dcrat | 2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2

Analysis

max time kernel
143s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
07-02-2025 04:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
Size

1.6MB
MD5

b330a516dc2ed01776ad58b0dc970216
SHA1

78db141d31b8131aabd9ba1c9144a33c8cd6842b
SHA256

2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2
SHA512

f25f66055176b4060b94ff3c765d54d6d7ee0186b70001205c2e65696180a57b32de897df1664bad8611f81da0f3267b6daf9eea46a0c68c4746c54a56999209
SSDEEP

24576:GlZi59u2GRCRXXdoOH0dMPg/riXqsLS29ryVYNN+GCiRtnATOD:GPfsDHwsg/riE29rC2+GJRVA

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ServiceProfiles\\NetworkService\\Links\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Media Player\\Skins\\backgroundTaskHost.exe\", \"C:\\Users\\Default\\Application Data\\TextInputHost.exe\", \"C:\\Program Files\\Windows Mail\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\winlogon.exe\""	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ServiceProfiles\\NetworkService\\Links\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Media Player\\Skins\\backgroundTaskHost.exe\", \"C:\\Users\\Default\\Application Data\\TextInputHost.exe\", \"C:\\Program Files\\Windows Mail\\sppsvc.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\winlogon.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe\""	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ServiceProfiles\\NetworkService\\Links\\SppExtComObj.exe\""	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ServiceProfiles\\NetworkService\\Links\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Media Player\\Skins\\backgroundTaskHost.exe\""	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ServiceProfiles\\NetworkService\\Links\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Media Player\\Skins\\backgroundTaskHost.exe\", \"C:\\Users\\Default\\Application Data\\TextInputHost.exe\""	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ServiceProfiles\\NetworkService\\Links\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Media Player\\Skins\\backgroundTaskHost.exe\", \"C:\\Users\\Default\\Application Data\\TextInputHost.exe\", \"C:\\Program Files\\Windows Mail\\sppsvc.exe\""	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2236	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8	2236	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3268	2236	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1408	2236	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	856	2236	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4520	2236	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	2236	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	2236	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4468	2236	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	2236	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1420	2236	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	2236	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4164	2236	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	2236	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	660	2236	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	2236	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	2236	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	404	2236	schtasks.exe	86

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1412605595-2147700071-3468511006-1000\Control Panel\International\Geo\Nation	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe

Executes dropped EXE 1 IoCs

pid	Process
1952	winlogon.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Windows Sidebar\\winlogon.exe\""	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1412605595-2147700071-3468511006-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe\""	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1412605595-2147700071-3468511006-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\ServiceProfiles\\NetworkService\\Links\\SppExtComObj.exe\""	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1412605595-2147700071-3468511006-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files\\Windows Media Player\\Skins\\backgroundTaskHost.exe\""	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files\\Windows Media Player\\Skins\\backgroundTaskHost.exe\""	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1412605595-2147700071-3468511006-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Users\\Default\\Application Data\\TextInputHost.exe\""	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1412605595-2147700071-3468511006-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Windows Sidebar\\winlogon.exe\""	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe\""	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\ServiceProfiles\\NetworkService\\Links\\SppExtComObj.exe\""	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Users\\Default\\Application Data\\TextInputHost.exe\""	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1412605595-2147700071-3468511006-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files\\Windows Mail\\sppsvc.exe\""	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files\\Windows Mail\\sppsvc.exe\""	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC4ADB88D0BEDF46699CB652F295D73CA4.TMP	csc.exe
File created	\??\c:\Windows\System32\p3zb05.exe	csc.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Sidebar\winlogon.exe	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\winlogon.exe	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
File created	C:\Program Files (x86)\Windows Sidebar\cc11b995f2a76d	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
File created	C:\Program Files\Windows Mail\sppsvc.exe	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
File created	C:\Program Files\Windows Mail\0a1fd5f707cd16	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
File created	C:\Program Files\Windows Media Player\Skins\backgroundTaskHost.exe	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
File created	C:\Program Files\Windows Media Player\Skins\eddb19405b7ce1	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\NetworkService\Links\SppExtComObj.exe	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Links\e1ef82546f0b02	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4372	PING.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1412605595-2147700071-3468511006-1000_Classes\Local Settings	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4372	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
8	schtasks.exe
1408	schtasks.exe
4468	schtasks.exe
2600	schtasks.exe
1620	schtasks.exe
3052	schtasks.exe
3268	schtasks.exe
2416	schtasks.exe
1644	schtasks.exe
4164	schtasks.exe
856	schtasks.exe
660	schtasks.exe
1616	schtasks.exe
2976	schtasks.exe
404	schtasks.exe
2620	schtasks.exe
4520	schtasks.exe
1420	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
1952	winlogon.exe
1952	winlogon.exe
1952	winlogon.exe
1952	winlogon.exe
1952	winlogon.exe
1952	winlogon.exe
1952	winlogon.exe
1952	winlogon.exe
1952	winlogon.exe
1952	winlogon.exe
1952	winlogon.exe
1952	winlogon.exe
1952	winlogon.exe
1952	winlogon.exe
1952	winlogon.exe
1952	winlogon.exe
1952	winlogon.exe
1952	winlogon.exe
1952	winlogon.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
Token: SeDebugPrivilege	1952	winlogon.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 1180	3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe	90
PID 3224 wrote to memory of 1180	3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe	90
PID 1180 wrote to memory of 2244	1180	csc.exe	92
PID 1180 wrote to memory of 2244	1180	csc.exe	92
PID 3224 wrote to memory of 1292	3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe	108
PID 3224 wrote to memory of 1292	3224	2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe	108
PID 1292 wrote to memory of 4532	1292	cmd.exe	110
PID 1292 wrote to memory of 4532	1292	cmd.exe	110
PID 1292 wrote to memory of 4372	1292	cmd.exe	111
PID 1292 wrote to memory of 4372	1292	cmd.exe	111
PID 1292 wrote to memory of 1952	1292	cmd.exe	123
PID 1292 wrote to memory of 1952	1292	cmd.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe
"C:\Users\Admin\AppData\Local\Temp\2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5zesslmb\5zesslmb.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6AC0.tmp" "c:\Windows\System32\CSC4ADB88D0BEDF46699CB652F295D73CA4.TMP"
    3⤵
    PID:2244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3v93bNNHKx.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4532
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4372
- - C:\Program Files (x86)\Windows Sidebar\winlogon.exe
    "C:\Program Files (x86)\Windows Sidebar\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Windows\ServiceProfiles\NetworkService\Links\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\NetworkService\Links\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Windows\ServiceProfiles\NetworkService\Links\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Media Player\Skins\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Skins\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Media Player\Skins\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Application Data\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Default\Application Data\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Application Data\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Mail\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Mail\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Sidebar\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee22" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\AppData\Local\Temp\2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee22" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\AppData\Local\Temp\2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3v93bNNHKx.bat

Filesize
179B

MD5
7aa096f711f7f3692a585bcbd7cc86a2

SHA1
816dbda0f8981a866d8724291786fd8214662cdf

SHA256
656823bf735562f5a622c8db44562b0a8b244b615d410abf70429d9e2576c4c7

SHA512
89feda4fda3192969d8e2e12a6ea4cfdef37f15996f0da1deb13ece29ae9999f9e7a1680149995766632a6c8a56bc24eec40885d457476af19c27fe9eb0653c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES6AC0.tmp

Filesize
1KB

MD5
07bd60766389f11d66b3dacf539f8020

SHA1
78085732b8c671a6d6c38fe7b872b5096898dc08

SHA256
83615824bd6eeede4b292576a591003cbaf9ae70619616b5bb8f5cd01ab6d47b

SHA512
ad4719e2e011e2fc8d8b0a9d5487c5829ff0ef855ed69bb46eeb8814c8fbf454a3070c698da0020067956a5221792924c20cc879c3e4c505cf45f6aa3256d950

