dcrat | 591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de

General

Target

591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
Size

2.2MB
MD5

86f0b098d34e7964a9da4131d1d58fa9
SHA1

614cbbda0058cefe56cf2e9c0db2e06f95a195a5
SHA256

591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de
SHA512

ca8bb85f6c5cf9766806965d00d9ceaaa490fc93c88fa70de27542cd5520c428a48e9a91c912940858e4c3948f4bc362ce98c76a2e24099341c88f9e3a2289a3
SSDEEP

24576:tg/TM3unSV8JHYj0M14oMKhqN8+r/tse9WPJXelRWjq+jPx8FT2t6nTtHtO3g4Jc:mQenScjKkr/y+qXeliq+iT2t60g7Er3

Score

10^/10

dcrat defense_evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 8 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	832	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	832	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4000	832	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	832	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	832	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	832	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	832	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4004	832	schtasks.exe	85

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3648-1-0x0000000000B00000-0x0000000000D42000-memory.dmp	dcrat
behavioral2/files/0x000a000000023b8a-23.dat	dcrat
behavioral2/files/0x000400000001e7a0-56.dat	dcrat
behavioral2/files/0x000300000001e863-89.dat	dcrat
behavioral2/files/0x000500000001e868-124.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2436272344-4274332273-444425594-1000\Control Panel\International\Geo\Nation	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe

Executes dropped EXE 1 IoCs

pid	Process
4596	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Windows\\write\\sysmon.exe\""	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\System32\\profext\\SppExtComObj.exe\""	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\System32\\smbwmiv2\\taskhostw.exe\""	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Documents and Settings\\Registry.exe\""	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de = "\"C:\\Windows\\System\\591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe\""	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\System32\\sxshared\\taskhostw.exe\""	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\PortableDeviceSyncProvider\\spoolsv.exe\""	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\PerfLogs\\lsass.exe\""	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe

Drops file in System32 directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\profext\RCXB1EB.tmp	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
File created	C:\Windows\System32\sxshared\taskhostw.exe	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
File created	C:\Windows\System32\PortableDeviceSyncProvider\spoolsv.exe	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
File created	C:\Windows\System32\PortableDeviceSyncProvider\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
File opened for modification	C:\Windows\System32\smbwmiv2\RCXA163.tmp	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
File opened for modification	C:\Windows\System32\sxshared\RCXA91A.tmp	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
File opened for modification	C:\Windows\System32\PortableDeviceSyncProvider\RCXAB1F.tmp	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
File opened for modification	C:\Windows\System32\PortableDeviceSyncProvider\RCXAB9D.tmp	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
File opened for modification	C:\Windows\System32\smbwmiv2\taskhostw.exe	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
File created	C:\Windows\System32\profext\SppExtComObj.exe	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
File opened for modification	C:\Windows\System32\smbwmiv2\RCXA162.tmp	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
File created	C:\Windows\System32\smbwmiv2\taskhostw.exe	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
File opened for modification	C:\Windows\System32\sxshared\RCXA89C.tmp	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
File opened for modification	C:\Windows\System32\sxshared\taskhostw.exe	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
File opened for modification	C:\Windows\System32\PortableDeviceSyncProvider\spoolsv.exe	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
File opened for modification	C:\Windows\System32\profext\SppExtComObj.exe	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
File created	C:\Windows\System32\smbwmiv2\ea9f0e6c9e2dcd4dfacdaf29ba21541fb815a988	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
File created	C:\Windows\System32\sxshared\ea9f0e6c9e2dcd4dfacdaf29ba21541fb815a988	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
File created	C:\Windows\System32\profext\e1ef82546f0b02b7e974f28047f3788b1128cce1	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
File opened for modification	C:\Windows\System32\profext\RCXB259.tmp	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System\591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
File opened for modification	C:\Windows\write\sysmon.exe	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
File created	C:\Windows\System\1ea28763389efe28e0c076b6969937594a718341	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
File opened for modification	C:\Windows\System\RCXA61A.tmp	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
File created	C:\Windows\write\121e5b5079f7c0e46d90f99b3864022518bbbda9	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
File opened for modification	C:\Windows\System\RCXA619.tmp	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
File opened for modification	C:\Windows\write\RCXAFD6.tmp	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
File opened for modification	C:\Windows\write\RCXAFD7.tmp	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
File created	C:\Windows\System\591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
File created	C:\Windows\write\sysmon.exe	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4004	schtasks.exe
2792	schtasks.exe
1536	schtasks.exe
4000	schtasks.exe
1360	schtasks.exe
1948	schtasks.exe
3056	schtasks.exe
1816	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
3648	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
3648	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
3648	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
3648	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
3648	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
3648	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
3648	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
3648	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
3648	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
3648	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
3648	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
3648	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
3648	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
3648	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
3648	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
3648	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
3648	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
3648	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
3648	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3648	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
Token: SeDebugPrivilege	4596	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 4596	3648	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe	95
PID 3648 wrote to memory of 4596	3648	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe	95

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
"C:\Users\Admin\AppData\Local\Temp\591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3648
- C:\Users\Admin\AppData\Local\Temp\591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe
  "C:\Users\Admin\AppData\Local\Temp\591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\System32\smbwmiv2\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Documents and Settings\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de" /sc ONLOGON /tr "'C:\Windows\System\591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\System32\sxshared\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\PortableDeviceSyncProvider\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\PerfLogs\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\write\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\System32\profext\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de.exe.log

