dcrat | 1781b1794d8a0afaa8c2b177466f9592ac973069a357f0d44aaedc8be12a5faf

Analysis

max time kernel
138s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/04/2026, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.7MB
Sample260419-3ay8macv5p
SHA256 1781b1794d8a0afaa8c2b177466f9592ac973069a357f0d44aaedc8be12a5faf
MD5 8ac324c0727610ce793d11cefe1fb2da
SHA1 9d6ec4193112dc80b446071eec62de240c494dee
SHA512 73bb57c223f139f91ef2c056afbbaa5740a377da4e496d3494248aa539e621a98996908e52956ca79a700603a327978d43db338fc7d4588e9ea64f733793a5a6
SSDEEP 49152:ckQTAEIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3sc9:caMuRD9JdOR4m+lmY/4rx8c9
TLSH
T1AB8523197181D333C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat trojan

Malware Config

Signatures

Family: DcRat 59 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		3104	schtasks.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\ee2ad38f3d4382		2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
		4496	schtasks.exe
		4188	schtasks.exe
		5564	schtasks.exe
		776	schtasks.exe
		3020	schtasks.exe
		3092	schtasks.exe
		4224	schtasks.exe
		4932	schtasks.exe
		1160	schtasks.exe
		4592	schtasks.exe
		1664	schtasks.exe
		4592	schtasks.exe
		1524	schtasks.exe
		4416	schtasks.exe
		2828	schtasks.exe
		4116	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
		4420	schtasks.exe
		3156	schtasks.exe
		5356	schtasks.exe
		3724	schtasks.exe
		3056	schtasks.exe
		2128	schtasks.exe
		5060	schtasks.exe
		1544	schtasks.exe
		6084	schtasks.exe
		3664	schtasks.exe
		4584	schtasks.exe
		1996	schtasks.exe
		1360	schtasks.exe
		1468	schtasks.exe
		3536	schtasks.exe
		2884	schtasks.exe
		1484	schtasks.exe
		2208	schtasks.exe
		4568	schtasks.exe
		660	schtasks.exe
		3912	schtasks.exe
		1892	schtasks.exe
		5856	schtasks.exe
		2564	schtasks.exe
		3324	schtasks.exe
		4956	schtasks.exe
		2568	schtasks.exe
		1508	schtasks.exe
		3716	schtasks.exe
		464	schtasks.exe
		3724	schtasks.exe
		3456	schtasks.exe
		3104	schtasks.exe
		1996	schtasks.exe
		2136	schtasks.exe
		3468	schtasks.exe
		4284	schtasks.exe
		2144	schtasks.exe
		5772	schtasks.exe
		3092	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\Registry.exe\""	2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\Registry.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\spoolsv.exe\""	2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4568	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3716	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4224	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3324	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3468	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1524	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4592	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3456	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4584	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3156	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4416	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4116	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	776	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3664	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3724	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3104	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4420	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4956	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4284	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3092	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1468	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	660	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4188	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3912	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	464	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3536	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4592	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3104	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3092	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3724	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6084	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5356	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5772	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5564	4172	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5856	4172	schtasks.exe	80

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Custom signature

Detects executables packed with SmartAssembly 5 IoCs

resource	yara_rule
behavioral2/memory/2204-5234-0x0000000006290000-0x00000000062A0000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/2204-5238-0x0000000006880000-0x000000000688A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/2204-5243-0x0000000006960000-0x000000000696C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/2204-5246-0x0000000007280000-0x000000000728C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/2204-5244-0x0000000006990000-0x000000000699A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
14600	powershell.exe
7276	powershell.exe
11124	powershell.exe
1816	powershell.exe
10136	powershell.exe
9036	powershell.exe
8020	powershell.exe
6836	powershell.exe
14664	powershell.exe
14632	powershell.exe
2152	powershell.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\Registry.exe\""	2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\spoolsv.exe\""	2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\spoolsv.exe\""	2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\Registry.exe\""	2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

