301c0d325e4feb81

Download Submit
C:\Users\Admin\AppData\Local\Temp\9rsY8ZYMRr.bat

Filesize
216B

MD5
629b149a00bf91ee7625921f85e08777

SHA1
05999eec12d3d76d0142a905d7f68e946b51b551

SHA256
cda2886ecef25e5b2295862e2217e349c5e08e56da5c6bdc2aeeaabe843cc5d4

SHA512
ee6145a76c89f4433f53603235cba2017b1fab9c013730bc13a4c377ea96e8ce2d15275cd144a4127159c5fa7bbb8c5c824bcbdeddb55abdd948ef4615f0a8ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESE09F.tmp

Filesize
1KB

MD5
b3af9574e79e6b2adaf676426643ab02

SHA1
e17f81c37f4149ddeb7cacc9ddd57e0e4b0e576c

SHA256
a918df87eb6737254ba2c5d29b6a3ee4724b4f7227d8e27e33cc48ed0f4d4712

SHA512
2b27e66b0ea52aac7ecd6e7ecaef025d5f374553398feb49f592777ac5331ea2c15c3aec2abceb0aebf74ec42ea6da165ca28b9704f8d32bfd71968d56e5fe87

Download Submit
C:\Users\Admin\AppData\Local\Temp\ToEuusmL27.bat

Filesize
168B

MD5
32be291bbb59f87ee58e1aea1540381d

SHA1
6d3d4376f7cd869bd827ad646e4943289f7903b2

SHA256
188343f81b2347413e4593e755ef75dc23c227d4a29809254231ea0a84fc6f92

SHA512
0497916c25597a82b6496e243f9befe4c07948e96c8dcdc76342068b4db1c249fb6c22f29935ae2b73447e0af1240bb71cd71d74b73df9115ae8ea95a6d6d578

Download Submit
C:\Users\Admin\AppData\Local\Temp\cRBFrjfuSR.bat

Filesize
168B

MD5
439952e47e4370c91a6f092651cbb058

SHA1
8b02cf0689872f119af7bca2a0e38a3fb6a1a6e8

SHA256
33c7e224d9bbf8a956881d3f832a70aab6a38700f27dd1a655fc6a31323c47b2

SHA512
8857966bc8f433bdce0d2b85ef6d73cb0d12084b97bb9dec897c9cf3722f2a993d0a1ee78d7cc6275a7391ab63d0ffa6b5c29b4429195023efe90fe7b1277ba0

Download Submit
C:\Users\Admin\AppData\Local\Temp\zjPPW8Mczj.bat

Filesize
168B

MD5
1715dc3983d4db7edc7cc2cd344e9bfb

SHA1
c88c4e41900a849d9736080d630f09d7786b1118

SHA256
626ea650662881f5afbacd8828df74dc14ee460b703c4962a5ec1d5ba59783b8

SHA512
8cb96e0f98e172712beccc2b1ce389f721a5a9ad824304336ff086c1ad9951d774eba48ff6d60692ffce84b388992609fa476b95294cc9007119f03d680ba501

Download Submit
C:\Users\Admin\AppData\Local\updater.exe

Filesize
1.8MB

MD5
4f964ada28fa2dde5c75d3c3682e69c4

SHA1
481a0ddc3dfd39147abf684b60b6a0b1dfbbc341

SHA256
7b0699fb946ce952624a3d5807839fb1a0613993270aca8227f35001b790b945

SHA512
ab07c9602776dc062599a89eed9d38be2c95f563a9ed9c906e6c1066f80e5666f119c5a790a120bf626a73edd3cc178924262d41c0f65eb20fcf3b542a83dc68

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\3hpd3qqa\3hpd3qqa.0.cs

Filesize
372B

MD5
2d7c234d04b7a328c944fcadfcdd5df7

SHA1
d9cad48a8fc5ee8c02970b6487ee41edd051df68

SHA256
d2e3a5f98b9fa3ec14c58e77d7cdff2e653dfaa41fa336f0f79e131b62589891

SHA512
add2eb8ebb480ad8bd1b9bfaf43ea20c512f910f3f0cd9fd462aaeffba7179cab6f5b14e6a8e0b3c8625a3d5b1f74f773317542012d8895861d1e79bb285a58e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\3hpd3qqa\3hpd3qqa.cmdline

Filesize
235B

MD5
1fe26c7afccbb9daaba7a8eba5207f05

SHA1
b48e5c6d0fe7b8caab02543343e7b60aae08cc54

SHA256
aec9b6451e12413d953e7540abbe613e526a300862dc1f87983d616dfc992864

SHA512
1bb6f660a8c066be483ee376a7bba19706cd696848ce40e14279904f4c22b0dce744cb98258c132e8807b53c8ed4f42fe95084b5757522b20513f1604213981c

Download Submit
\??\c:\Windows\System32\CSC5519532ADFA34466AD302D42A5A3A84.TMP

Filesize
1KB

MD5
dcd286f3a69cfd0292a8edbc946f8553

SHA1
4d347ac1e8c1d75fc139878f5646d3a0b083ef17

SHA256
29e03364271673f4b388131b7773d016df859bb0b1c5e6c3ad6914a632600596

SHA512
4b9546033bd4957263854fbb0a87aa1d57ce3afbce7bf03b12b05b78f97c5a27c52c1d73e34b6a5ba2c395e26ec9c474a32609441b99cf78ea707113fca96f77

Download Submit
memory/2488-12-0x0000000000430000-0x000000000043E000-memory.dmp

Filesize
56KB

Download
memory/2488-14-0x0000000000570000-0x0000000000582000-memory.dmp

Filesize
72KB

Download
memory/2488-19-0x0000000000440000-0x000000000044E000-memory.dmp

Filesize
56KB

Download
memory/2488-21-0x0000000000450000-0x0000000000460000-memory.dmp

Filesize
64KB

Download
memory/2488-22-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/2488-24-0x0000000000C00000-0x0000000000C5A000-memory.dmp

Filesize
360KB

Download
memory/2488-26-0x00000000005C0000-0x00000000005CE000-memory.dmp

Filesize
56KB

Download
memory/2488-28-0x0000000000D00000-0x0000000000D4E000-memory.dmp

Filesize
312KB

Download
memory/2488-29-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/2488-16-0x0000000000590000-0x00000000005A6000-memory.dmp

Filesize
88KB

Download
memory/2488-37-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/2488-17-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/2488-38-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/2488-0-0x000007FEF5873000-0x000007FEF5874000-memory.dmp

Filesize
4KB

Download
memory/2488-10-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/2488-50-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/2488-9-0x0000000000550000-0x0000000000568000-memory.dmp

Filesize
96KB

Download
memory/2488-7-0x0000000000410000-0x000000000042C000-memory.dmp

Filesize
112KB

Download
memory/2488-1-0x0000000000DB0000-0x0000000000F7A000-memory.dmp

Filesize
1.8MB

Download
memory/2488-6-0x0000000000430000-0x000000000044C000-memory.dmp

Filesize
112KB

Download
memory/2488-2-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/2488-4-0x0000000000200000-0x000000000020E000-memory.dmp

Filesize
56KB

Download
memory/2632-72-0x0000000000EB0000-0x000000000107A000-memory.dmp

Filesize
1.8MB

Download
memory/2856-54-0x0000000000050000-0x000000000021A000-memory.dmp

Filesize
1.8MB

Download