Filesize
1KB

MD5
b7c0c43fc7804baaa7dc87152cdc9554

SHA1
1bab62bd56af745678d4e967d91e1ccfdeed4038

SHA256
46386a61f3aaf1b1c2e6efc9fc7e9e9ff16cd13ae58b8d856835771fedb6d457

SHA512
9fda3dd00a3406137e0113f13f78e77b20a76512b35820d38df696842cbbf2e2ebabfb99a3846c9637ecb54af858ec1551521187e379872973006426a253f769

Download Submit
C:\Users\Registry.exe

Filesize
2.2MB

MD5
21b20405cee46486c6bdd665e4a56f5b

SHA1
9cab3a3adfca73200ccf27f45b02593c735190bc

SHA256
44a3a584532812044b0d3f252ef31540cc1d17d9d135241e4d6a592d1236cf1e

SHA512
eb345965cf5706d0d194245ee5489927356d3314f346170d90351f55ac30315669430857e48b9e28809568f9109aca64166fff7407733ff70dddbc066bc77e38

Download Submit
C:\Windows\System32\PortableDeviceSyncProvider\spoolsv.exe

Filesize
2.2MB

MD5
ebbabf77b9202e1a4e2d3c695cebe4b4

SHA1
3f7a583f9c53908db2ac223e0b8c6cd2e5b862e7

SHA256
125968ce387cf8257b5023508578f89bc83bb04a32188d743f06d6e491b7016a

SHA512
3582daeb007c5d50612576b7ce173fd90c5e476787e1475df4987a8e0844932da136e8e36612f15f29020271c3e69a35629f766ffddb067706522a81eafbc775

Download Submit
C:\Windows\System32\PortableDeviceSyncProvider\spoolsv.exe

Filesize
2.2MB

MD5
86f0b098d34e7964a9da4131d1d58fa9

SHA1
614cbbda0058cefe56cf2e9c0db2e06f95a195a5

SHA256
591f9eba78261505ce83e1b6fca9388e8c932d604b1b376a21ee7c99182665de

SHA512
ca8bb85f6c5cf9766806965d00d9ceaaa490fc93c88fa70de27542cd5520c428a48e9a91c912940858e4c3948f4bc362ce98c76a2e24099341c88f9e3a2289a3

Download Submit
C:\Windows\System32\profext\SppExtComObj.exe

Filesize
2.2MB

MD5
e25a39e4aa8226e61ad4d87ab202b075

SHA1
f788abc5eec5bcbb870dda8611be38ec974a72e6

SHA256
e6dc771e96a2b81593d3c25b081cebd16c173f906747286b8a803126805c7865

SHA512
1637af5e9f0df90bb108303356cfc63e96a4f6ef5a59de43a8dc974311f7f693f4734f0a69bd9aec02244d39a9d35de0a6d10b4d4c7553d98de5aefc633222f4

Download Submit
memory/3648-5-0x0000000002EC0000-0x0000000002ECC000-memory.dmp

Filesize
48KB

Download
memory/3648-19-0x00007FFA03EC0000-0x00007FFA04981000-memory.dmp

Filesize
10.8MB

Download
memory/3648-7-0x000000001B940000-0x000000001B996000-memory.dmp

Filesize
344KB

Download
memory/3648-8-0x0000000002ED0000-0x0000000002EDA000-memory.dmp

Filesize
40KB

Download
memory/3648-9-0x0000000002EE0000-0x0000000002EE8000-memory.dmp

Filesize
32KB

Download
memory/3648-10-0x0000000002F00000-0x0000000002F0C000-memory.dmp

Filesize
48KB

Download
memory/3648-11-0x0000000002F10000-0x0000000002F1C000-memory.dmp

Filesize
48KB

Download
memory/3648-14-0x00007FFA03EC0000-0x00007FFA04981000-memory.dmp

Filesize
10.8MB

Download
memory/3648-15-0x00007FFA03EC0000-0x00007FFA04981000-memory.dmp

Filesize
10.8MB

Download
memory/3648-6-0x0000000002EF0000-0x0000000002EFA000-memory.dmp

Filesize
40KB

Download
memory/3648-0-0x00007FFA03EC3000-0x00007FFA03EC5000-memory.dmp

Filesize
8KB

Download
memory/3648-3-0x0000000002EA0000-0x0000000002EA8000-memory.dmp

Filesize
32KB

Download
memory/3648-4-0x0000000002EB0000-0x0000000002EC0000-memory.dmp

Filesize
64KB

Download
memory/3648-2-0x00007FFA03EC0000-0x00007FFA04981000-memory.dmp

Filesize
10.8MB

Download
memory/3648-127-0x00007FFA03EC3000-0x00007FFA03EC5000-memory.dmp

Filesize
8KB

Download
memory/3648-130-0x00007FFA03EC0000-0x00007FFA04981000-memory.dmp

Filesize
10.8MB

Download
memory/3648-132-0x00007FFA03EC0000-0x00007FFA04981000-memory.dmp

Filesize
10.8MB

Download
memory/3648-1-0x0000000000B00000-0x0000000000D42000-memory.dmp

Filesize
2.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads