dcrat | e7cf9ae73751f92a53dbbc41b4939510e23352bf3a942e86b269c72b80cdb63c

Analysis

max time kernel
119s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20250610-en
resource tags

arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2025, 21:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EB71BD542C88DEE476937C64F685729E.exe
Size 3.4MB
Sample251008-1p5b3seq8w
SHA256 e7cf9ae73751f92a53dbbc41b4939510e23352bf3a942e86b269c72b80cdb63c
MD5 eb71bd542c88dee476937c64f685729e
SHA1 9c5264de5006a051cf949d749173211af5f71086
SHA512 1b58ae7989d54093eccd0b06e07440b6e0769ed85aa149f12796bbc0a29553eebd70f764edd9d3ad40e0e592100d0887f565c8fddd072729a51b003821c6330e
SSDEEP 49152:mSWEezum6cP6UWecaJtx1Y2QUoB70+xfiXkRSMxUoMK4U7gqo:PWim6cC5eBxCB5Bxfg0dmo3M
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion execution dcrat infostealer persistence rat trojan

Malware Config

Signatures

DcRat 49 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		3448	schtasks.exe
		1476	schtasks.exe
		1168	schtasks.exe
		2788	schtasks.exe
		5064	schtasks.exe
		2272	schtasks.exe
		1872	schtasks.exe
		952	schtasks.exe
		1568	schtasks.exe
		4520	schtasks.exe
		4872	schtasks.exe
		3484	schtasks.exe
		2668	schtasks.exe
		64	schtasks.exe
		4708	schtasks.exe
		4596	schtasks.exe
		1084	schtasks.exe
		4364	schtasks.exe
		4108	schtasks.exe
		3376	schtasks.exe
		1792	schtasks.exe
		4068	schtasks.exe
		2588	schtasks.exe
		64	schtasks.exe
		3812	schtasks.exe
		4540	schtasks.exe
		4232	schtasks.exe
		4752	schtasks.exe
		1480	schtasks.exe
		4848	schtasks.exe
		384	schtasks.exe
		4184	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		EB71BD542C88DEE476937C64F685729E.exe
		872	schtasks.exe
		112	schtasks.exe
		1540	schtasks.exe
		1168	schtasks.exe
		4708	schtasks.exe
		736	schtasks.exe
		1308	schtasks.exe
		1452	schtasks.exe
		4764	schtasks.exe
		636	schtasks.exe
		3908	schtasks.exe
		3896	schtasks.exe
		2816	schtasks.exe
		1560	schtasks.exe
		4524	schtasks.exe
		1848	schtasks.exe

Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 16 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\SendTo\\csrss.exe\", \"C:\\513f912a0bcac845f169\\csrss.exe\", \"C:\\513f912a0bcac845f169\\smss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\spoolsv.exe\", \"C:\\Users\\Admin\\Templates\\dllhost.exe\", \"C:\\513f912a0bcac845f169\\explorer.exe\", \"C:\\439b749fc5b925b896b5d131\\dllhost.exe\", \"C:\\513f912a0bcac845f169\\System.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Idle.exe\", \"C:\\513f912a0bcac845f169\\RuntimeBroker.exe\", \"C:\\Windows\\Speech_OneCore\\Engines\\Lexicon\\es-ES\\EB71BD542C88DEE476937C64F685729E.exe\", \"C:\\Users\\Admin\\dwm.exe\", \"C:\\Users\\Public\\AccountPictures\\Registry.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\SendTo\\csrss.exe\", \"C:\\513f912a0bcac845f169\\csrss.exe\", \"C:\\513f912a0bcac845f169\\smss.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\SendTo\\csrss.exe\", \"C:\\513f912a0bcac845f169\\csrss.exe\", \"C:\\513f912a0bcac845f169\\smss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\spoolsv.exe\", \"C:\\Users\\Admin\\Templates\\dllhost.exe\", \"C:\\513f912a0bcac845f169\\explorer.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\SendTo\\csrss.exe\", \"C:\\513f912a0bcac845f169\\csrss.exe\", \"C:\\513f912a0bcac845f169\\smss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\spoolsv.exe\", \"C:\\Users\\Admin\\Templates\\dllhost.exe\", \"C:\\513f912a0bcac845f169\\explorer.exe\", \"C:\\439b749fc5b925b896b5d131\\dllhost.exe\", \"C:\\513f912a0bcac845f169\\System.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Idle.exe\", \"C:\\513f912a0bcac845f169\\RuntimeBroker.exe\", \"C:\\Windows\\Speech_OneCore\\Engines\\Lexicon\\es-ES\\EB71BD542C88DEE476937C64F685729E.exe\", \"C:\\Users\\Admin\\dwm.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\SendTo\\csrss.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\SendTo\\csrss.exe\", \"C:\\513f912a0bcac845f169\\csrss.exe\", \"C:\\513f912a0bcac845f169\\smss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\spoolsv.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\SendTo\\csrss.exe\", \"C:\\513f912a0bcac845f169\\csrss.exe\", \"C:\\513f912a0bcac845f169\\smss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\spoolsv.exe\", \"C:\\Users\\Admin\\Templates\\dllhost.exe\", \"C:\\513f912a0bcac845f169\\explorer.exe\", \"C:\\439b749fc5b925b896b5d131\\dllhost.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\SendTo\\csrss.exe\", \"C:\\513f912a0bcac845f169\\csrss.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\SendTo\\csrss.exe\", \"C:\\513f912a0bcac845f169\\csrss.exe\", \"C:\\513f912a0bcac845f169\\smss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\spoolsv.exe\", \"C:\\Users\\Admin\\Templates\\dllhost.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\SendTo\\csrss.exe\", \"C:\\513f912a0bcac845f169\\csrss.exe\", \"C:\\513f912a0bcac845f169\\smss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\spoolsv.exe\", \"C:\\Users\\Admin\\Templates\\dllhost.exe\", \"C:\\513f912a0bcac845f169\\explorer.exe\", \"C:\\439b749fc5b925b896b5d131\\dllhost.exe\", \"C:\\513f912a0bcac845f169\\System.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Idle.exe\", \"C:\\513f912a0bcac845f169\\RuntimeBroker.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\SendTo\\csrss.exe\", \"C:\\513f912a0bcac845f169\\csrss.exe\", \"C:\\513f912a0bcac845f169\\smss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\spoolsv.exe\", \"C:\\Users\\Admin\\Templates\\dllhost.exe\", \"C:\\513f912a0bcac845f169\\explorer.exe\", \"C:\\439b749fc5b925b896b5d131\\dllhost.exe\", \"C:\\513f912a0bcac845f169\\System.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Idle.exe\", \"C:\\513f912a0bcac845f169\\RuntimeBroker.exe\", \"C:\\Windows\\Speech_OneCore\\Engines\\Lexicon\\es-ES\\EB71BD542C88DEE476937C64F685729E.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\SendTo\\csrss.exe\", \"C:\\513f912a0bcac845f169\\csrss.exe\", \"C:\\513f912a0bcac845f169\\smss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\spoolsv.exe\", \"C:\\Users\\Admin\\Templates\\dllhost.exe\", \"C:\\513f912a0bcac845f169\\explorer.exe\", \"C:\\439b749fc5b925b896b5d131\\dllhost.exe\", \"C:\\513f912a0bcac845f169\\System.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Idle.exe\", \"C:\\513f912a0bcac845f169\\RuntimeBroker.exe\", \"C:\\Windows\\Speech_OneCore\\Engines\\Lexicon\\es-ES\\EB71BD542C88DEE476937C64F685729E.exe\", \"C:\\Users\\Admin\\dwm.exe\", \"C:\\Users\\Public\\AccountPictures\\Registry.exe\", \"C:\\439b749fc5b925b896b5d131\\sppsvc.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\SendTo\\csrss.exe\", \"C:\\513f912a0bcac845f169\\csrss.exe\", \"C:\\513f912a0bcac845f169\\smss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\spoolsv.exe\", \"C:\\Users\\Admin\\Templates\\dllhost.exe\", \"C:\\513f912a0bcac845f169\\explorer.exe\", \"C:\\439b749fc5b925b896b5d131\\dllhost.exe\", \"C:\\513f912a0bcac845f169\\System.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Idle.exe\", \"C:\\513f912a0bcac845f169\\RuntimeBroker.exe\", \"C:\\Windows\\Speech_OneCore\\Engines\\Lexicon\\es-ES\\EB71BD542C88DEE476937C64F685729E.exe\", \"C:\\Users\\Admin\\dwm.exe\", \"C:\\Users\\Public\\AccountPictures\\Registry.exe\", \"C:\\439b749fc5b925b896b5d131\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\SendTo\\csrss.exe\", \"C:\\513f912a0bcac845f169\\csrss.exe\", \"C:\\513f912a0bcac845f169\\smss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\spoolsv.exe\", \"C:\\Users\\Admin\\Templates\\dllhost.exe\", \"C:\\513f912a0bcac845f169\\explorer.exe\", \"C:\\439b749fc5b925b896b5d131\\dllhost.exe\", \"C:\\513f912a0bcac845f169\\System.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Idle.exe\", \"C:\\513f912a0bcac845f169\\RuntimeBroker.exe\", \"C:\\Windows\\Speech_OneCore\\Engines\\Lexicon\\es-ES\\EB71BD542C88DEE476937C64F685729E.exe\", \"C:\\Users\\Admin\\dwm.exe\", \"C:\\Users\\Public\\AccountPictures\\Registry.exe\", \"C:\\439b749fc5b925b896b5d131\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\services.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\SendTo\\csrss.exe\", \"C:\\513f912a0bcac845f169\\csrss.exe\", \"C:\\513f912a0bcac845f169\\smss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\spoolsv.exe\", \"C:\\Users\\Admin\\Templates\\dllhost.exe\", \"C:\\513f912a0bcac845f169\\explorer.exe\", \"C:\\439b749fc5b925b896b5d131\\dllhost.exe\", \"C:\\513f912a0bcac845f169\\System.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\SendTo\\csrss.exe\", \"C:\\513f912a0bcac845f169\\csrss.exe\", \"C:\\513f912a0bcac845f169\\smss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\spoolsv.exe\", \"C:\\Users\\Admin\\Templates\\dllhost.exe\", \"C:\\513f912a0bcac845f169\\explorer.exe\", \"C:\\439b749fc5b925b896b5d131\\dllhost.exe\", \"C:\\513f912a0bcac845f169\\System.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Idle.exe\""	EB71BD542C88DEE476937C64F685729E.exe

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4184	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4068	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4108	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4872	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3484	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	736	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3376	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5064	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4520	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3908	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1168	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1452	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3896	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	112	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	872	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4848	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4364	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	64	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4752	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1480	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1568	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4540	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4524	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4232	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4708	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3448	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1540	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	636	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	384	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1168	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	64	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3812	728	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4708	728	schtasks.exe	86

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	EB71BD542C88DEE476937C64F685729E.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	EB71BD542C88DEE476937C64F685729E.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	EB71BD542C88DEE476937C64F685729E.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/3240-0-0x0000000000030000-0x000000000039A000-memory.dmp	dcrat
behavioral1/files/0x00080000000240e8-47.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2866795425-63786011-2927312124-1000\Control Panel\International\Geo\Nation	EB71BD542C88DEE476937C64F685729E.exe

Executes dropped EXE 17 IoCs

pid	Process
1436	csrss.exe
1876	csrss.exe
4384	smss.exe
3056	spoolsv.exe
2228	dllhost.exe
1156	explorer.exe
4164	EB71BD542C88DEE476937C64F685729E.exe
2640	RuntimeBroker.exe
4016	dllhost.exe
4728	System.exe
1184	Idle.exe
3128	dwm.exe
3544	Registry.exe
1308	sppsvc.exe
116	smss.exe
4184	services.exe
5248	dllhost.exe

