dcrat | 4bcbb8983fe7425976c5a1789deff73fb138e80981f5ebfef1f835bcc6757760

Resubmissions

14/04/2025, 07:51

250414-jp1kfssjz9 10

14/04/2025, 07:46

250414-jl9nyssjt9 10

08/04/2025, 15:58

250408-tevasswl18 10

08/04/2025, 14:19

250408-rm2nqsvqw2 10

Analysis

max time kernel
103s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2025, 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa942bbb984e2be3a2e1d8414cc00cd7.exe
Size

984KB
MD5

fa942bbb984e2be3a2e1d8414cc00cd7
SHA1

822821106f149cbc674cccf5d8cc1aec612bb8f4
SHA256

07419cc322e8ed4baae30a8ba72afc56634175dd54b57c513112e420a9cc69b4
SHA512

57f062fa5d5fbfa9ebba4ca401e42954b0ed16ec7bc4f28bc6ca00b06e273bbe6dbcab895fc6e460262fcb42cd3a0705a61bb4de2d8a2a08baabb738868af2dc
SSDEEP

12288:zzZvuvewk/0pPPXA5q/TQ9+n95vV25gnwHexSDwbwvDxlpaS98IUNldnd65EgF1s:zzZvuGD2PvA5YxwmbZB6Uv

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 10 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	996	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4208	996	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1380	996	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4908	996	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1512	996	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	996	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3656	996	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3796	996	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3096	996	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	996	schtasks.exe	88

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Executes dropped EXE 11 IoCs

pid	Process
3164	csrss.exe
4268	unsecapp.exe
2748	dwm.exe
4476	fa942bbb984e2be3a2e1d8414cc00cd7.exe
712	dllhost.exe
4912	csrss.exe
2992	dllhost.exe
3840	OfficeClickToRun.exe
3484	winlogon.exe
1560	dllhost.exe
4564	winlogon.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\SchCache\\dllhost.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RINTL.kk-kz\\OfficeClickToRun.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Documents and Settings\\dllhost.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\c2c7c62e3dd3bcbd2ee6d4\\csrss.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\System32\\wbem\\netprofm\\unsecapp.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fa942bbb984e2be3a2e1d8414cc00cd7 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\f62837f3bc66012b94d74cc471f3d97a\\fa942bbb984e2be3a2e1d8414cc00cd7.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\Offline Web Pages\\csrss.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\System32\\XAudio2_9\\winlogon.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\a5520cf74cedd2462ce392906afc\\dllhost.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\inetcomm\\dwm.exe\""	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\System32\inetcomm\6cb0b6c459d5d3	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Windows\System32\wbem\netprofm\29c1c3cc0f7685	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Windows\System32\XAudio2_9\winlogon.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Windows\System32\XAudio2_9\cc11b995f2a76d	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Windows\System32\inetcomm\RCXB17F.tmp	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Windows\System32\wbem\netprofm\unsecapp.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Windows\System32\wbem\netprofm\unsecapp.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Windows\System32\inetcomm\dwm.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Windows\System32\wbem\netprofm\RCXB384.tmp	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Windows\System32\XAudio2_9\RCXBDE9.tmp	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Windows\System32\XAudio2_9\winlogon.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Windows\System32\inetcomm\dwm.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz\OfficeClickToRun.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz\e6c9b481da804f	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz\RCXB9E0.tmp	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz\OfficeClickToRun.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SchCache\dllhost.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Windows\Offline Web Pages\RCXBBE5.tmp	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Windows\Offline Web Pages\csrss.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Windows\SchCache\dllhost.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Windows\SchCache\5940a34987c991	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Windows\Offline Web Pages\csrss.exe	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File created	C:\Windows\Offline Web Pages\886983d96e3d3e	fa942bbb984e2be3a2e1d8414cc00cd7.exe
File opened for modification	C:\Windows\SchCache\RCXB7CC.tmp	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000_Classes\Local Settings	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2024	schtasks.exe
3796	schtasks.exe
3096	schtasks.exe
2684	schtasks.exe
2428	schtasks.exe
1380	schtasks.exe
1512	schtasks.exe
3656	schtasks.exe
4208	schtasks.exe
4908	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3884	fa942bbb984e2be3a2e1d8414cc00cd7.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	3884	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Token: SeDebugPrivilege	3164	csrss.exe
Token: SeDebugPrivilege	4268	unsecapp.exe
Token: SeDebugPrivilege	2748	dwm.exe
Token: SeDebugPrivilege	712	dllhost.exe
Token: SeDebugPrivilege	4476	fa942bbb984e2be3a2e1d8414cc00cd7.exe
Token: SeDebugPrivilege	3484	winlogon.exe
Token: SeDebugPrivilege	4912	csrss.exe
Token: SeDebugPrivilege	1560	dllhost.exe
Token: SeDebugPrivilege	2992	dllhost.exe
Token: SeDebugPrivilege	3840	OfficeClickToRun.exe
Token: SeDebugPrivilege	4564	winlogon.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 3164	1312	cmd.exe	102
PID 1312 wrote to memory of 3164	1312	cmd.exe	102
PID 4412 wrote to memory of 4268	4412	cmd.exe	112
PID 4412 wrote to memory of 4268	4412	cmd.exe	112
PID 1276 wrote to memory of 2748	1276	cmd.exe	116
PID 1276 wrote to memory of 2748	1276	cmd.exe	116
PID 1504 wrote to memory of 4476	1504	cmd.exe	122
PID 1504 wrote to memory of 4476	1504	cmd.exe	122
PID 1588 wrote to memory of 712	1588	cmd.exe	123
PID 1588 wrote to memory of 712	1588	cmd.exe	123
PID 3124 wrote to memory of 4912	3124	cmd.exe	124
PID 3124 wrote to memory of 4912	3124	cmd.exe	124
PID 3704 wrote to memory of 2992	3704	cmd.exe	125
PID 3704 wrote to memory of 2992	3704	cmd.exe	125
PID 3584 wrote to memory of 3840	3584	cmd.exe	126
PID 3584 wrote to memory of 3840	3584	cmd.exe	126
PID 4016 wrote to memory of 3484	4016	cmd.exe	127
PID 4016 wrote to memory of 3484	4016	cmd.exe	127
PID 1156 wrote to memory of 1560	1156	cmd.exe	128
PID 1156 wrote to memory of 1560	1156	cmd.exe	128
PID 3884 wrote to memory of 3732	3884	fa942bbb984e2be3a2e1d8414cc00cd7.exe	133
PID 3884 wrote to memory of 3732	3884	fa942bbb984e2be3a2e1d8414cc00cd7.exe	133
PID 3732 wrote to memory of 3436	3732	cmd.exe	135
PID 3732 wrote to memory of 3436	3732	cmd.exe	135
PID 3732 wrote to memory of 4564	3732	cmd.exe	139
PID 3732 wrote to memory of 4564	3732	cmd.exe	139

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fa942bbb984e2be3a2e1d8414cc00cd7.exe
"C:\Users\Admin\AppData\Local\Temp\fa942bbb984e2be3a2e1d8414cc00cd7.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IVwKE84btE.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3436
- - C:\Windows\System32\XAudio2_9\winlogon.exe
    "C:\Windows\System32\XAudio2_9\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\c2c7c62e3dd3bcbd2ee6d4\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\c2c7c62e3dd3bcbd2ee6d4\csrss.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1312
- C:\c2c7c62e3dd3bcbd2ee6d4\csrss.exe
  C:\c2c7c62e3dd3bcbd2ee6d4\csrss.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\inetcomm\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\System32\inetcomm\dwm.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\System32\inetcomm\dwm.exe
  C:\Windows\System32\inetcomm\dwm.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\System32\wbem\netprofm\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\netprofm\unsecapp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\System32\wbem\netprofm\unsecapp.exe
  C:\Windows\System32\wbem\netprofm\unsecapp.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fa942bbb984e2be3a2e1d8414cc00cd7" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\f62837f3bc66012b94d74cc471f3d97a\fa942bbb984e2be3a2e1d8414cc00cd7.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f62837f3bc66012b94d74cc471f3d97a\fa942bbb984e2be3a2e1d8414cc00cd7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Users\Admin\AppData\Local\Temp\f62837f3bc66012b94d74cc471f3d97a\fa942bbb984e2be3a2e1d8414cc00cd7.exe
  C:\Users\Admin\AppData\Local\Temp\f62837f3bc66012b94d74cc471f3d97a\fa942bbb984e2be3a2e1d8414cc00cd7.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\SchCache\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\SchCache\dllhost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Windows\SchCache\dllhost.exe
  C:\Windows\SchCache\dllhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz\OfficeClickToRun.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz\OfficeClickToRun.exe
  "C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz\OfficeClickToRun.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\Offline Web Pages\csrss.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\Offline Web Pages\csrss.exe
  "C:\Windows\Offline Web Pages\csrss.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\XAudio2_9\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Documents and Settings\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\System32\XAudio2_9\winlogon.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Windows\System32\XAudio2_9\winlogon.exe
  C:\Windows\System32\XAudio2_9\winlogon.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Documents and Settings\dllhost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Documents and Settings\dllhost.exe
  "C:\Documents and Settings\dllhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\a5520cf74cedd2462ce392906afc\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3796