SmartAssembly .NET packer 5 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/2204-5234-0x0000000006290000-0x00000000062A0000-memory.dmp	SmartAssembly
behavioral2/memory/2204-5238-0x0000000006880000-0x000000000688A000-memory.dmp	SmartAssembly
behavioral2/memory/2204-5243-0x0000000006960000-0x000000000696C000-memory.dmp	SmartAssembly
behavioral2/memory/2204-5246-0x0000000007280000-0x000000000728C000-memory.dmp	SmartAssembly
behavioral2/memory/2204-5244-0x0000000006990000-0x000000000699A000-memory.dmp	SmartAssembly

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe	2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\ee2ad38f3d4382	2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\spoolsv.exe	2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\f3b6ecef712a24	2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files\Uninstall Information\SppExtComObj.exe	2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files\Uninstall Information\e1ef82546f0b02	2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe	2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2884	schtasks.exe
3324	schtasks.exe
1664	schtasks.exe
4496	schtasks.exe
660	schtasks.exe
1996	schtasks.exe
4416	schtasks.exe
2128	schtasks.exe
4592	schtasks.exe
2136	schtasks.exe
5856	schtasks.exe
1996	schtasks.exe
2828	schtasks.exe
2564	schtasks.exe
4188	schtasks.exe
1892	schtasks.exe
3724	schtasks.exe
6084	schtasks.exe
3912	schtasks.exe
4584	schtasks.exe
5564	schtasks.exe
1360	schtasks.exe
3724	schtasks.exe
2144	schtasks.exe
5356	schtasks.exe
3056	schtasks.exe
3664	schtasks.exe
464	schtasks.exe
3104	schtasks.exe
1484	schtasks.exe
3020	schtasks.exe
4956	schtasks.exe
3092	schtasks.exe
4568	schtasks.exe
2568	schtasks.exe
4116	schtasks.exe
1468	schtasks.exe
5060	schtasks.exe
1508	schtasks.exe
4420	schtasks.exe
1544	schtasks.exe
776	schtasks.exe
3716	schtasks.exe
4224	schtasks.exe
3468	schtasks.exe
1524	schtasks.exe
2208	schtasks.exe
3156	schtasks.exe
3092	schtasks.exe
4592	schtasks.exe
4284	schtasks.exe
3536	schtasks.exe
3104	schtasks.exe
5772	schtasks.exe
1160	schtasks.exe
3456	schtasks.exe
4932	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2204	2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2204	2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2204	2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2204	2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-19_8ac324c0727610ce793d11cefe1fb2da_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Family: DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2204
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6836
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8020
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9036
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2152
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:10136
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1816
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:11124
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7276
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:14600
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:14632
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:14664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\spoolsv.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Uninstall Information\SppExtComObj.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Uninstall Information\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\lsass.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Admin\lsass.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\lsass.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office\fontdrvhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Windows\Media\Festival\smss.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Media\Festival\smss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\Media\Festival\smss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\Idle.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Idle.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Reference Assemblies\Idle.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\uk-UA\sppsvc.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\uk-UA\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\uk-UA\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\dllhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\es-ES\StartMenuExperienceHost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\es-ES\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\es-ES\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\explorer.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3536

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\spoolsv.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\spoolsv.exe"
1⤵
PID:3672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\explorer.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\explorer.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Videos\smss.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Public\Videos\smss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Videos\smss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office 15\lsass.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1892

C:\Program Files\Uninstall Information\RuntimeBroker.exe
"C:\Program Files\Uninstall Information\RuntimeBroker.exe"
1⤵
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\lsass.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office 15\lsass.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\smss.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\smss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6084

C:\Recovery\WindowsRE\fontdrvhost.exe
"C:\Recovery\WindowsRE\fontdrvhost.exe"
1⤵
PID:5200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\smss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5356

C:\Program Files (x86)\Reference Assemblies\Idle.exe
"C:\Program Files (x86)\Reference Assemblies\Idle.exe"
1⤵
PID:6016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\OfficeClickToRun.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5772

C:\Program Files\Windows Media Player\es-ES\StartMenuExperienceHost.exe
"C:\Program Files\Windows Media Player\es-ES\StartMenuExperienceHost.exe"
1⤵
PID:5872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5856

