dcrat | 4087dd67130db8a0192954514a065d9e94755a0783a8c32c31b2adfbe3ca528c

Analysis

max time kernel
116s
max time network
111s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
08-01-2025 07:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4087dd67130db8a0192954514a065d9e94755a0783a8c32c31b2adfbe3ca528c.exe
Size

1.3MB
MD5

2bad7faaa75d08ffaa3034186ac53736
SHA1

2105258d18a3c672353aae82ba6a683ececd3436
SHA256

4087dd67130db8a0192954514a065d9e94755a0783a8c32c31b2adfbe3ca528c
SHA512

3b84a5cab7c5b4beb215b41f309f1abf5c8301791873a3d32f64e899c25eaf9daaccaa0bb776f99ac085d23a7cbfb4df55af0a82cc9fd0a3b0d428b8eaeef7e7
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjCh:UbA30GnzV/q+DnsXgH

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1796	2676	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	2676	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	2676	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	2676	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1320	2676	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	2676	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	2676	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	2676	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	2676	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	2676	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	2676	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2868	2676	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2676	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	2676	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	2676	schtasks.exe	34

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000018b68-9.dat	dcrat
behavioral1/memory/2908-13-0x0000000000A20000-0x0000000000B30000-memory.dmp	dcrat
behavioral1/memory/2344-60-0x0000000000F00000-0x0000000001010000-memory.dmp	dcrat
behavioral1/memory/1864-243-0x0000000000340000-0x0000000000450000-memory.dmp	dcrat
behavioral1/memory/2556-303-0x0000000000300000-0x0000000000410000-memory.dmp	dcrat
behavioral1/memory/2592-363-0x0000000000EF0000-0x0000000001000000-memory.dmp	dcrat
behavioral1/memory/2660-423-0x0000000000250000-0x0000000000360000-memory.dmp	dcrat
behavioral1/memory/1792-483-0x0000000000A60000-0x0000000000B70000-memory.dmp	dcrat
behavioral1/memory/2636-544-0x00000000003F0000-0x0000000000500000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2148	powershell.exe
2012	powershell.exe
2008	powershell.exe
2196	powershell.exe
2376	powershell.exe
2380	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
2908	DllCommonsvc.exe
2344	System.exe
2788	System.exe
980	System.exe
1864	System.exe
2556	System.exe
2592	System.exe
2660	System.exe
1792	System.exe
2636	System.exe

