dcrat | 7e71c79883eb025596762b4e0bf86b447039079dfe510ccf13a383b612575fa6

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3dfc71cfc45034d671ac0f319bc080bd.exe
Size

885KB
MD5

3dfc71cfc45034d671ac0f319bc080bd
SHA1

7d8a8faccf06d8ec762bdf56e8842dd069ec3801
SHA256

13af700b0453342984055a1e70619698a9163812e7524e4c6c264e29f25fd9a1
SHA512

8c824df6e8976dbf362cc075a1f114d9b86ad16cc0bedd880ef0a6afb7e745b901d957b96b8cf40020cbfb1c52f82874eacd319a9dc905b64d793c953503a00e
SSDEEP

12288:8lNE5VnZuh+ZIlXJBH5SP2I/lwvDT77/wOKsV42i3GULVaHeopyyx:8lNCv6XJ5BClaXfD9vUha+u

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3636	3176	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	3176	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4524	3176	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4560	3176	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4640	3176	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4644	3176	schtasks.exe	87

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral24/memory/3144-1-0x00000000001A0000-0x0000000000284000-memory.dmp	dcrat
behavioral24/files/0x01ad0000000221a8-21.dat	dcrat

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	3dfc71cfc45034d671ac0f319bc080bd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 14 IoCs

