description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2780	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1808	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1880	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1828	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	572	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	836	2464	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2464	schtasks.exe	31

resource	yara_rule
behavioral9/memory/2532-1-0x00000000002A0000-0x000000000037A000-memory.dmp	dcrat
behavioral9/files/0x0005000000019616-17.dat	dcrat
behavioral9/files/0x0011000000015ceb-79.dat	dcrat
behavioral9/files/0x0007000000019610-90.dat	dcrat
behavioral9/memory/2800-172-0x0000000000890000-0x000000000096A000-memory.dmp	dcrat

description	ioc	Process
File created	C:\Program Files\Windows NT\Accessories\it-IT\audiodg.exe	c45000d07293154a655ba52ffb7bab99.exe
File created	C:\Program Files\Windows NT\Accessories\it-IT\42af1c969fbb7b	c45000d07293154a655ba52ffb7bab99.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\System.exe	c45000d07293154a655ba52ffb7bab99.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\lsm.exe	c45000d07293154a655ba52ffb7bab99.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\27d1bcfc3c54e0	c45000d07293154a655ba52ffb7bab99.exe
File opened for modification	C:\Program Files (x86)\Google\CrashReports\explorer.exe	c45000d07293154a655ba52ffb7bab99.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\RCXE7AB.tmp	c45000d07293154a655ba52ffb7bab99.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\System.exe	c45000d07293154a655ba52ffb7bab99.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\it-IT\RCXEEA3.tmp	c45000d07293154a655ba52ffb7bab99.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\it-IT\RCXEEA4.tmp	c45000d07293154a655ba52ffb7bab99.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\RCXE130.tmp	c45000d07293154a655ba52ffb7bab99.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\lsm.exe	c45000d07293154a655ba52ffb7bab99.exe
File opened for modification	C:\Program Files (x86)\Google\CrashReports\RCXE5A7.tmp	c45000d07293154a655ba52ffb7bab99.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\RCXF58C.tmp	c45000d07293154a655ba52ffb7bab99.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\System.exe	c45000d07293154a655ba52ffb7bab99.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\System.exe	c45000d07293154a655ba52ffb7bab99.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\RCXE896.tmp	c45000d07293154a655ba52ffb7bab99.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\it-IT\audiodg.exe	c45000d07293154a655ba52ffb7bab99.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\RCXF58D.tmp	c45000d07293154a655ba52ffb7bab99.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\RCXE12F.tmp	c45000d07293154a655ba52ffb7bab99.exe
File opened for modification	C:\Program Files (x86)\Google\CrashReports\RCXE539.tmp	c45000d07293154a655ba52ffb7bab99.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\101b941d020240	c45000d07293154a655ba52ffb7bab99.exe
File created	C:\Program Files (x86)\Google\CrashReports\explorer.exe	c45000d07293154a655ba52ffb7bab99.exe
File created	C:\Program Files (x86)\Google\CrashReports\7a0fd90576e088	c45000d07293154a655ba52ffb7bab99.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\27d1bcfc3c54e0	c45000d07293154a655ba52ffb7bab99.exe

description	ioc	Process
File created	C:\Windows\Web\Wallpaper\OSPPSVC.exe	c45000d07293154a655ba52ffb7bab99.exe
File created	C:\Windows\Web\Wallpaper\1610b97d3ab4a7	c45000d07293154a655ba52ffb7bab99.exe
File opened for modification	C:\Windows\Web\Wallpaper\RCXE334.tmp	c45000d07293154a655ba52ffb7bab99.exe
File opened for modification	C:\Windows\Web\Wallpaper\RCXE335.tmp	c45000d07293154a655ba52ffb7bab99.exe
File opened for modification	C:\Windows\Web\Wallpaper\OSPPSVC.exe	c45000d07293154a655ba52ffb7bab99.exe

description	pid	Process
Token: SeDebugPrivilege	2532	c45000d07293154a655ba52ffb7bab99.exe
Token: SeDebugPrivilege	2800	OSPPSVC.exe

description	pid	Process	procid_target
PID 2532 wrote to memory of 2300	2532	c45000d07293154a655ba52ffb7bab99.exe	65
PID 2532 wrote to memory of 2300	2532	c45000d07293154a655ba52ffb7bab99.exe	65
PID 2532 wrote to memory of 2300	2532	c45000d07293154a655ba52ffb7bab99.exe	65
PID 2300 wrote to memory of 1800	2300	cmd.exe	67
PID 2300 wrote to memory of 1800	2300	cmd.exe	67
PID 2300 wrote to memory of 1800	2300	cmd.exe	67
PID 2300 wrote to memory of 2800	2300	cmd.exe	68
PID 2300 wrote to memory of 2800	2300	cmd.exe	68
PID 2300 wrote to memory of 2800	2300	cmd.exe	68

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.