Adds Run key to start application 2 TTPs 32 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2866795425-63786011-2927312124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Microsoft.NET\\services.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Microsoft.NET\\services.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Admin\\SendTo\\csrss.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2866795425-63786011-2927312124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\513f912a0bcac845f169\\csrss.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2866795425-63786011-2927312124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\513f912a0bcac845f169\\explorer.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2866795425-63786011-2927312124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\513f912a0bcac845f169\\RuntimeBroker.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2866795425-63786011-2927312124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\Public\\AccountPictures\\Registry.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2866795425-63786011-2927312124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\439b749fc5b925b896b5d131\\sppsvc.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\439b749fc5b925b896b5d131\\sppsvc.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2866795425-63786011-2927312124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Admin\\SendTo\\csrss.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\513f912a0bcac845f169\\csrss.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2866795425-63786011-2927312124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\spoolsv.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\Public\\AccountPictures\\Registry.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2866795425-63786011-2927312124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\439b749fc5b925b896b5d131\\dllhost.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\439b749fc5b925b896b5d131\\dllhost.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2866795425-63786011-2927312124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\513f912a0bcac845f169\\System.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Admin\\dwm.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Recovery\\WindowsRE\\smss.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2866795425-63786011-2927312124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\513f912a0bcac845f169\\smss.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\513f912a0bcac845f169\\System.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2866795425-63786011-2927312124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Idle.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Idle.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\513f912a0bcac845f169\\smss.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\spoolsv.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Admin\\Templates\\dllhost.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\513f912a0bcac845f169\\explorer.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\513f912a0bcac845f169\\RuntimeBroker.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2866795425-63786011-2927312124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EB71BD542C88DEE476937C64F685729E = "\"C:\\Windows\\Speech_OneCore\\Engines\\Lexicon\\es-ES\\EB71BD542C88DEE476937C64F685729E.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EB71BD542C88DEE476937C64F685729E = "\"C:\\Windows\\Speech_OneCore\\Engines\\Lexicon\\es-ES\\EB71BD542C88DEE476937C64F685729E.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2866795425-63786011-2927312124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Admin\\dwm.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2866795425-63786011-2927312124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Recovery\\WindowsRE\\smss.exe\""	EB71BD542C88DEE476937C64F685729E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2866795425-63786011-2927312124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Admin\\Templates\\dllhost.exe\""	EB71BD542C88DEE476937C64F685729E.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	EB71BD542C88DEE476937C64F685729E.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	EB71BD542C88DEE476937C64F685729E.exe

SmartAssembly .NET packer 9 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral1/memory/3240-8-0x000000001B000000-0x000000001B010000-memory.dmp	SmartAssembly
behavioral1/memory/3240-15-0x000000001C740000-0x000000001C74A000-memory.dmp	SmartAssembly
behavioral1/memory/3240-24-0x000000001C970000-0x000000001C97C000-memory.dmp	SmartAssembly
behavioral1/memory/3240-23-0x000000001C960000-0x000000001C96C000-memory.dmp	SmartAssembly
behavioral1/memory/3240-27-0x000000001C9A0000-0x000000001C9AC000-memory.dmp	SmartAssembly
behavioral1/memory/3240-29-0x000000001CAC0000-0x000000001CACC000-memory.dmp	SmartAssembly
behavioral1/memory/3240-30-0x000000001CAD0000-0x000000001CADA000-memory.dmp	SmartAssembly
behavioral1/memory/3240-35-0x000000001CC20000-0x000000001CC2C000-memory.dmp	SmartAssembly
behavioral1/memory/3240-37-0x000000001CC40000-0x000000001CC4A000-memory.dmp	SmartAssembly

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft.NET\c5b4cb5e9653cc	EB71BD542C88DEE476937C64F685729E.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\spoolsv.exe	EB71BD542C88DEE476937C64F685729E.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\f3b6ecef712a24	EB71BD542C88DEE476937C64F685729E.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Idle.exe	EB71BD542C88DEE476937C64F685729E.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\6ccacd8608530f	EB71BD542C88DEE476937C64F685729E.exe
File created	C:\Program Files\Windows Media Player\Icons\Idle.exe	EB71BD542C88DEE476937C64F685729E.exe
File created	C:\Program Files (x86)\Microsoft.NET\services.exe	EB71BD542C88DEE476937C64F685729E.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\ServiceState\System.exe	EB71BD542C88DEE476937C64F685729E.exe
File created	C:\Windows\Speech_OneCore\Engines\Lexicon\es-ES\EB71BD542C88DEE476937C64F685729E.exe	EB71BD542C88DEE476937C64F685729E.exe
File created	C:\Windows\Speech_OneCore\Engines\Lexicon\es-ES\e69cff7a7efdf5	EB71BD542C88DEE476937C64F685729E.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2866795425-63786011-2927312124-1000_Classes\Local Settings	EB71BD542C88DEE476937C64F685729E.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1848	schtasks.exe
872	schtasks.exe
64	schtasks.exe
1308	schtasks.exe
3812	schtasks.exe
3484	schtasks.exe
3376	schtasks.exe
112	schtasks.exe
4364	schtasks.exe
1480	schtasks.exe
4540	schtasks.exe
1084	schtasks.exe
4068	schtasks.exe
4872	schtasks.exe
1872	schtasks.exe
2588	schtasks.exe
1540	schtasks.exe
1168	schtasks.exe
1452	schtasks.exe
2272	schtasks.exe
2788	schtasks.exe
4232	schtasks.exe
4708	schtasks.exe
1568	schtasks.exe
736	schtasks.exe
1168	schtasks.exe
3896	schtasks.exe
2816	schtasks.exe
384	schtasks.exe
5064	schtasks.exe
3908	schtasks.exe
4764	schtasks.exe
1476	schtasks.exe
3448	schtasks.exe
636	schtasks.exe
4520	schtasks.exe
4848	schtasks.exe
1560	schtasks.exe
2668	schtasks.exe
64	schtasks.exe
4108	schtasks.exe
952	schtasks.exe
4752	schtasks.exe
4524	schtasks.exe
4596	schtasks.exe
1792	schtasks.exe
4708	schtasks.exe
4184	schtasks.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe
3240	EB71BD542C88DEE476937C64F685729E.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	3240	EB71BD542C88DEE476937C64F685729E.exe
Token: SeDebugPrivilege	1436	csrss.exe
Token: SeDebugPrivilege	1876	csrss.exe
Token: SeDebugPrivilege	4384	smss.exe
Token: SeDebugPrivilege	3056	spoolsv.exe
Token: SeDebugPrivilege	2228	dllhost.exe
Token: SeDebugPrivilege	1156	explorer.exe
Token: SeDebugPrivilege	4164	EB71BD542C88DEE476937C64F685729E.exe
Token: SeDebugPrivilege	2640	RuntimeBroker.exe
Token: SeDebugPrivilege	4016	dllhost.exe
Token: SeDebugPrivilege	1184	Idle.exe
Token: SeDebugPrivilege	4728	System.exe
Token: SeDebugPrivilege	3544	Registry.exe
Token: SeDebugPrivilege	3128	dwm.exe
Token: SeDebugPrivilege	1308	sppsvc.exe
Token: SeDebugPrivilege	116	smss.exe
Token: SeDebugPrivilege	4184	services.exe
Token: SeDebugPrivilege	5248	dllhost.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 1436	4192	cmd.exe	95
PID 4192 wrote to memory of 1436	4192	cmd.exe	95
PID 800 wrote to memory of 1876	800	cmd.exe	108
PID 800 wrote to memory of 1876	800	cmd.exe	108
PID 3032 wrote to memory of 4384	3032	cmd.exe	110
PID 3032 wrote to memory of 4384	3032	cmd.exe	110
PID 4360 wrote to memory of 3056	4360	cmd.exe	115
PID 4360 wrote to memory of 3056	4360	cmd.exe	115
PID 4780 wrote to memory of 2228	4780	cmd.exe	142
PID 4780 wrote to memory of 2228	4780	cmd.exe	142
PID 4024 wrote to memory of 1156	4024	cmd.exe	149
PID 4024 wrote to memory of 1156	4024	cmd.exe	149
PID 2172 wrote to memory of 4164	2172	cmd.exe	162
PID 2172 wrote to memory of 4164	2172	cmd.exe	162
PID 4588 wrote to memory of 2640	4588	cmd.exe	164
PID 4588 wrote to memory of 2640	4588	cmd.exe	164
PID 336 wrote to memory of 4016	336	cmd.exe	171
PID 336 wrote to memory of 4016	336	cmd.exe	171
PID 4956 wrote to memory of 4728	4956	cmd.exe	173
PID 4956 wrote to memory of 4728	4956	cmd.exe	173
PID 2852 wrote to memory of 1184	2852	cmd.exe	174
PID 2852 wrote to memory of 1184	2852	cmd.exe	174
PID 2416 wrote to memory of 3128	2416	cmd.exe	175
PID 2416 wrote to memory of 3128	2416	cmd.exe	175
PID 3180 wrote to memory of 3544	3180	cmd.exe	176
PID 3180 wrote to memory of 3544	3180	cmd.exe	176
PID 3240 wrote to memory of 1924	3240	EB71BD542C88DEE476937C64F685729E.exe	180
PID 3240 wrote to memory of 1924	3240	EB71BD542C88DEE476937C64F685729E.exe	180
PID 3656 wrote to memory of 1308	3656	cmd.exe	181
PID 3656 wrote to memory of 1308	3656	cmd.exe	181
PID 5016 wrote to memory of 116	5016	cmd.exe	182
PID 5016 wrote to memory of 116	5016	cmd.exe	182
PID 3440 wrote to memory of 4184	3440	cmd.exe	184
PID 3440 wrote to memory of 4184	3440	cmd.exe	184
PID 1924 wrote to memory of 2196	1924	cmd.exe	185
PID 1924 wrote to memory of 2196	1924	cmd.exe	185
PID 1924 wrote to memory of 5248	1924	cmd.exe	191
PID 1924 wrote to memory of 5248	1924	cmd.exe	191