Download Submit
C:\Windows\ServiceProfiles\NetworkService\Links\SppExtComObj.exe

Filesize
1.6MB

MD5
b330a516dc2ed01776ad58b0dc970216

SHA1
78db141d31b8131aabd9ba1c9144a33c8cd6842b

SHA256
2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2

SHA512
f25f66055176b4060b94ff3c765d54d6d7ee0186b70001205c2e65696180a57b32de897df1664bad8611f81da0f3267b6daf9eea46a0c68c4746c54a56999209

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5zesslmb\5zesslmb.0.cs

Filesize
396B

MD5
cd894f87ff2d164bcb12ab007c5ad6dd

SHA1
8971167adfd3df2612bc897a34b1fec74fb1aed5

SHA256
37b46cd3a479a7710f28e6eb007d07c5ddd892ac71735ca2f0e47918ed85d15a

SHA512
8e109d18bc12cebcb5c744efbb199c86bf25f03d4c0f31fe33493b80dccf64d7133c69ca5ccc19f47a2c72344af2500c9ab99e4c857a23fb327dc5f08c7b97d4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5zesslmb\5zesslmb.cmdline

Filesize
235B

MD5
568e55a3c04587bd9205540ea660ca6d

SHA1
a85da714f97e3d5ae75dbcf8bd0027ff1462735f

SHA256
a2f52e8fcb0bf48b6f928e53c4f5d90185c5804c2fc1c5ad299e34edf8c78cca

SHA512
b0a06e644d8354d0ef0a836dd0a63e71f5c410822cde969f32df0b293e7bc96998977f98ed496b6231d0a34e2449deb978a182fcdeec452070a99795e8ff964c

Download Submit
\??\c:\Windows\System32\CSC4ADB88D0BEDF46699CB652F295D73CA4.TMP

Filesize
1KB

MD5
8d1ed1c8f2cbc3e62adae4e1344d01ac

SHA1
76a58b523ba6de952174cea4ef64b94f399ce726

SHA256
9a083c7646ac0a5488172479ce5ffca6dc9bb5cb645334000e2e9c8befc4eab2

SHA512
f69f4034486c2606b5a92bac3bf0e26f8bf927eded38fc402ad2299d5891c2336f59f11bc2c2ecaf93339cc460b67eb0a4ef9f5c95952e8765b00536a638c0d1

Download Submit
memory/3224-6-0x0000000002A30000-0x0000000002A3E000-memory.dmp

Filesize
56KB

Download
memory/3224-28-0x00007FFBE56F0000-0x00007FFBE61B1000-memory.dmp

Filesize
10.8MB

Download
memory/3224-10-0x0000000002A40000-0x0000000002A4C000-memory.dmp

Filesize
48KB

Download
memory/3224-11-0x00007FFBE56F0000-0x00007FFBE61B1000-memory.dmp

Filesize
10.8MB

Download
memory/3224-13-0x00007FFBE56F0000-0x00007FFBE61B1000-memory.dmp

Filesize
10.8MB

Download
memory/3224-20-0x00007FFBE56F0000-0x00007FFBE61B1000-memory.dmp

Filesize
10.8MB

Download
memory/3224-7-0x00007FFBE56F0000-0x00007FFBE61B1000-memory.dmp

Filesize
10.8MB

Download
memory/3224-8-0x00007FFBE56F0000-0x00007FFBE61B1000-memory.dmp

Filesize
10.8MB

Download
memory/3224-0-0x00007FFBE56F3000-0x00007FFBE56F5000-memory.dmp

Filesize
8KB

Download
memory/3224-4-0x00007FFBE56F0000-0x00007FFBE61B1000-memory.dmp

Filesize
10.8MB

Download
memory/3224-3-0x00007FFBE56F0000-0x00007FFBE61B1000-memory.dmp

Filesize
10.8MB

Download
memory/3224-2-0x00007FFBE56F0000-0x00007FFBE61B1000-memory.dmp

Filesize
10.8MB

Download
memory/3224-1-0x0000000000780000-0x000000000092A000-memory.dmp

Filesize
1.7MB

Download
memory/3224-44-0x00007FFBE56F0000-0x00007FFBE61B1000-memory.dmp

Filesize
10.8MB

Download