Loads dropped DLL 2 IoCs

pid	Process
2812	cmd.exe
2812	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
19	raw.githubusercontent.com
4	raw.githubusercontent.com
13	raw.githubusercontent.com
16	raw.githubusercontent.com
23	raw.githubusercontent.com
26	raw.githubusercontent.com
29	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Uninstall Information\System.exe	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\27d1bcfc3c54e0	DllCommonsvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\conhost.exe	DllCommonsvc.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\088424020bedd6	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4087dd67130db8a0192954514a065d9e94755a0783a8c32c31b2adfbe3ca528c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3024	schtasks.exe
1688	schtasks.exe
2868	schtasks.exe
1796	schtasks.exe
1320	schtasks.exe
2504	schtasks.exe
2928	schtasks.exe
2528	schtasks.exe
1952	schtasks.exe
2536	schtasks.exe
3036	schtasks.exe
1992	schtasks.exe
2124	schtasks.exe
2112	schtasks.exe
2616	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2908	DllCommonsvc.exe
2196	powershell.exe
2376	powershell.exe
2148	powershell.exe
2008	powershell.exe
2380	powershell.exe
2012	powershell.exe
2344	System.exe
2788	System.exe
980	System.exe
1864	System.exe
2556	System.exe
2592	System.exe
2660	System.exe
1792	System.exe
2636	System.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2908	DllCommonsvc.exe
Token: SeDebugPrivilege	2196	powershell.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeDebugPrivilege	2148	powershell.exe
Token: SeDebugPrivilege	2008	powershell.exe
Token: SeDebugPrivilege	2380	powershell.exe
Token: SeDebugPrivilege	2344	System.exe
Token: SeDebugPrivilege	2012	powershell.exe
Token: SeDebugPrivilege	2788	System.exe
Token: SeDebugPrivilege	980	System.exe
Token: SeDebugPrivilege	1864	System.exe
Token: SeDebugPrivilege	2556	System.exe
Token: SeDebugPrivilege	2592	System.exe
Token: SeDebugPrivilege	2660	System.exe
Token: SeDebugPrivilege	1792	System.exe
Token: SeDebugPrivilege	2636	System.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2788	2084	4087dd67130db8a0192954514a065d9e94755a0783a8c32c31b2adfbe3ca528c.exe	30
PID 2084 wrote to memory of 2788	2084	4087dd67130db8a0192954514a065d9e94755a0783a8c32c31b2adfbe3ca528c.exe	30
PID 2084 wrote to memory of 2788	2084	4087dd67130db8a0192954514a065d9e94755a0783a8c32c31b2adfbe3ca528c.exe	30
PID 2084 wrote to memory of 2788	2084	4087dd67130db8a0192954514a065d9e94755a0783a8c32c31b2adfbe3ca528c.exe	30
PID 2788 wrote to memory of 2812	2788	WScript.exe	31
PID 2788 wrote to memory of 2812	2788	WScript.exe	31
PID 2788 wrote to memory of 2812	2788	WScript.exe	31
PID 2788 wrote to memory of 2812	2788	WScript.exe	31
PID 2812 wrote to memory of 2908	2812	cmd.exe	33
PID 2812 wrote to memory of 2908	2812	cmd.exe	33
PID 2812 wrote to memory of 2908	2812	cmd.exe	33
PID 2812 wrote to memory of 2908	2812	cmd.exe	33
PID 2908 wrote to memory of 2196	2908	DllCommonsvc.exe	50
PID 2908 wrote to memory of 2196	2908	DllCommonsvc.exe	50
PID 2908 wrote to memory of 2196	2908	DllCommonsvc.exe	50
PID 2908 wrote to memory of 2376	2908	DllCommonsvc.exe	51
PID 2908 wrote to memory of 2376	2908	DllCommonsvc.exe	51
PID 2908 wrote to memory of 2376	2908	DllCommonsvc.exe	51
PID 2908 wrote to memory of 2380	2908	DllCommonsvc.exe	52
PID 2908 wrote to memory of 2380	2908	DllCommonsvc.exe	52
PID 2908 wrote to memory of 2380	2908	DllCommonsvc.exe	52
PID 2908 wrote to memory of 2148	2908	DllCommonsvc.exe	53
PID 2908 wrote to memory of 2148	2908	DllCommonsvc.exe	53
PID 2908 wrote to memory of 2148	2908	DllCommonsvc.exe	53
PID 2908 wrote to memory of 2012	2908	DllCommonsvc.exe	54
PID 2908 wrote to memory of 2012	2908	DllCommonsvc.exe	54
PID 2908 wrote to memory of 2012	2908	DllCommonsvc.exe	54
PID 2908 wrote to memory of 2008	2908	DllCommonsvc.exe	55
PID 2908 wrote to memory of 2008	2908	DllCommonsvc.exe	55
PID 2908 wrote to memory of 2008	2908	DllCommonsvc.exe	55
PID 2908 wrote to memory of 2344	2908	DllCommonsvc.exe	62
PID 2908 wrote to memory of 2344	2908	DllCommonsvc.exe	62
PID 2908 wrote to memory of 2344	2908	DllCommonsvc.exe	62
PID 2344 wrote to memory of 2952	2344	System.exe	63
PID 2344 wrote to memory of 2952	2344	System.exe	63
PID 2344 wrote to memory of 2952	2344	System.exe	63
PID 2952 wrote to memory of 2704	2952	cmd.exe	65
PID 2952 wrote to memory of 2704	2952	cmd.exe	65
PID 2952 wrote to memory of 2704	2952	cmd.exe	65
PID 2952 wrote to memory of 2788	2952	cmd.exe	66
PID 2952 wrote to memory of 2788	2952	cmd.exe	66
PID 2952 wrote to memory of 2788	2952	cmd.exe	66
PID 2788 wrote to memory of 2076	2788	System.exe	67
PID 2788 wrote to memory of 2076	2788	System.exe	67
PID 2788 wrote to memory of 2076	2788	System.exe	67
PID 2076 wrote to memory of 2168	2076	cmd.exe	69
PID 2076 wrote to memory of 2168	2076	cmd.exe	69
PID 2076 wrote to memory of 2168	2076	cmd.exe	69
PID 2076 wrote to memory of 980	2076	cmd.exe	70
PID 2076 wrote to memory of 980	2076	cmd.exe	70
PID 2076 wrote to memory of 980	2076	cmd.exe	70
PID 980 wrote to memory of 740	980	System.exe	71
PID 980 wrote to memory of 740	980	System.exe	71
PID 980 wrote to memory of 740	980	System.exe	71
PID 740 wrote to memory of 2132	740	cmd.exe	73
PID 740 wrote to memory of 2132	740	cmd.exe	73
PID 740 wrote to memory of 2132	740	cmd.exe	73
PID 740 wrote to memory of 1864	740	cmd.exe	74
PID 740 wrote to memory of 1864	740	cmd.exe	74
PID 740 wrote to memory of 1864	740	cmd.exe	74
PID 1864 wrote to memory of 2744	1864	System.exe	75
PID 1864 wrote to memory of 2744	1864	System.exe	75
PID 1864 wrote to memory of 2744	1864	System.exe	75
PID 2744 wrote to memory of 1596	2744	cmd.exe	77

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4087dd67130db8a0192954514a065d9e94755a0783a8c32c31b2adfbe3ca528c.exe
"C:\Users\Admin\AppData\Local\Temp\4087dd67130db8a0192954514a065d9e94755a0783a8c32c31b2adfbe3ca528c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2908
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2196
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2376
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2380
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2148
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2012
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008
    - - C:\Program Files\Uninstall Information\System.exe
        
        "C:\Program Files\Uninstall Information\System.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2344
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1n8esAjYxK.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2952
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2704
        
        C:\Program Files\Uninstall Information\System.exe
        
        "C:\Program Files\Uninstall Information\System.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2788
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KLWAYFjljO.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2076
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2168
        
        C:\Program Files\Uninstall Information\System.exe
        
        "C:\Program Files\Uninstall Information\System.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:980
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HcCr6nEVp7.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:740
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2132
        
        C:\Program Files\Uninstall Information\System.exe
        
        "C:\Program Files\Uninstall Information\System.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1864
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WLCDTNV5Zk.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2744
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:1596
        
        C:\Program Files\Uninstall Information\System.exe
        
        "C:\Program Files\Uninstall Information\System.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2556
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\F4MZx53eLu.bat"
        14⤵
        
        PID:768
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2580
        
        C:\Program Files\Uninstall Information\System.exe
        
        "C:\Program Files\Uninstall Information\System.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2592
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8KwMxVG80h.bat"
        16⤵
        
        PID:2332
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2868
        
        C:\Program Files\Uninstall Information\System.exe
        
        "C:\Program Files\Uninstall Information\System.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2660
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Kz6bOuYaab.bat"
        18⤵
        
        PID:2100
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2328
        
        C:\Program Files\Uninstall Information\System.exe
        
        "C:\Program Files\Uninstall Information\System.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1792
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j95GpUP4tv.bat"
        20⤵
        
        PID:2892
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:1736
        
        C:\Program Files\Uninstall Information\System.exe
        
        "C:\Program Files\Uninstall Information\System.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\providercommon\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\providercommon\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\providercommon\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Program Files\Uninstall Information\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Uninstall Information\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\providercommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f03e23bb80f8305eb00e3c723ad259b2

SHA1
566580ef2f80c9052bad90d7b9be1028b356c74c

SHA256
a0b19bd29d6dffe58cc5fa80634618cb8ee3ea4f8abc2813e7deb0a1322b2e90

SHA512
f6eb7ddbf20811f3f12fe0d8fe0db66dff6af32935cb054bb16665f8af2aebe5718396baac047a762ebe8a274ac589ab4d3985a5c6fe7345f4cb468f3b4d97f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce3ac47917482aa51f90d0e269b43578

SHA1
1226ccf919378d5a6e016e2920dbfa36dbbeb677

SHA256
7c4371e89eb3f47c292d990b48a6acdf7d074e24b46a7c6805d477cb16480ba2

SHA512
2631dd652df43830bf62f9fc4dce1fef47cb3739fb52c3e9296d8d0f615272fe203cd4f27ef4a0bc71db0dff51d45effe593b3016c4620d5c803fd3566b88bd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25c51f26dcafc036769e2943fb05bad9

SHA1
aac72361a89ce2d53c913793ab82048ffa6bb613

SHA256
ab4c6daf8a70db157724c380ab6ba0f6350075f06acc2ba5a894bcf7597e6040

SHA512
4b192ef5bb2ec2b469943f46ee7e93cca57574c26707da21a14f0ee55f826f9ceefafcf6cbc1b18d613c57da2dda96a2687c6e0f4693c9f6bd739eac34688d4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4666a95008be310c5187b4657a0fd063