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	EB71BD542C88DEE476937C64F685729E.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	EB71BD542C88DEE476937C64F685729E.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	EB71BD542C88DEE476937C64F685729E.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\EB71BD542C88DEE476937C64F685729E.exe
"C:\Users\Admin\AppData\Local\Temp\EB71BD542C88DEE476937C64F685729E.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3240
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7TzXZIZif2.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2196
- - C:\Users\Admin\Templates\dllhost.exe
    "C:\Users\Admin\Templates\dllhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\SendTo\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\SendTo\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\SendTo\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\SendTo\csrss.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Users\Admin\SendTo\csrss.exe
  C:\Users\Admin\SendTo\csrss.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\513f912a0bcac845f169\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\513f912a0bcac845f169\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\513f912a0bcac845f169\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\513f912a0bcac845f169\csrss.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:800
- C:\513f912a0bcac845f169\csrss.exe
  C:\513f912a0bcac845f169\csrss.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\513f912a0bcac845f169\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\513f912a0bcac845f169\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\513f912a0bcac845f169\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\513f912a0bcac845f169\smss.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\513f912a0bcac845f169\smss.exe
  C:\513f912a0bcac845f169\smss.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1848

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Windows Multimedia Platform\spoolsv.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Program Files (x86)\Windows Multimedia Platform\spoolsv.exe
  "C:\Program Files (x86)\Windows Multimedia Platform\spoolsv.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Templates\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\Templates\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Templates\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Templates\dllhost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Users\Admin\Templates\dllhost.exe
  C:\Users\Admin\Templates\dllhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\513f912a0bcac845f169\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\513f912a0bcac845f169\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\513f912a0bcac845f169\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4848

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\513f912a0bcac845f169\explorer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4024
- C:\513f912a0bcac845f169\explorer.exe
  C:\513f912a0bcac845f169\explorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\439b749fc5b925b896b5d131\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\439b749fc5b925b896b5d131\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\439b749fc5b925b896b5d131\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\439b749fc5b925b896b5d131\dllhost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:336
- C:\439b749fc5b925b896b5d131\dllhost.exe
  C:\439b749fc5b925b896b5d131\dllhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\513f912a0bcac845f169\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\513f912a0bcac845f169\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\513f912a0bcac845f169\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1476

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\513f912a0bcac845f169\System.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4956
- C:\513f912a0bcac845f169\System.exe
  C:\513f912a0bcac845f169\System.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Idle.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Idle.exe
  "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Idle.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\513f912a0bcac845f169\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\513f912a0bcac845f169\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:64