pid	Process
5176	RuntimeBroker.exe
4036	RuntimeBroker.exe
3360	RuntimeBroker.exe
224	RuntimeBroker.exe
4536	RuntimeBroker.exe
4068	RuntimeBroker.exe
5628	RuntimeBroker.exe
1028	RuntimeBroker.exe
3560	RuntimeBroker.exe
1208	RuntimeBroker.exe
4540	RuntimeBroker.exe
5292	RuntimeBroker.exe
1992	RuntimeBroker.exe
5676	RuntimeBroker.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe	3dfc71cfc45034d671ac0f319bc080bd.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\9e8d7a4ca61bd9	3dfc71cfc45034d671ac0f319bc080bd.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\en-US\RCXB598.tmp	3dfc71cfc45034d671ac0f319bc080bd.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\en-US\RCXB599.tmp	3dfc71cfc45034d671ac0f319bc080bd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	3dfc71cfc45034d671ac0f319bc080bd.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4524	schtasks.exe
4560	schtasks.exe
4640	schtasks.exe
4644	schtasks.exe
3636	schtasks.exe
2096	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
3144	3dfc71cfc45034d671ac0f319bc080bd.exe
5176	RuntimeBroker.exe
4036	RuntimeBroker.exe
3360	RuntimeBroker.exe
224	RuntimeBroker.exe
4536	RuntimeBroker.exe
4536	RuntimeBroker.exe
4068	RuntimeBroker.exe
4068	RuntimeBroker.exe
5628	RuntimeBroker.exe
1028	RuntimeBroker.exe
3560	RuntimeBroker.exe
1208	RuntimeBroker.exe
4540	RuntimeBroker.exe
5292	RuntimeBroker.exe
1992	RuntimeBroker.exe
5676	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	3144	3dfc71cfc45034d671ac0f319bc080bd.exe
Token: SeDebugPrivilege	5176	RuntimeBroker.exe
Token: SeDebugPrivilege	4036	RuntimeBroker.exe
Token: SeDebugPrivilege	3360	RuntimeBroker.exe
Token: SeDebugPrivilege	224	RuntimeBroker.exe
Token: SeDebugPrivilege	4536	RuntimeBroker.exe
Token: SeDebugPrivilege	4068	RuntimeBroker.exe
Token: SeDebugPrivilege	5628	RuntimeBroker.exe
Token: SeDebugPrivilege	1028	RuntimeBroker.exe
Token: SeDebugPrivilege	3560	RuntimeBroker.exe
Token: SeDebugPrivilege	1208	RuntimeBroker.exe
Token: SeDebugPrivilege	4540	RuntimeBroker.exe
Token: SeDebugPrivilege	5292	RuntimeBroker.exe
Token: SeDebugPrivilege	1992	RuntimeBroker.exe
Token: SeDebugPrivilege	5676	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 4332	3144	3dfc71cfc45034d671ac0f319bc080bd.exe	94
PID 3144 wrote to memory of 4332	3144	3dfc71cfc45034d671ac0f319bc080bd.exe	94
PID 4332 wrote to memory of 384	4332	cmd.exe	96
PID 4332 wrote to memory of 384	4332	cmd.exe	96
PID 4332 wrote to memory of 5176	4332	cmd.exe	101
PID 4332 wrote to memory of 5176	4332	cmd.exe	101
PID 5176 wrote to memory of 3700	5176	RuntimeBroker.exe	102
PID 5176 wrote to memory of 3700	5176	RuntimeBroker.exe	102
PID 5176 wrote to memory of 3732	5176	RuntimeBroker.exe	103
PID 5176 wrote to memory of 3732	5176	RuntimeBroker.exe	103
PID 3700 wrote to memory of 4036	3700	WScript.exe	106
PID 3700 wrote to memory of 4036	3700	WScript.exe	106
PID 4036 wrote to memory of 1880	4036	RuntimeBroker.exe	107
PID 4036 wrote to memory of 1880	4036	RuntimeBroker.exe	107
PID 4036 wrote to memory of 1300	4036	RuntimeBroker.exe	108
PID 4036 wrote to memory of 1300	4036	RuntimeBroker.exe	108
PID 1880 wrote to memory of 3360	1880	WScript.exe	111
PID 1880 wrote to memory of 3360	1880	WScript.exe	111
PID 3360 wrote to memory of 3988	3360	RuntimeBroker.exe	112
PID 3360 wrote to memory of 3988	3360	RuntimeBroker.exe	112
PID 3360 wrote to memory of 3388	3360	RuntimeBroker.exe	113
PID 3360 wrote to memory of 3388	3360	RuntimeBroker.exe	113
PID 3988 wrote to memory of 224	3988	WScript.exe	114
PID 3988 wrote to memory of 224	3988	WScript.exe	114
PID 224 wrote to memory of 5196	224	RuntimeBroker.exe	115
PID 224 wrote to memory of 5196	224	RuntimeBroker.exe	115
PID 224 wrote to memory of 2868	224	RuntimeBroker.exe	116
PID 224 wrote to memory of 2868	224	RuntimeBroker.exe	116
PID 5196 wrote to memory of 4536	5196	WScript.exe	120
PID 5196 wrote to memory of 4536	5196	WScript.exe	120
PID 4536 wrote to memory of 3868	4536	RuntimeBroker.exe	121
PID 4536 wrote to memory of 3868	4536	RuntimeBroker.exe	121
PID 4536 wrote to memory of 4620	4536	RuntimeBroker.exe	122
PID 4536 wrote to memory of 4620	4536	RuntimeBroker.exe	122
PID 3868 wrote to memory of 4068	3868	WScript.exe	123
PID 3868 wrote to memory of 4068	3868	WScript.exe	123
PID 4068 wrote to memory of 6004	4068	RuntimeBroker.exe	127
PID 4068 wrote to memory of 6004	4068	RuntimeBroker.exe	127
PID 4068 wrote to memory of 4768	4068	RuntimeBroker.exe	128
PID 4068 wrote to memory of 4768	4068	RuntimeBroker.exe	128
PID 6004 wrote to memory of 5628	6004	WScript.exe	129
PID 6004 wrote to memory of 5628	6004	WScript.exe	129
PID 5628 wrote to memory of 5320	5628	RuntimeBroker.exe	130
PID 5628 wrote to memory of 5320	5628	RuntimeBroker.exe	130
PID 5628 wrote to memory of 1916	5628	RuntimeBroker.exe	131
PID 5628 wrote to memory of 1916	5628	RuntimeBroker.exe	131
PID 5320 wrote to memory of 1028	5320	WScript.exe	132
PID 5320 wrote to memory of 1028	5320	WScript.exe	132
PID 1028 wrote to memory of 4036	1028	RuntimeBroker.exe	133
PID 1028 wrote to memory of 4036	1028	RuntimeBroker.exe	133
PID 1028 wrote to memory of 5364	1028	RuntimeBroker.exe	134
PID 1028 wrote to memory of 5364	1028	RuntimeBroker.exe	134
PID 4036 wrote to memory of 3560	4036	WScript.exe	136
PID 4036 wrote to memory of 3560	4036	WScript.exe	136
PID 3560 wrote to memory of 2912	3560	RuntimeBroker.exe	137
PID 3560 wrote to memory of 2912	3560	RuntimeBroker.exe	137
PID 3560 wrote to memory of 5484	3560	RuntimeBroker.exe	138
PID 3560 wrote to memory of 5484	3560	RuntimeBroker.exe	138
PID 2912 wrote to memory of 1208	2912	WScript.exe	139
PID 2912 wrote to memory of 1208	2912	WScript.exe	139
PID 1208 wrote to memory of 2764	1208	RuntimeBroker.exe	140
PID 1208 wrote to memory of 2764	1208	RuntimeBroker.exe	140
PID 1208 wrote to memory of 5272	1208	RuntimeBroker.exe	141
PID 1208 wrote to memory of 5272	1208	RuntimeBroker.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3dfc71cfc45034d671ac0f319bc080bd.exe
"C:\Users\Admin\AppData\Local\Temp\3dfc71cfc45034d671ac0f319bc080bd.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nDdOsbL9Ya.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:384
- - C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe
    "C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5176
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3640fe5d-028d-46c3-89ce-be346ff8849f.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3700
    - - C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe
        