SHA1
d260054bfb69d08c50d36dd2c5013a5052e275d0

SHA256
677bcd3814dbbbdece761677b096888006a4a0f4ce3538fcca2bb5f993b0010d

SHA512
334ddfb3a77a1ce30ba322e48d7697339d0f9cfc943d2fedaf583d6ade07eaa4e85fccd2b36e329a420d4ec3ac052f698b95b38293e20bc9ba0ea8e4e4217cc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62600174945ac1a5d89aca78b8fc70a4

SHA1
d523583d1a40fc4b9acc19455acd31a57a9bb14e

SHA256
9a6339d4d9ff517fa74feecab400662bde6a319aa51fba98b318234e7a7b6a56

SHA512
cee20b0450d26354995982569db5613bcae53daabf60a8a59202dc9f7d5642698bb445ed7500e5c647fe0262844f6c17621ec50fef5dd3dd086f32788cfc73b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1e2ee1f37c92cd6c742b2d17049dcbb

SHA1
2286052cc018f3169b5b6107ef69d02a8dfcd4c7

SHA256
a2c8fb0c61733163bf1ba8a20d56fc777623a767a7adcb53651b33b0c69d2faf

SHA512
f314a0f4d08b56bd4d004bb12f023b93fec11a49da252c2c65265e3c9b59d4964361908c35a2a3342e662a6376246975b0f54524e6aeb186ebaf632b35249041

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4bb533873639aecf4116c40a2b47fbf

SHA1
a19c1c65bb61d697e1865a339db31ea4107b421c

SHA256
fce480024000c2917f63ff56e21039459f96a9a2353842d305653530bd445748

SHA512
17efcd02695885c7134232dbcbb1fabe942c8b3d3eec1fbbefc218152716b6c7cce384f4b4fea495379c5b4aa42a9bd6d471089305b9efa10e88d26ffe97d52b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1n8esAjYxK.bat

Filesize
214B

MD5
769abc1bcc6bc4beef476214bbcf8bcf

SHA1
c7364c35a300eb5eda013f1db7a7de8fc1031cfb

SHA256
f654e782b495df75322bf6edef0617b19f814b4edf50cbfc5ced9ef220fab652

SHA512
7efdf57bf57bf08d6ab7cc3f11242cf9ec8685ce64ab0d2d7d052e6bf05cf949e5e06186f08e81ebcbd51a3b52d1e1fb803b373c571a89728fd208828549769f

Download Submit
C:\Users\Admin\AppData\Local\Temp\8KwMxVG80h.bat

Filesize
214B

MD5
5de839bb93f1f025c51401784c0e83eb

SHA1
30a16afac506793c173c3ee25b6504eb9aaab373

SHA256
11223082612b70859ef3ea5cb6db20bf6b4d409738b00a14713e8884b4c8335a

SHA512
00c06ea0bb0457de9e9b14a701dd727bef1009a998ff233afaf5c648f0fd6b393285dc0c56c6645ad9450ca3265b8259ef922fe2f1800fcf3aab4440667ea825

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8307.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\F4MZx53eLu.bat

Filesize
214B

MD5
8ea372d39e1b47a25227ce00c3338372

SHA1
f4b94e499acfc9b1021d46521a191ab4790c61b3

SHA256
e68d468befa5495f484535eefcb02bf6d70ae7d14f2fd7bc319c8660b8750157

SHA512
b1bd2eec97e9368a6c5b9d12bf208df5ab7e313b8b2ea6eeb417168872d3a63fe58a05586b52eb06d345a3bbfe2b78d06fd8ba7fb57f52d9d8766591f862a65e

Download Submit
C:\Users\Admin\AppData\Local\Temp\HcCr6nEVp7.bat

Filesize
214B

MD5
85e9b107ad2d5ad1d6bb920b222b4f18

SHA1
e8a56e87eb1216b49e59ba6ac56992b36e368fd7

SHA256
044f5f0749e88c5cef1a97aa52a12a1ab2a3fa63a35055e10c396d613b0aea5a

SHA512
4ca0d8b05729ef3cd5c46e3cd16034fff45d1856baba247f250888723e9174d25d01a4d09c2a3130563b232b7202768042428c8c91d2ae7da05decd7576797e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\KLWAYFjljO.bat