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\513f912a0bcac845f169\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\513f912a0bcac845f169\RuntimeBroker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4588
- C:\513f912a0bcac845f169\RuntimeBroker.exe
  C:\513f912a0bcac845f169\RuntimeBroker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "EB71BD542C88DEE476937C64F685729EE" /sc MINUTE /mo 14 /tr "'C:\Windows\Speech_OneCore\Engines\Lexicon\es-ES\EB71BD542C88DEE476937C64F685729E.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "EB71BD542C88DEE476937C64F685729E" /sc ONLOGON /tr "'C:\Windows\Speech_OneCore\Engines\Lexicon\es-ES\EB71BD542C88DEE476937C64F685729E.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "EB71BD542C88DEE476937C64F685729EE" /sc MINUTE /mo 13 /tr "'C:\Windows\Speech_OneCore\Engines\Lexicon\es-ES\EB71BD542C88DEE476937C64F685729E.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1308

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\Speech_OneCore\Engines\Lexicon\es-ES\EB71BD542C88DEE476937C64F685729E.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\Speech_OneCore\Engines\Lexicon\es-ES\EB71BD542C88DEE476937C64F685729E.exe
  C:\Windows\Speech_OneCore\Engines\Lexicon\es-ES\EB71BD542C88DEE476937C64F685729E.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Admin\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\dwm.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Users\Admin\dwm.exe
  C:\Users\Admin\dwm.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Users\Public\AccountPictures\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Users\Public\AccountPictures\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Public\AccountPictures\Registry.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Users\Public\AccountPictures\Registry.exe
  C:\Users\Public\AccountPictures\Registry.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\439b749fc5b925b896b5d131\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\439b749fc5b925b896b5d131\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\439b749fc5b925b896b5d131\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\439b749fc5b925b896b5d131\sppsvc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3656
- C:\439b749fc5b925b896b5d131\sppsvc.exe
  C:\439b749fc5b925b896b5d131\sppsvc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Recovery\WindowsRE\smss.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Recovery\WindowsRE\smss.exe
  C:\Recovery\WindowsRE\smss.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:64

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft.NET\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft.NET\services.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Program Files (x86)\Microsoft.NET\services.exe
  "C:\Program Files (x86)\Microsoft.NET\services.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EB71BD542C88DEE476937C64F685729E.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\EB71BD542C88DEE476937C64F685729E.exe.log
Size 1KB
SHA256 2b1ffeab025cc7c61c50e3e2e4c9253046d9174cf00181a8c1de733a4c0daa14
MD5 655010c15ea0ca05a6e5ddcd84986b98
SHA1 120bf7e516aeed462c07625fbfcdab5124ad05d3
SHA512 e52c26718d7d1e979837b5ac626dde26920fe7413b8aa7be6f1be566a1b0f035582f4d313400e3ad6b92552abb1dfaf186b60b875fb955a2a94fd839fe841437
MD5 SHA1 SHA512

Submit Download

csrss.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
MD5 SHA1 SHA512

Submit Download

7TzXZIZif2.bat

Path C:\Users\Admin\AppData\Local\Temp\7TzXZIZif2.bat
Size 201B
SHA256 dcbc3e1d010e5e2b8ee4d75c2ede39e0a0c1fa1ceea2e72adad481f5469cab59
MD5 b2af0cb43286999470966f87e65d1331
SHA1 b4f1f2df3c2e7a43464fd0aa868739e207e63040
SHA512 f0143143240cbaf98fae2c9ea608fccce3c4dd0efc7552ce67f4e7a023ef3c981c6e523a6fb3c178b30e8a92da62fc7753b86df59bc982ee3adcccb1b5082879
MD5 SHA1 SHA512

Submit Download

csrss.exe

Path C:\Users\Admin\SendTo\csrss.exe
Size 3.4MB
SHA256 e7cf9ae73751f92a53dbbc41b4939510e23352bf3a942e86b269c72b80cdb63c
MD5 eb71bd542c88dee476937c64f685729e
SHA1 9c5264de5006a051cf949d749173211af5f71086
SHA512 1b58ae7989d54093eccd0b06e07440b6e0769ed85aa149f12796bbc0a29553eebd70f764edd9d3ad40e0e592100d0887f565c8fddd072729a51b003821c6330e
SSDEEP 49152:mSWEezum6cP6UWecaJtx1Y2QUoB70+xfiXkRSMxUoMK4U7gqo:PWim6cC5eBxCB5Bxfg0dmo3M
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3240-22-0x000000001CE90000-0x000000001D3B8000-memory.dmp

Download

memory/3240-18-0x000000001C900000-0x000000001C908000-memory.dmp

Download

memory/3240-6-0x000000001C750000-0x000000001C7A0000-memory.dmp

Download

memory/3240-7-0x00000000024E0000-0x00000000024E8000-memory.dmp

Download

memory/3240-8-0x000000001B000000-0x000000001B010000-memory.dmp

Download

memory/3240-9-0x000000001B010000-0x000000001B026000-memory.dmp

Download

memory/3240-10-0x000000001B030000-0x000000001B038000-memory.dmp

Download

memory/3240-11-0x000000001C700000-0x000000001C712000-memory.dmp

Download

memory/3240-12-0x000000001C730000-0x000000001C73C000-memory.dmp

Download

memory/3240-13-0x000000001C710000-0x000000001C718000-memory.dmp

Download

memory/3240-14-0x000000001C720000-0x000000001C730000-memory.dmp

Download

memory/3240-15-0x000000001C740000-0x000000001C74A000-memory.dmp

Download

memory/3240-16-0x000000001C8A0000-0x000000001C8F6000-memory.dmp

Download

memory/3240-17-0x000000001C8F0000-0x000000001C8FC000-memory.dmp

Download

memory/3240-24-0x000000001C970000-0x000000001C97C000-memory.dmp

Download

memory/3240-19-0x000000001C910000-0x000000001C91C000-memory.dmp

Download

memory/3240-21-0x000000001C930000-0x000000001C942000-memory.dmp

Download

memory/3240-20-0x000000001C920000-0x000000001C928000-memory.dmp

Download

memory/3240-5-0x000000001AFE0000-0x000000001AFFC000-memory.dmp

Download

memory/3240-0-0x0000000000030000-0x000000000039A000-memory.dmp

Download

memory/3240-28-0x000000001CAB0000-0x000000001CAB8000-memory.dmp

Download

memory/3240-25-0x000000001C980000-0x000000001C988000-memory.dmp

Download

memory/3240-26-0x000000001C990000-0x000000001C99C000-memory.dmp

Download

memory/3240-27-0x000000001C9A0000-0x000000001C9AC000-memory.dmp

Download

memory/3240-29-0x000000001CAC0000-0x000000001CACC000-memory.dmp

Download

memory/3240-23-0x000000001C960000-0x000000001C96C000-memory.dmp

Download

memory/3240-31-0x000000001CBE0000-0x000000001CBEE000-memory.dmp

Download

memory/3240-32-0x000000001CBF0000-0x000000001CBF8000-memory.dmp

Download

memory/3240-30-0x000000001CAD0000-0x000000001CADA000-memory.dmp

Download

memory/3240-33-0x000000001CC00000-0x000000001CC0E000-memory.dmp

Download

memory/3240-35-0x000000001CC20000-0x000000001CC2C000-memory.dmp

Download

memory/3240-34-0x000000001CC10000-0x000000001CC18000-memory.dmp

Download

memory/3240-37-0x000000001CC40000-0x000000001CC4A000-memory.dmp

Download

memory/3240-36-0x000000001CC30000-0x000000001CC38000-memory.dmp

Download

memory/3240-38-0x000000001CC50000-0x000000001CC5C000-memory.dmp

Download

memory/3240-4-0x00000000024D0000-0x00000000024D8000-memory.dmp

Download

memory/3240-125-0x00007FFF55DA0000-0x00007FFF56069000-memory.dmp

Download

memory/3240-3-0x0000000002420000-0x000000000242E000-memory.dmp

Download

memory/3240-2-0x0000000002410000-0x000000000241E000-memory.dmp

Download

memory/3240-1-0x00007FFF55DA0000-0x00007FFF56069000-memory.dmp

Download