        "C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4036
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\410b6a5c-1276-4d4e-af9a-f2bb92b8a775.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1880
        
        C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe
        
        "C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3360
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\990a1a95-bf92-4786-b024-acad819199bf.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3988
        
        C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe
        
        "C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:224
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9a5c39f1-bb53-4aca-ad56-1ce3913f0e68.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:5196
        
        C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe
        
        "C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4536
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d7e2db88-2282-4091-be49-86aabbd01c7f.vbs"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:3868
        
        C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe
        
        "C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d3bd73e7-6d31-43e3-912e-d5c115009ebd.vbs"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:6004
        
        C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe
        
        "C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5628
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ba691714-1a03-4982-ba5b-9ae28b2f1512.vbs"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:5320
        
        C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe
        
        "C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1028
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4dc8def2-7334-4cc4-be77-705e05a18308.vbs"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:4036
        
        C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe
        
        "C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3560
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\71fb6027-6880-418e-ac80-cbafaa61f403.vbs"
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:2912
        
        C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe
        
        "C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1208
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fd09ceee-fbe9-4cb1-8e85-330a7c303daa.vbs"
        22⤵
        
        PID:2764
        
        C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe
        
        "C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4540
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\349c73b9-f461-4699-9e1b-e00964044ce6.vbs"
        24⤵
        
        PID:4904
        
        C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe
        
        "C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5292
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\79df7b22-5815-46cf-9923-61c4de8b8223.vbs"
        26⤵
        
        PID:2820
        
        C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe
        
        "C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1992
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5dcbe999-72f8-4c02-8025-81a98429ba98.vbs"
        28⤵
        
        PID:2032
        
        C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe
        
        "C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5676
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\62defe0e-83ad-4cea-9461-ae4b4273ed4f.vbs"
        30⤵
        
        PID:3900
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\da71b2bd-a14f-4aa7-8a8d-6f70db7f9794.vbs"
        30⤵
        
        PID:2580
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4dacaca7-07b2-43e6-ab16-b06299030bed.vbs"
        28⤵
        
        PID:4552
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c068b136-2772-4f80-befd-0583248b4407.vbs"
        26⤵
        
        PID:6008
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3990c846-c42c-4bb7-b73d-6d416872c3c3.vbs"
        24⤵
        
        PID:4672
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\23a78552-201c-464d-84a6-03a1a3304612.vbs"
        22⤵
        
        PID:5272
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7f7fa408-0c01-420a-b6ed-3ae088c5c00a.vbs"
        20⤵
        
        PID:5484
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c34ba6b6-a6d7-45b5-a474-d7eeb5870e04.vbs"
        18⤵
        
        PID:5364
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c4bac12e-866a-4af7-a384-2fb8c890c33d.vbs"
        16⤵
        
        PID:1916
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c9ca6b10-7b6a-4a95-9e82-cd83171ca058.vbs"
        14⤵
        
        PID:4768
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dde342f5-b587-4d50-9ee1-d08bb6179fb3.vbs"
        12⤵
        
        PID:4620
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1f2a17e6-78f4-4f41-a9df-fb329cc8e459.vbs"
        10⤵
        
        PID:2868
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fbf81cac-fe19-4383-9373-eaa7c2fbd5e2.vbs"
        8⤵
        
        PID:3388
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0be8d7ba-2a2e-406e-830c-fc24e9dcb649.vbs"
        6⤵
        
        PID:1300
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f3225b47-5645-440c-8d13-089575b384e5.vbs"
      4⤵
      PID:3732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\WindowsRE\sysmon.exe

Filesize
885KB

MD5
3dfc71cfc45034d671ac0f319bc080bd

SHA1
7d8a8faccf06d8ec762bdf56e8842dd069ec3801

SHA256
13af700b0453342984055a1e70619698a9163812e7524e4c6c264e29f25fd9a1

SHA512
8c824df6e8976dbf362cc075a1f114d9b86ad16cc0bedd880ef0a6afb7e745b901d957b96b8cf40020cbfb1c52f82874eacd319a9dc905b64d793c953503a00e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

Filesize
1KB

MD5
3690a1c3b695227a38625dcf27bd6dac

SHA1
c2ed91e98b120681182904fa2c7cd504e5c4b2f5

SHA256
2ca8df156dba033c5b3ae4009e3be14dcdc6b9be53588055efd0864a1ab8ff73

SHA512
15ebfe05c0317f844e957ac02842a60b01f00ddca981e888e547056d0e30c97829bc4a2a46ce43034b3346f7cf5406c7c41c2a830f0abc47c8d2fd2ef00cb2c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\349c73b9-f461-4699-9e1b-e00964044ce6.vbs

Filesize
744B

MD5
532ae1501ec1ba488bf443906afd4ad8

SHA1
eeee94a554380cd153be6c6b4492b57604ae1d8f

SHA256
04e95dbf27ac51ba98f46d04b53cfd6d4cda017e36a21e7d35ad310a80364075

SHA512
fb87244a61270b9994b38ff4d3530be2615c07c1f48364eeacd092ab5f4be71ed3a5b8e355952b4ee0593d9a36c4411a0e06d637591ce738c66323d2eb7d47be

Download Submit
C:\Users\Admin\AppData\Local\Temp\3640fe5d-028d-46c3-89ce-be346ff8849f.vbs

Filesize
744B

MD5
b02d2199d05ed2f8c8c1edb2945e9adb

SHA1
7a044313a639ae9c439aa2ea20736cb13d8d4bfd

SHA256
52c641124797727e2d3d152af45966e20314be622f4b91571a5a2b16108db09f

SHA512
e4bf40f4aa5fe4386515ac615ba4cc8c8e48e966f3778bcde130e77f4489e013f570b0319f0e12303c442e3d26a057e7f7d2d1e4c25961a126a048914b398322

Download Submit
C:\Users\Admin\AppData\Local\Temp\410b6a5c-1276-4d4e-af9a-f2bb92b8a775.vbs

Filesize
744B

MD5
8bf55248b95bc7ea50b61ac87b56b05a

SHA1
0239687a10b7a1d09afa8181d5026981b80b7b35

SHA256
304950fcbde5f052122a1a19ae28e31753fbc59360f23f753af4cb8f2c02648f

SHA512
f0361ce6bbddfdf66187ef477aab3e2e5a608960528c4494177fcefb00b9e36022b6fd5b12280888a9ac5d06d5d844d5f8bbd0ea146941f4f626e5291178ea5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\4dc8def2-7334-4cc4-be77-705e05a18308.vbs

Filesize
744B

MD5
0f523900ab55ab38f1134b37d516662d

SHA1
7210a81d0ed60072a1d7bb3374e2e8090a8e8680

SHA256
9c201f8c2fe98590e0ac6bdadfdb94b64c39c999f20e8fdddfb679e8c176482e

SHA512
e5118efd103d00c2fc07721c070af6e0f25b37c177989c2980fc182af3b913e79c3726d5d805f8c5ac4678c8c3d3e50dd8b43206f206b4d549d2d9a945897d74

Download Submit
C:\Users\Admin\AppData\Local\Temp\5dcbe999-72f8-4c02-8025-81a98429ba98.vbs

Filesize
744B

MD5
ef8ee614cb7665d700c6746e69b16a67

SHA1
897ae7a2147e697c6e2639dc2dd52266a82c3e25

SHA256
3adbd547abfb8c2e6018e3cd0d06c4ce6c194ef1c8e7080e4b767942194537b9

SHA512
4fa5033b3a6c19562be2b784a818dd4cce93762d40e2855c8980b534530dfa46332a86ba5992bd3f8941dc4ebd5a81e03181ff76be48d8b2d74dc5432fa925a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\62defe0e-83ad-4cea-9461-ae4b4273ed4f.vbs

Filesize
744B

MD5
492f96f6ed0589a2c165dfafb2c6a971

SHA1
5a84382f54612f95481cc97f64f5ac4a09d4c053

SHA256
9b905c6a107e23b0cac1750c1435890ee274fb5d27fb91d375e18faa1c8b124b

SHA512
9c820300c70c9b99b0b6d0c25d118c25bd3c86c3f1fbf3cda8cf5a5b0bbc25ebeae1f638465495a9400da8217f3d66c1730a0a57d039222f47b4da6e04f4969f

Download Submit
C:\Users\Admin\AppData\Local\Temp\71fb6027-6880-418e-ac80-cbafaa61f403.vbs

Filesize
744B

MD5
f95a63b3882f8f7eb7b136f710ab22ff

SHA1
84c88f2ebb9fdfcf32a82206cc7a8235ecd74202

SHA256
625371c1fc800a04366884fcf133499bf05d291b0e3518f4741a14c0e433ff57

SHA512
e073578b82a3e1537692e63d458f4a69dbd9acf37920f1c4a544aedc37b3da09662287f006d3f850d7497e89e8e4a08b3367e26bfc0dd2be00ded2edd1a62549

Download Submit
C:\Users\Admin\AppData\Local\Temp\79df7b22-5815-46cf-9923-61c4de8b8223.vbs

Filesize
744B

MD5
00e2a2d388ae3388623ec9710acc3468

SHA1
9e3c863d1ac55fa8fbf3e92a7c2d8e07d13a02ff

SHA256
6b9be42a8d296d7de1ccd173cf12c1c4e8fdd88f1a694775a2a64f3499e0b217

SHA512
28b5bc0d463915f46e03b5401b1a660b20532278545a8c9addac95018f3e8b1c46846de5f9559f0b0359f18b3b6080a114ebb3e8a62bc3f691cc8a39a9c359a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\990a1a95-bf92-4786-b024-acad819199bf.vbs

Filesize
744B

MD5
c7c2a40aa5b7bf260c3ed684cf5bcd49

SHA1
69efcd80b4979cade0155ebceb911bf19133779e

SHA256
8422165300e2fff07929e716ab237af9b5e971aa8df014bda30f3a5fb9047157

SHA512
2e76ebb7cfd491628dd09403df26eddde64370982759a29ce9bac607dd1d565a5ba67d94a812615d21d38fbbfe4ad8ba974880cd3363ece0cf52c281a4814f37

Download Submit
C:\Users\Admin\AppData\Local\Temp\9a5c39f1-bb53-4aca-ad56-1ce3913f0e68.vbs

Filesize
743B

MD5
aacf2a12f2fbd66aae7854e5240bc93f

SHA1
1ad97635e0a271f059d4808acec0e95c16e3f1d3

SHA256
01eaabf1f16e3412bcc1b34b6d683b59377cdf4d41eb6afebdfe32d4501ac670

SHA512
357e84ab885ba8ff1e977cdc3b857c2fce61994f2165f8baa76cda2c104da0e09bd810c971636927a827b9f3e5e0acbf2be801fbd8f725f4c071d339f7ec9f6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ba691714-1a03-4982-ba5b-9ae28b2f1512.vbs

Filesize
744B

MD5
b2e963a53a8321816bc38a56b488d917

SHA1
373c7aa2747595149015d549a5241e54b3d2fb71

SHA256
aaedf4d363407a8c28769dd14e942710717c7a510dad3cca85f082895e9f0626

SHA512
bf282ce34899a0be80b2bb198d3c8c85102a78f0d0be603bb481859283959af222258fe3c64cca1332a98dcbe7ba03ede4ea941da3867915e1c8c01610cd6e30

Download Submit
C:\Users\Admin\AppData\Local\Temp\d3bd73e7-6d31-43e3-912e-d5c115009ebd.vbs

Filesize
744B

MD5
04a0b29cd39b002cd3455f12bd0598b4

SHA1
973932923e1f25b27d6c793400208de680e3a509

SHA256
8066244bd2caede3c26441ba025761f4f8b5778b93e24a4d77861aad02fcf022

SHA512
9af1f9821042e7a4a96d8001bc37e8790175eb08a63e8f02eb3f77326adf53d02591d5d635feac090cdd42306576e350f7eb58dc74c2361914f1a22492e09704

Download Submit
C:\Users\Admin\AppData\Local\Temp\d7e2db88-2282-4091-be49-86aabbd01c7f.vbs

Filesize
744B

MD5
194435315451016604d31ab356903489

SHA1
19b12c4ee2c5f6c81c0633a0ab4bb74a4b90f1d9

SHA256
232d184ac45e925b49d12c635250b928ce0984f5be0fc2dffee32adf4c62a0f2

SHA512
409a776aa64798db0366d62aa91953b33b9aa2779f19d4069bab599eef2d7dbedc8e7236fc410e1c669930aa921096ebe18f0721690e81ead83dbc3af26e5aba

Download Submit
C:\Users\Admin\AppData\Local\Temp\f3225b47-5645-440c-8d13-089575b384e5.vbs

Filesize
520B

MD5
ab3016e769e4cf378ed36ab1f121d495

SHA1
9cef1383b9a2a00971dee8c483aede87d3129ae8

SHA256
f42327b0caf59fa170d6f0f3624d65d545c89d95e21e4563ce05322c612c895f

SHA512
3c74989f03202c9bc520ee252e82471db41d45b8511dea93875c71ea878f3c83cb343c0e33072edd97c981f28cba8fdbe0016cf67f00ec67828a7ec89e2f37c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\fd09ceee-fbe9-4cb1-8e85-330a7c303daa.vbs

Filesize
744B

MD5
55cc6990cb0b0d3e5c7210c50ff51064

SHA1
82c1171707db0da752125dd0331df58c6af66afa

SHA256
08b24301c51a8f373eef84ec4ec5890fb4000aa443d7347a78deb4a80448902e

SHA512
4deb66e313c9bbe258d337aa3a42a588ffa82c92fc031868e5e291c566aa407bc4664a364474225d5d98d4f93466cc37ca742d7f9b60cf7758f3ceb680944bcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nDdOsbL9Ya.bat

Filesize
233B

MD5
db4950ade45566ac8ff2f2e46b2f83e7

SHA1
56ba8fe9c5f49c906d7f24448c8a58f7f30aa582

SHA256
cdb99dc8483e103003a000676fbcfe952bef5e222affa0cea7569f8ba16972d4

SHA512
cf7b7ac5e85e69cf91ea05f313203432f394bc60f5fdc742c16b47b57131c47944490c38bd90b1c19a62b9feb7bd67c6ed487db27eba9fd0bae582f6d78c2db7

Download Submit
memory/3144-9-0x000000001B400000-0x000000001B408000-memory.dmp

Filesize
32KB

Download
memory/3144-8-0x000000001B3F0000-0x000000001B3FE000-memory.dmp

Filesize
56KB

Download
memory/3144-7-0x00000000024B0000-0x00000000024BA000-memory.dmp

Filesize
40KB

Download
memory/3144-0-0x00007FF8D4CD3000-0x00007FF8D4CD5000-memory.dmp

Filesize
8KB

Download
memory/3144-6-0x0000000002490000-0x00000000024A6000-memory.dmp

Filesize
88KB

Download
memory/3144-10-0x000000001B410000-0x000000001B41C000-memory.dmp

Filesize
48KB

Download
memory/3144-4-0x000000001B440000-0x000000001B490000-memory.dmp

Filesize
320KB

Download
memory/3144-48-0x00007FF8D4CD0000-0x00007FF8D5791000-memory.dmp

Filesize
10.8MB

Download
memory/3144-5-0x0000000000A40000-0x0000000000A50000-memory.dmp

Filesize
64KB

Download
memory/3144-3-0x0000000002360000-0x000000000237C000-memory.dmp

Filesize
112KB

Download
memory/3144-2-0x00007FF8D4CD0000-0x00007FF8D5791000-memory.dmp

Filesize
10.8MB

Download
memory/3144-1-0x00000000001A0000-0x0000000000284000-memory.dmp

Filesize
912KB

Download