Filesize
214B

MD5
3dbc74d23009ab0b2f201c7976427d9e

SHA1
12cd3dac0cadbb2829fadffeafd6823a7b7d504a

SHA256
b308bd53875a90a4f543bd1b1c5c7857a5921efeb759e5a8a01393d012be2794

SHA512
fbaae3770176f8709ddf30f34d2255e7bc75752e1aa8e4fb3b7ae539d6a300c117b356729c2ff47094750a921c341a12e78c38503c3f330547e4bfaf94e4fa78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Kz6bOuYaab.bat

Filesize
214B

MD5
4ff0d793ee4318917d0a321920291066

SHA1
994be669c18421dba97aa7bc01b9543684f42568

SHA256
0a2869730e2f824a7034847bf66d36f3987dcee8303316b39cdda707d4bd6104

SHA512
ab61b66a92ca92bf9403da7d569ec4af4ebc73bce338ec88f650d1b8c94d462c3640c3fd4dc4a1d74801c93b1ff3d5f866c0de081b58931b15d94a24a4b5cdd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar831A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\WLCDTNV5Zk.bat

Filesize
214B

MD5
4034f6eb9ded323686fd4ec5d729a3f5

SHA1
e1c143e7c5f615ca52fc24b0657b682475d56745

SHA256
9235e28d79dacabfe51013cc5d3da290dd9e2e44bf5d86f932a49cf7029c6247

SHA512
18085c4bbd7b0ad117769eb0e9f160b95b4c0c603bd956fd2ec3ee32f2f556654ff90f36038e0c01af4ec58de970b6cb43e85ae7a826e4db6123081813c5282a

Download Submit
C:\Users\Admin\AppData\Local\Temp\j95GpUP4tv.bat

Filesize
214B

MD5
4a3835b4b3cbd1b22f3f2dd958ca2600

SHA1
b5bb92822a347234f81f6e2354e5b7c588e2f1b7

SHA256
b8c9021d5f9dafd1230c40220842420d94438bd0a1b1271c04e5052da8334a86

SHA512
a7da7feacfcb5eb9f8ec9ae89feba0188fda79dccb0ce88aca5488106afc2128ba6e26b98984b5812685c05ac69d2b133f4b9b167711db7245f50ddb76aa6251

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
e97631f10f1516dae2010cbe2521469e

SHA1
d8bce0027eb6c75c7352b88126677f5b2c91c7b5

SHA256
16e42b928b7e719940c59ad3161240377e60dd1c9aa6e2eadd3aa8a0482a5111

SHA512
3a601e066d62347270c99519afa298ed7d0da5f1a0822ce00bae72c15a0208f6252654d144d59be40579ec2fae279c7db93bfa63c52a9605f6588d20e0103276

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
memory/1792-484-0x00000000001C0000-0x00000000001D2000-memory.dmp

Filesize
72KB

Download
memory/1792-483-0x0000000000A60000-0x0000000000B70000-memory.dmp

Filesize
1.1MB

Download
memory/1864-243-0x0000000000340000-0x0000000000450000-memory.dmp

Filesize
1.1MB

Download
memory/2008-59-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

Filesize
2.9MB

Download
memory/2196-58-0x0000000001E70000-0x0000000001E78000-memory.dmp

Filesize
32KB

Download
memory/2344-60-0x0000000000F00000-0x0000000001010000-memory.dmp

Filesize
1.1MB

Download
memory/2556-303-0x0000000000300000-0x0000000000410000-memory.dmp

Filesize
1.1MB

Download
memory/2592-363-0x0000000000EF0000-0x0000000001000000-memory.dmp

Filesize
1.1MB

Download
memory/2636-544-0x00000000003F0000-0x0000000000500000-memory.dmp

Filesize
1.1MB

Download
memory/2660-423-0x0000000000250000-0x0000000000360000-memory.dmp

Filesize
1.1MB

Download
memory/2788-124-0x0000000000250000-0x0000000000262000-memory.dmp

Filesize
72KB

Download
memory/2908-15-0x00000000004D0000-0x00000000004DC000-memory.dmp

Filesize
48KB

Download
memory/2908-14-0x00000000004B0000-0x00000000004C2000-memory.dmp

Filesize
72KB

Download
memory/2908-17-0x00000000004E0000-0x00000000004EC000-memory.dmp

Filesize
48KB

Download
memory/2908-16-0x00000000004C0000-0x00000000004CC000-memory.dmp

Filesize
48KB

Download
memory/2908-13-0x0000000000A20000-0x0000000000B30000-memory.dmp

Filesize
1.1MB

Download