dcrat | 3c5d4007aabc7835b586d15313645af2e823dfad1d487cad46453dc3474e2693

Analysis

max time kernel
147s
max time network
156s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 20:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe
Size 827KB
Sample250322-zaqppszvbx
SHA256 8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e
MD5 7d14c283441fdefcf681cc58017bb841
SHA1 cdfe7ca961f11fd078a314335ce8c19f3acf2409
SHA512 413f00a1c2dc19c43bf1a61738ac605c405f4834095a0e410091cfbb10085d56afe8bd99928477b5dec24c3b323c387da1e3bc6680409681a1d66a7318d3eb9f
SSDEEP 12288:sNtD0qKiyhtFrXketHevYS6Rc/OOi1GuHQiEHRu3oDK:snKiyhXket+vYNSi+iEE3oO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	484	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1280	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	468	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	584	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1500	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	388	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	772	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1336	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	316	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	668	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3004	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	700	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	916	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	3048	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	932	3048	schtasks.exe	31

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral21/memory/1928-1-0x0000000000140000-0x0000000000216000-memory.dmp	dcrat
behavioral21/files/0x00050000000193a5-11.dat	dcrat
behavioral21/memory/2256-39-0x0000000000D70000-0x0000000000E46000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
2256	sppsvc.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files\Uninstall Information\sppsvc.exe	8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\dwm.exe	8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe
File created	C:\Program Files (x86)\Windows Sidebar\csrss.exe	8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\dwm.exe	8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\6cb0b6c459d5d3	8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe
File created	C:\Program Files\Internet Explorer\es-ES\csrss.exe	8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe
File opened for modification	C:\Program Files\Uninstall Information\sppsvc.exe	8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe
File created	C:\Program Files (x86)\Windows Defender\en-US\1610b97d3ab4a7	8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\6cb0b6c459d5d3	8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe
File created	C:\Program Files\Uninstall Information\0a1fd5f707cd16	8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\886983d96e3d3e	8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe
File created	C:\Program Files\Internet Explorer\ja-JP\0a1fd5f707cd16	8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe
File created	C:\Program Files (x86)\Windows Defender\en-US\OSPPSVC.exe	8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\csrss.exe	8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe
File created	C:\Program Files\Internet Explorer\ja-JP\sppsvc.exe	8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe
File created	C:\Program Files (x86)\Windows Sidebar\886983d96e3d3e	8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe
File created	C:\Program Files\Internet Explorer\es-ES\886983d96e3d3e	8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2544	schtasks.exe
2604	schtasks.exe
756	schtasks.exe
3064	schtasks.exe
484	schtasks.exe
1280	schtasks.exe
2016	schtasks.exe
2676	schtasks.exe
2344	schtasks.exe
1748	schtasks.exe
2860	schtasks.exe
2940	schtasks.exe
1944	schtasks.exe
916	schtasks.exe
2764	schtasks.exe
2804	schtasks.exe
2704	schtasks.exe
1336	schtasks.exe
2820	schtasks.exe
2552	schtasks.exe
536	schtasks.exe
584	schtasks.exe
388	schtasks.exe
772	schtasks.exe
668	schtasks.exe
3004	schtasks.exe
2724	schtasks.exe
2512	schtasks.exe
2856	schtasks.exe
1140	schtasks.exe
1956	schtasks.exe
1032	schtasks.exe
932	schtasks.exe
2688	schtasks.exe
468	schtasks.exe
1500	schtasks.exe
316	schtasks.exe
2864	schtasks.exe
700	schtasks.exe
2648	schtasks.exe
1592	schtasks.exe
1648	schtasks.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2256	sppsvc.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1928	8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe
1928	8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe
1928	8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe
1928	8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe
1928	8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe
1928	8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe
1928	8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe
2256	sppsvc.exe
2256	sppsvc.exe
2256	sppsvc.exe
2256	sppsvc.exe
2256	sppsvc.exe
2256	sppsvc.exe
2256	sppsvc.exe
2256	sppsvc.exe
2256	sppsvc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2256	sppsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1928	8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe
Token: SeDebugPrivilege	2256	sppsvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 776	1928	8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe	74
PID 1928 wrote to memory of 776	1928	8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe	74
PID 1928 wrote to memory of 776	1928	8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe	74
PID 776 wrote to memory of 2112	776	cmd.exe	76
PID 776 wrote to memory of 2112	776	cmd.exe	76
PID 776 wrote to memory of 2112	776	cmd.exe	76
PID 776 wrote to memory of 2256	776	cmd.exe	77
PID 776 wrote to memory of 2256	776	cmd.exe	77
PID 776 wrote to memory of 2256	776	cmd.exe	77
PID 776 wrote to memory of 2256	776	cmd.exe	77
PID 776 wrote to memory of 2256	776	cmd.exe	77

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe
"C:\Users\Admin\AppData\Local\Temp\8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jTD2MXd5XY.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:776
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2112
- - C:\Program Files\Internet Explorer\ja-JP\sppsvc.exe
    "C:\Program Files\Internet Explorer\ja-JP\sppsvc.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files\Uninstall Information\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Uninstall Information\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\en-US\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\en-US\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\en-US\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Videos\Sample Videos\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Public\Videos\Sample Videos\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Videos\Sample Videos\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Internet Explorer\ja-JP\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\ja-JP\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files\Internet Explorer\ja-JP\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\es-ES\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Internet Explorer\es-ES\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\es-ES\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Internet Explorer\es-ES\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dwm.exe

Path C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\dwm.exe
Size 827KB
SHA256 8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e
MD5 7d14c283441fdefcf681cc58017bb841
SHA1 cdfe7ca961f11fd078a314335ce8c19f3acf2409
SHA512 413f00a1c2dc19c43bf1a61738ac605c405f4834095a0e410091cfbb10085d56afe8bd99928477b5dec24c3b323c387da1e3bc6680409681a1d66a7318d3eb9f
SSDEEP 12288:sNtD0qKiyhtFrXketHevYS6Rc/OOi1GuHQiEHRu3oDK:snKiyhXket+vYNSi+iEE3oO
MD5 SHA1 SHA512 SSDEEP

Submit Download

jTD2MXd5XY.bat

Path C:\Users\Admin\AppData\Local\Temp\jTD2MXd5XY.bat
Size 216B
SHA256 f1d509ed0d928f61b83a6b5bdde77e65e07395cc9d3bf6f72013c0ca09fe83a4
MD5 870e347c2bdb53dc384b82bd557dba85
SHA1 c49fcbc435aa648f73a70a5e4ecdc74fb375d39a
SHA512 841c20619bd24963abb62d2f9f4ede00675c13d9050a8969e714e4db9eb4e37185cac56fe59478ab4b3444fd4c67d2e731b59043b97e03d66b419b9d3a26fbb6
MD5 SHA1 SHA512

Submit Download

memory/1928-0-0x000007FEF5813000-0x000007FEF5814000-memory.dmp

Download

memory/1928-1-0x0000000000140000-0x0000000000216000-memory.dmp

Download

memory/1928-2-0x000007FEF5810000-0x000007FEF61FC000-memory.dmp

Download

memory/1928-36-0x000007FEF5810000-0x000007FEF61FC000-memory.dmp

Download

memory/2256-39-0x0000000000D70000-0x0000000000E46000-memory.dmp

Download