description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1912	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	636	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1288	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1128	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1480	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1888	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1344	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	880	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	812	2276	schtasks.exe	30

resource	yara_rule
behavioral1/memory/2244-1-0x00000000003E0000-0x000000000062E000-memory.dmp	dcrat
behavioral1/files/0x00060000000175e7-16.dat	dcrat
behavioral1/memory/1780-45-0x0000000000FC0000-0x000000000120E000-memory.dmp	dcrat
behavioral1/memory/3008-50-0x0000000001260000-0x00000000014AE000-memory.dmp	dcrat
behavioral1/memory/2612-54-0x0000000000AD0000-0x0000000000D1E000-memory.dmp	dcrat
behavioral1/memory/2092-62-0x00000000003D0000-0x000000000061E000-memory.dmp	dcrat
behavioral1/memory/1756-61-0x00000000012C0000-0x000000000150E000-memory.dmp	dcrat
behavioral1/memory/3052-67-0x00000000001D0000-0x000000000041E000-memory.dmp	dcrat
behavioral1/memory/2152-68-0x00000000013B0000-0x00000000015FE000-memory.dmp	dcrat
behavioral1/memory/1788-72-0x0000000000DC0000-0x000000000100E000-memory.dmp	dcrat
behavioral1/memory/2360-75-0x0000000001010000-0x000000000125E000-memory.dmp	dcrat
behavioral1/memory/1796-78-0x0000000001330000-0x000000000157E000-memory.dmp	dcrat
behavioral1/memory/1872-81-0x00000000001A0000-0x00000000003EE000-memory.dmp	dcrat
behavioral1/memory/2216-84-0x0000000001150000-0x000000000139E000-memory.dmp	dcrat

pid	Process
1780	02d4afb627db486201d4700854e390d9.exe
3008	services.exe
2612	taskhost.exe
1756	spoolsv.exe
2092	System.exe
3052	lsass.exe
2152	explorer.exe
1788	02d4afb627db486201d4700854e390d9.exe
2360	OSPPSVC.exe
1796	services.exe
1872	csrss.exe
2216	taskhost.exe

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft.NET\lsass.exe	02d4afb627db486201d4700854e390d9.exe
File created	C:\Program Files (x86)\Microsoft.NET\6203df4a6bafc7	02d4afb627db486201d4700854e390d9.exe

description	ioc	Process
File created	C:\Windows\CSC\v2.0.6\csrss.exe	02d4afb627db486201d4700854e390d9.exe
File created	C:\Windows\Setup\State\csrss.exe	02d4afb627db486201d4700854e390d9.exe
File opened for modification	C:\Windows\Setup\State\csrss.exe	02d4afb627db486201d4700854e390d9.exe
File created	C:\Windows\Setup\State\886983d96e3d3e	02d4afb627db486201d4700854e390d9.exe
File created	C:\Windows\Resources\Ease of Access Themes\services.exe	02d4afb627db486201d4700854e390d9.exe
File created	C:\Windows\Resources\Ease of Access Themes\c5b4cb5e9653cc	02d4afb627db486201d4700854e390d9.exe

pid	Process
2244	02d4afb627db486201d4700854e390d9.exe
2244	02d4afb627db486201d4700854e390d9.exe
2244	02d4afb627db486201d4700854e390d9.exe
2244	02d4afb627db486201d4700854e390d9.exe
2244	02d4afb627db486201d4700854e390d9.exe
2244	02d4afb627db486201d4700854e390d9.exe
2244	02d4afb627db486201d4700854e390d9.exe
1780	02d4afb627db486201d4700854e390d9.exe
3008	services.exe
2612	taskhost.exe
1756	spoolsv.exe
2152	explorer.exe
1788	02d4afb627db486201d4700854e390d9.exe
2360	OSPPSVC.exe
1796	services.exe
1872	csrss.exe
2216	taskhost.exe

description	pid	Process
Token: SeDebugPrivilege	2244	02d4afb627db486201d4700854e390d9.exe
Token: SeDebugPrivilege	1780	02d4afb627db486201d4700854e390d9.exe
Token: SeDebugPrivilege	3008	services.exe
Token: SeDebugPrivilege	2612	taskhost.exe
Token: SeDebugPrivilege	1756	spoolsv.exe
Token: SeDebugPrivilege	2092	System.exe
Token: SeDebugPrivilege	2152	explorer.exe
Token: SeDebugPrivilege	3052	lsass.exe
Token: SeDebugPrivilege	1788	02d4afb627db486201d4700854e390d9.exe
Token: SeDebugPrivilege	2360	OSPPSVC.exe
Token: SeDebugPrivilege	1796	services.exe
Token: SeDebugPrivilege	1872	csrss.exe
Token: SeDebugPrivilege	2216	taskhost.exe

description	pid	Process	procid_target
PID 2244 wrote to memory of 1780	2244	02d4afb627db486201d4700854e390d9.exe	76
PID 2244 wrote to memory of 1780	2244	02d4afb627db486201d4700854e390d9.exe	76
PID 2244 wrote to memory of 1780	2244	02d4afb627db486201d4700854e390d9.exe	76
PID 2520 wrote to memory of 3008	2520	taskeng.exe	80
PID 2520 wrote to memory of 3008	2520	taskeng.exe	80
PID 2520 wrote to memory of 3008	2520	taskeng.exe	80
PID 2520 wrote to memory of 2612	2520	taskeng.exe	82
PID 2520 wrote to memory of 2612	2520	taskeng.exe	82
PID 2520 wrote to memory of 2612	2520	taskeng.exe	82
PID 2520 wrote to memory of 1756	2520	taskeng.exe	83
PID 2520 wrote to memory of 1756	2520	taskeng.exe	83
PID 2520 wrote to memory of 1756	2520	taskeng.exe	83
PID 2520 wrote to memory of 2092	2520	taskeng.exe	84
PID 2520 wrote to memory of 2092	2520	taskeng.exe	84
PID 2520 wrote to memory of 2092	2520	taskeng.exe	84
PID 2520 wrote to memory of 3052	2520	taskeng.exe	85
PID 2520 wrote to memory of 3052	2520	taskeng.exe	85
PID 2520 wrote to memory of 3052	2520	taskeng.exe	85
PID 2520 wrote to memory of 2152	2520	taskeng.exe	86
PID 2520 wrote to memory of 2152	2520	taskeng.exe	86
PID 2520 wrote to memory of 2152	2520	taskeng.exe	86
PID 2520 wrote to memory of 1788	2520	taskeng.exe	87
PID 2520 wrote to memory of 1788	2520	taskeng.exe	87
PID 2520 wrote to memory of 1788	2520	taskeng.exe	87
PID 2520 wrote to memory of 2360	2520	taskeng.exe	88
PID 2520 wrote to memory of 2360	2520	taskeng.exe	88
PID 2520 wrote to memory of 2360	2520	taskeng.exe	88
PID 2520 wrote to memory of 1796	2520	taskeng.exe	89
PID 2520 wrote to memory of 1796	2520	taskeng.exe	89
PID 2520 wrote to memory of 1796	2520	taskeng.exe	89
PID 2520 wrote to memory of 1872	2520	taskeng.exe	90
PID 2520 wrote to memory of 1872	2520	taskeng.exe	90
PID 2520 wrote to memory of 1872	2520	taskeng.exe	90
PID 2520 wrote to memory of 2216	2520	taskeng.exe	91
PID 2520 wrote to memory of 2216	2520	taskeng.exe	91
PID 2520 wrote to memory of 2216	2520	taskeng.exe	91

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads