dcrat | 3c5d4007aabc7835b586d15313645af2e823dfad1d487cad46453dc3474e2693

Analysis

max time kernel
59s
max time network
58s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 20:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
Size

1.6MB
MD5

522b3cc9b8e0565c5a2eb2d40b7a9513
SHA1

86d71ba007afecc0f28e9815086992099a13f2c4
SHA256

86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12
SHA512

a22e86028dc923064c045563341d3c144f9d3473935c8ebecf54e2a6ab4afb5b21d2cc0a80f92dc96ceb294dbbf2a33ebc48122079acb62f9ec140230e3e6c73
SSDEEP

24576:qsm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:qD8Jijt+xpS/ekYmLGdhEAf7bCcjE

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	2624	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	2624	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2212	2624	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	332	2624	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	296	2624	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	268	2624	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	2624	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	2624	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	2624	schtasks.exe	30

DCRat payload 9 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral25/memory/2848-1-0x0000000000A20000-0x0000000000BC2000-memory.dmp	dcrat
behavioral25/files/0x00060000000193c4-27.dat	dcrat
behavioral25/files/0x000d00000001202c-47.dat	dcrat
behavioral25/files/0x0007000000019250-89.dat	dcrat
behavioral25/memory/2708-91-0x0000000000ED0000-0x0000000001072000-memory.dmp	dcrat
behavioral25/memory/2100-102-0x0000000001200000-0x00000000013A2000-memory.dmp	dcrat
behavioral25/memory/2288-114-0x0000000000360000-0x0000000000502000-memory.dmp	dcrat
behavioral25/memory/3020-126-0x0000000000950000-0x0000000000AF2000-memory.dmp	dcrat
behavioral25/memory/624-138-0x0000000000980000-0x0000000000B22000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2616	powershell.exe
2904	powershell.exe
2964	powershell.exe
2728	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
2708	wininit.exe
2100	wininit.exe
2288	wininit.exe
3020	wininit.exe
624	wininit.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\wininit.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Program Files\7-Zip\56085415360792	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Program Files\7-Zip\RCX7B5D.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Program Files\7-Zip\RCX7BCC.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Program Files\7-Zip\wininit.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts\RCX795A.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Windows\L2Schemas\csrss.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Windows\L2Schemas\csrss.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Windows\L2Schemas\886983d96e3d3e	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Windows\Fonts\69ddcba757bf72	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Windows\L2Schemas\RCX7679.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Windows\Fonts\RCX78EB.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Windows\Fonts\smss.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File created	C:\Windows\Fonts\smss.exe	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
File opened for modification	C:\Windows\L2Schemas\RCX767A.tmp	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2748	schtasks.exe
332	schtasks.exe
2476	schtasks.exe
2280	schtasks.exe
2212	schtasks.exe
296	schtasks.exe
268	schtasks.exe
1852	schtasks.exe
2112	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2848	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
2728	powershell.exe
2616	powershell.exe
2964	powershell.exe
2904	powershell.exe
2708	wininit.exe
2100	wininit.exe
2288	wininit.exe
3020	wininit.exe
624	wininit.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2848	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	2964	powershell.exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	2708	wininit.exe
Token: SeDebugPrivilege	2100	wininit.exe
Token: SeDebugPrivilege	2288	wininit.exe
Token: SeDebugPrivilege	3020	wininit.exe
Token: SeDebugPrivilege	624	wininit.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2616	2848	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	40
PID 2848 wrote to memory of 2616	2848	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	40
PID 2848 wrote to memory of 2616	2848	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	40
PID 2848 wrote to memory of 2904	2848	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	41
PID 2848 wrote to memory of 2904	2848	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	41
PID 2848 wrote to memory of 2904	2848	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	41
PID 2848 wrote to memory of 2964	2848	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	42
PID 2848 wrote to memory of 2964	2848	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	42
PID 2848 wrote to memory of 2964	2848	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	42
PID 2848 wrote to memory of 2728	2848	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	43
PID 2848 wrote to memory of 2728	2848	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	43
PID 2848 wrote to memory of 2728	2848	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	43
PID 2848 wrote to memory of 3000	2848	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	48
PID 2848 wrote to memory of 3000	2848	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	48
PID 2848 wrote to memory of 3000	2848	86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe	48
PID 3000 wrote to memory of 3052	3000	cmd.exe	50
PID 3000 wrote to memory of 3052	3000	cmd.exe	50
PID 3000 wrote to memory of 3052	3000	cmd.exe	50
PID 3000 wrote to memory of 2708	3000	cmd.exe	51
PID 3000 wrote to memory of 2708	3000	cmd.exe	51
PID 3000 wrote to memory of 2708	3000	cmd.exe	51
PID 2708 wrote to memory of 1540	2708	wininit.exe	52
PID 2708 wrote to memory of 1540	2708	wininit.exe	52
PID 2708 wrote to memory of 1540	2708	wininit.exe	52
PID 2708 wrote to memory of 760	2708	wininit.exe	53
PID 2708 wrote to memory of 760	2708	wininit.exe	53
PID 2708 wrote to memory of 760	2708	wininit.exe	53
PID 1540 wrote to memory of 2100	1540	WScript.exe	55
PID 1540 wrote to memory of 2100	1540	WScript.exe	55
PID 1540 wrote to memory of 2100	1540	WScript.exe	55
PID 2100 wrote to memory of 2744	2100	wininit.exe	56
PID 2100 wrote to memory of 2744	2100	wininit.exe	56
PID 2100 wrote to memory of 2744	2100	wininit.exe	56
PID 2100 wrote to memory of 3004	2100	wininit.exe	57
PID 2100 wrote to memory of 3004	2100	wininit.exe	57
PID 2100 wrote to memory of 3004	2100	wininit.exe	57
PID 2744 wrote to memory of 2288	2744	WScript.exe	58
PID 2744 wrote to memory of 2288	2744	WScript.exe	58
PID 2744 wrote to memory of 2288	2744	WScript.exe	58
PID 2288 wrote to memory of 1524	2288	wininit.exe	59
PID 2288 wrote to memory of 1524	2288	wininit.exe	59
PID 2288 wrote to memory of 1524	2288	wininit.exe	59
PID 2288 wrote to memory of 2932	2288	wininit.exe	60
PID 2288 wrote to memory of 2932	2288	wininit.exe	60
PID 2288 wrote to memory of 2932	2288	wininit.exe	60
PID 1524 wrote to memory of 3020	1524	WScript.exe	61
PID 1524 wrote to memory of 3020	1524	WScript.exe	61
PID 1524 wrote to memory of 3020	1524	WScript.exe	61
PID 3020 wrote to memory of 2808	3020	wininit.exe	62
PID 3020 wrote to memory of 2808	3020	wininit.exe	62
PID 3020 wrote to memory of 2808	3020	wininit.exe	62
PID 3020 wrote to memory of 2292	3020	wininit.exe	63
PID 3020 wrote to memory of 2292	3020	wininit.exe	63
PID 3020 wrote to memory of 2292	3020	wininit.exe	63
PID 2808 wrote to memory of 624	2808	WScript.exe	64
PID 2808 wrote to memory of 624	2808	WScript.exe	64
PID 2808 wrote to memory of 624	2808	WScript.exe	64
PID 624 wrote to memory of 1708	624	wininit.exe	65
PID 624 wrote to memory of 1708	624	wininit.exe	65
PID 624 wrote to memory of 1708	624	wininit.exe	65
PID 624 wrote to memory of 1808	624	wininit.exe	66
PID 624 wrote to memory of 1808	624	wininit.exe	66
PID 624 wrote to memory of 1808	624	wininit.exe	66

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
"C:\Users\Admin\AppData\Local\Temp\86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\L2Schemas\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Fonts\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2728
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nbjzFmbPFe.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3052
- - C:\Program Files\7-Zip\wininit.exe
    "C:\Program Files\7-Zip\wininit.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\da1dbcbf-d4b8-4b09-8df1-724b7a830ef0.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1540
    - - C:\Program Files\7-Zip\wininit.exe
        
        "C:\Program Files\7-Zip\wininit.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2100
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f269809c-3677-471b-80bd-caffc0eadd83.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2744
        
        C:\Program Files\7-Zip\wininit.exe
        
        "C:\Program Files\7-Zip\wininit.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2288
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\35c3e8f9-21d4-43d5-85e8-5adf10f13b66.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1524
        
        C:\Program Files\7-Zip\wininit.exe
        
        "C:\Program Files\7-Zip\wininit.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3020
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d8ba2609-4f27-436a-a01a-aff8e4ebcde2.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2808
        
        C:\Program Files\7-Zip\wininit.exe
        
        "C:\Program Files\7-Zip\wininit.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:624
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5895c246-ec3c-4abe-be82-6a9b46cca2d0.vbs"
        12⤵
        
        PID:1708
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2ccab419-892b-4f67-8c1e-a46a6706c4b4.vbs"
        12⤵
        
        PID:1808
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e36f7c35-020e-4895-84d4-d0481cd13d05.vbs"
        10⤵
        
        PID:2292
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4645d953-c2f4-45be-96e7-cc7235f4d481.vbs"
        8⤵
        
        PID:2932
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d942a078-5d76-4415-a43a-f72e5be7b6e9.vbs"
        6⤵
        
        PID:3004
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e738fd97-fe46-4464-9a1f-0e89c3f99dc2.vbs"
      4⤵
      PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\L2Schemas\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\L2Schemas\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\L2Schemas\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\Fonts\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Fonts\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Windows\Fonts\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files\7-Zip\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\7-Zip\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files\7-Zip\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\wininit.exe

Filesize
1.6MB

MD5
5fa4f46215c0b832d7f8b676b37cbf8d

SHA1
2e1bdf2fc115eafda488aa6dfdc8038b2fff5070

SHA256
60a19df832b62c5fc3b03d643fd441b9a60843c7288a5532059326bd0ed96764

SHA512
843c50e322763e349c1cc70a2566225e4b220f9ca81785639134ab0b43f1dcdb572b680db92c1f61c8e5d51127ffde427c4281ba724acff71c2b03afc30ce567

Download Submit
C:\Users\Admin\AppData\Local\Temp\35c3e8f9-21d4-43d5-85e8-5adf10f13b66.vbs

Filesize
710B

MD5
13ff722d0560ed39905c66e89ba4e2c8

SHA1
0fa1a4af41fd706b633bf8c42b4602c29a8d1170

SHA256
4d4767c2bb0084dd3d17cc89af82a61bf686bae6b99880bf6c67b90f57794aaf

SHA512
64ae51de1745a2c6a5f27de46fd4666ed069823ffa31cc5bff1fb7de5d4926d39048181aea3ee3bb2cb9ac69a1e98ee4c14164014ebbb4fe1a138816587f4d9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\5895c246-ec3c-4abe-be82-6a9b46cca2d0.vbs

Filesize
709B

MD5
6aa233546dcddc38c0d81ad6fd688f68

SHA1
32d7d8bafd1e7b2b04c7b1bb6659b00a62cfd140

SHA256
6908575c30884f644b8a1f286169ee62bd9d63cea15c8aa7a849c38f36cab33f

SHA512
7a45db218a76d5763cf0c11591c3210a7918415e5ebb525b8b372c5364831a0765cd1d72a9aed429700e9bfd74e39a154cc93869f3b1caa566430bdd651b34ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\RCX7476.tmp

Filesize
1.6MB

MD5
522b3cc9b8e0565c5a2eb2d40b7a9513

SHA1
86d71ba007afecc0f28e9815086992099a13f2c4

SHA256
86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12

SHA512
a22e86028dc923064c045563341d3c144f9d3473935c8ebecf54e2a6ab4afb5b21d2cc0a80f92dc96ceb294dbbf2a33ebc48122079acb62f9ec140230e3e6c73

Download Submit
C:\Users\Admin\AppData\Local\Temp\d8ba2609-4f27-436a-a01a-aff8e4ebcde2.vbs

Filesize
710B

MD5
38574fda645e94aec85ed134c7d7883e

SHA1
1978e8a949f6495a9a3f7cd448d7f7e17d84696c

SHA256
6e5653c835c752ecb44afce5fd101d2854e38cf24980c5c77473ed7ad0429b1b

SHA512
35a07052d3536ec29d057fb40daed963f6fe2d51911089618ad2a5884053b3f54b6e10e58993f52f95ef8edff933338395605b487a56e87dfa968bb4656d8c6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\da1dbcbf-d4b8-4b09-8df1-724b7a830ef0.vbs

Filesize
710B

MD5
15589c8c0139394967b03e5795dde3da

SHA1
42c433b312c322116ded1f700752b006be41026b

SHA256
6074668dc1d0ee0800625d5110dd38071b4c159b3432bfe26a6c9b9e83f95b9f

SHA512
cba1da93b65ea5cb56bd6087b5418d0819b68f81bad74e41fcb0ae7d3d0158ffc41f73bd31c9ecc1b924a763bf1723c65b44af9ad7155f4aa40dd7183026c599

Download Submit
C:\Users\Admin\AppData\Local\Temp\e738fd97-fe46-4464-9a1f-0e89c3f99dc2.vbs

Filesize
486B

MD5
f57d317030bf391362180861ceadc2b1

SHA1
a8152a563dea3ec0ae6b48c4315dd2ed4a733759

SHA256
595571a2391da0f3b17b7054b63b0cdb29c0097ee12ef31fd3bf60e606dffe0c

SHA512
0a3061744361c7cef4fd53842badce324d824fa89fac17d5ac73685815a7e86a58db49d0e094b27c5d6c42996a04a6ed8b688a27574fd81a1ad5c6ae2c0b6e0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\f269809c-3677-471b-80bd-caffc0eadd83.vbs

Filesize
710B

MD5
c9d3b76946507306ce360bc3b5f4823c

SHA1
9b9bedc001104f768ce257fc65d166348af267e0

SHA256
b6a83dcec8689835ebf850e5ff58b2af992edf67b3873a28d3cc1edd533e774f

SHA512
8ad6d079e3e9f408da33c13426ace560d60704ab5fa9473f8e76c11dfbe675d027aa951272c0d61659fc5d14ae370695eb0a01dc05885ee96edd10f603db4153