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\a5520cf74cedd2462ce392906afc\dllhost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1156
- C:\a5520cf74cedd2462ce392906afc\dllhost.exe
  C:\a5520cf74cedd2462ce392906afc\dllhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fa942bbb984e2be3a2e1d8414cc00cd7.exe.log

Filesize
1KB

MD5
bbb951a34b516b66451218a3ec3b0ae1

SHA1
7393835a2476ae655916e0a9687eeaba3ee876e9

SHA256
eb70c64ae99d14ac2588b7a84854fbf3c420532d7fe4dfd49c7b5a70c869943a

SHA512
63bcbfcf8e7421c66855c487c31b2991a989bdea0c1edd4c40066b52fa3eb3d9d37db1cd21b8eb4f33dd5870cc20532c8f485eab9c0b4f6b0793a35c077f2d6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\winlogon.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Temp\IVwKE84btE.bat

Filesize
206B

MD5
443b952390ed2c5e55dcb75f14fc384f

SHA1
d7b16bfbc310f55ca1ed58167a449552eff14a7b

SHA256
7abf58c795fddb34e42af415ba613ba6642da4a07ef1452b97d6d38294ecbb7b

SHA512
d0bd0194f7b4be48d00db7c16f37c2b086ace7ee3e4c7f2eb37ba2585a08e448bc7eba66d200fbeb35da2a9e41fc66f5ee35eb493ad89dc3ff61156e397254b3

Download Submit
C:\Windows\SchCache\dllhost.exe

Filesize
984KB

MD5
fa942bbb984e2be3a2e1d8414cc00cd7

SHA1
822821106f149cbc674cccf5d8cc1aec612bb8f4

SHA256
07419cc322e8ed4baae30a8ba72afc56634175dd54b57c513112e420a9cc69b4

SHA512
57f062fa5d5fbfa9ebba4ca401e42954b0ed16ec7bc4f28bc6ca00b06e273bbe6dbcab895fc6e460262fcb42cd3a0705a61bb4de2d8a2a08baabb738868af2dc

Download Submit
memory/3884-10-0x00000000010D0000-0x00000000010E2000-memory.dmp

Filesize
72KB

Download
memory/3884-11-0x000000001C200000-0x000000001C728000-memory.dmp

Filesize
5.2MB

Download
memory/3884-8-0x0000000000F60000-0x0000000000F70000-memory.dmp

Filesize
64KB

Download
memory/3884-7-0x0000000000F50000-0x0000000000F58000-memory.dmp

Filesize
32KB

Download
memory/3884-6-0x0000000000F30000-0x0000000000F40000-memory.dmp

Filesize
64KB

Download
memory/3884-9-0x00000000010C0000-0x00000000010CC000-memory.dmp

Filesize
48KB

Download
memory/3884-0-0x00007FFD9C9D3000-0x00007FFD9C9D5000-memory.dmp

Filesize
8KB

Download
memory/3884-5-0x0000000000CB0000-0x0000000000CC0000-memory.dmp

Filesize
64KB

Download
memory/3884-12-0x0000000001110000-0x000000000111C000-memory.dmp

Filesize
48KB

Download
memory/3884-4-0x000000001B410000-0x000000001B460000-memory.dmp

Filesize
320KB

Download
memory/3884-3-0x0000000000F10000-0x0000000000F2C000-memory.dmp

Filesize
112KB

Download
memory/3884-102-0x00007FFD9C9D0000-0x00007FFD9D491000-memory.dmp

Filesize
10.8MB

Download
memory/3884-2-0x00007FFD9C9D0000-0x00007FFD9D491000-memory.dmp

Filesize
10.8MB

Download
memory/3884-1-0x0000000000610000-0x000000000070C000-memory.dmp

Filesize
1008KB

Download
memory/4564-114-0x000000001BE90000-0x000000001BF92000-memory.dmp

Filesize
1.0MB

Download
memory/4564-115-0x000000001BE90000-0x000000001BF92000-memory.dmp

Filesize
1.0MB

Download