Download Submit
C:\Users\Admin\AppData\Local\Temp\nbjzFmbPFe.bat

Filesize
199B

MD5
3cf20f989878056adbb4cf66af322bb2

SHA1
52650f280a3240944db59b8c46ab5a60499e32df

SHA256
c09e291659371c1d7a1bcb6fa06fef5509cb2ead2e21baa57006825b0cd3cea5

SHA512
2b2f5d87fe5b13474c2b91d8cad5317f6cbfb809235a4a8c659ee41e4042e2a69f321e105d1fc944af9b34986f290056c20a9449b1a39b5977079fef82de4e5d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NWWFAI1FK2VLLQQKD90Y.temp

Filesize
7KB

MD5
c6933d0194f6ae6557ce71115e2814d7

SHA1
1bcd5a89a6f28b2f10dd21b770aec65421af8182

SHA256
9fd49e15e41f019a82688c3b61237122e98dd06710777949d1157218c13c3a5f

SHA512
578eabbf3274cf5e5dfd30b8efffaa8edb20dced6b2271a0c36efb379819e4c7602d8c2c1ff754b40d1114d584dc1268a8dd5f13386a3b83f59384a1aeb536cc

Download Submit
C:\Windows\Fonts\smss.exe

Filesize
1.6MB

MD5
283b1e7fafad30f27ff0c24b8b5b63da

SHA1
1f25dae1e4e46df2b9aff0c2d10ac0153613994d

SHA256
40a2a39dc17c1c481b30fb7c30ff56208f0468e7cace33d15e588d0f9c34ddd0

SHA512
74dba5cd2d182e3cacb86fe4cc128426e4c17856ffaa1fa5ebcae670b2264c19b69b793b1eb25f6bb453788afe222480c1d56c80319147bf7350604cba547fe6

Download Submit
memory/624-138-0x0000000000980000-0x0000000000B22000-memory.dmp

Filesize
1.6MB

Download
memory/2100-102-0x0000000001200000-0x00000000013A2000-memory.dmp

Filesize
1.6MB

Download
memory/2288-114-0x0000000000360000-0x0000000000502000-memory.dmp

Filesize
1.6MB

Download
memory/2616-87-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/2708-91-0x0000000000ED0000-0x0000000001072000-memory.dmp

Filesize
1.6MB

Download
memory/2728-88-0x0000000002960000-0x0000000002968000-memory.dmp

Filesize
32KB

Download
memory/2848-10-0x0000000000580000-0x000000000058C000-memory.dmp

Filesize
48KB

Download
memory/2848-6-0x0000000000270000-0x0000000000278000-memory.dmp

Filesize
32KB

Download
memory/2848-9-0x0000000000450000-0x000000000045C000-memory.dmp

Filesize
48KB

Download
memory/2848-66-0x000007FEF5540000-0x000007FEF5F2C000-memory.dmp

Filesize
9.9MB

Download
memory/2848-8-0x0000000000440000-0x0000000000448000-memory.dmp

Filesize
32KB

Download
memory/2848-11-0x0000000000590000-0x000000000059A000-memory.dmp

Filesize
40KB

Download
memory/2848-16-0x00000000009F0000-0x00000000009FC000-memory.dmp

Filesize
48KB

Download
memory/2848-7-0x0000000000430000-0x0000000000440000-memory.dmp

Filesize
64KB

Download
memory/2848-15-0x00000000009E0000-0x00000000009EA000-memory.dmp

Filesize
40KB

Download
memory/2848-0-0x000007FEF5543000-0x000007FEF5544000-memory.dmp

Filesize
4KB

Download
memory/2848-5-0x0000000000410000-0x0000000000426000-memory.dmp

Filesize
88KB

Download
memory/2848-13-0x00000000005B0000-0x00000000005B8000-memory.dmp

Filesize
32KB

Download
memory/2848-4-0x0000000000260000-0x0000000000270000-memory.dmp

Filesize
64KB

Download
memory/2848-14-0x00000000009D0000-0x00000000009D8000-memory.dmp

Filesize
32KB

Download
memory/2848-3-0x0000000000240000-0x000000000025C000-memory.dmp

Filesize
112KB

Download
memory/2848-1-0x0000000000A20000-0x0000000000BC2000-memory.dmp

Filesize
1.6MB

Download
memory/2848-2-0x000007FEF5540000-0x000007FEF5F2C000-memory.dmp

Filesize
9.9MB

Download
memory/2848-12-0x00000000005A0000-0x00000000005AE000-memory.dmp

Filesize
56KB

Download
memory/3020-126-0x0000000000950000-0x0000000000AF2000-memory.dmp

Filesize
1.6MB

Download