C:\Users\Public\Videos\smss.exe
"C:\Users\Public\Videos\smss.exe"
1⤵
PID:6008

C:\Program Files (x86)\Internet Explorer\uk-UA\sppsvc.exe
"C:\Program Files (x86)\Internet Explorer\uk-UA\sppsvc.exe"
1⤵
PID:6420

C:\Program Files\Microsoft Office\fontdrvhost.exe
"C:\Program Files\Microsoft Office\fontdrvhost.exe"
1⤵
PID:6948

C:\Windows\Media\Festival\smss.exe
"C:\Windows\Media\Festival\smss.exe"
1⤵
PID:5256

C:\Recovery\WindowsRE\smss.exe
"C:\Recovery\WindowsRE\smss.exe"
1⤵
PID:6216

C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\Registry.exe"
1⤵
PID:5504

C:\Program Files\Uninstall Information\SppExtComObj.exe
"C:\Program Files\Uninstall Information\SppExtComObj.exe"
1⤵
PID:11240

C:\Users\Admin\lsass.exe
"C:\Users\Admin\lsass.exe"
1⤵
PID:11252

C:\Users\Default User\dllhost.exe
"C:\Users\Default User\dllhost.exe"
1⤵
PID:13876

C:\Recovery\WindowsRE\dllhost.exe
"C:\Recovery\WindowsRE\dllhost.exe"
1⤵
PID:5876

C:\Program Files (x86)\Windows Media Player\fr-FR\OfficeClickToRun.exe
"C:\Program Files (x86)\Windows Media Player\fr-FR\OfficeClickToRun.exe"
1⤵
PID:15276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fontdrvhost.exe

Path C:\Program Files\Microsoft Office\fontdrvhost.exe
Size 1.7MB
SHA256 1781b1794d8a0afaa8c2b177466f9592ac973069a357f0d44aaedc8be12a5faf
MD5 8ac324c0727610ce793d11cefe1fb2da
SHA1 9d6ec4193112dc80b446071eec62de240c494dee
SHA512 73bb57c223f139f91ef2c056afbbaa5740a377da4e496d3494248aa539e621a98996908e52956ca79a700603a327978d43db338fc7d4588e9ea64f733793a5a6
SSDEEP 49152:ckQTAEIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3sc9:caMuRD9JdOR4m+lmY/4rx8c9
TLSH
T1AB8523197181D333C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2204-0-0x00000000052A0000-0x00000000052B0000-memory.dmp

Download

memory/2204-1-0x0000000005540000-0x00000000057BC000-memory.dmp

Download

memory/2204-2-0x00000000052A0000-0x00000000052B0000-memory.dmp

Download

memory/2204-3-0x00000000052A0000-0x00000000052B0000-memory.dmp

Download

memory/2204-4-0x00000000057C0000-0x0000000005D66000-memory.dmp

Download

memory/2204-5-0x00000000052B0000-0x000000000552A000-memory.dmp

Download

memory/2204-15-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-13-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-11-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-9-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-7-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-6-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-21-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-19-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-29-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-37-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-45-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-57-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-72-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-65-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-73-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-91-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-89-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-87-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-85-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-83-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-81-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-79-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-77-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-75-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-69-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-105-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-107-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-103-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-121-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-119-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-117-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-115-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-113-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-111-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-109-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-101-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-99-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-97-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-95-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-93-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-67-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-63-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-61-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-59-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-55-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-53-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-51-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-49-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-47-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-43-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-41-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-39-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-35-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-31-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-34-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-27-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-25-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-24-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-17-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-125-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-123-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-127-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-131-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-129-0x00000000052B0000-0x0000000005524000-memory.dmp

Download

memory/2204-1716-0x00000000052A0000-0x00000000052B0000-memory.dmp

Download

memory/2204-2195-0x00000000052A0000-0x00000000052B0000-memory.dmp

Download

memory/2204-5230-0x00000000052A0000-0x00000000052B0000-memory.dmp

Download

memory/2204-5231-0x0000000002A60000-0x0000000002A7C000-memory.dmp

Download

memory/2204-5232-0x0000000002A90000-0x0000000002AE0000-memory.dmp

Download

memory/2204-5234-0x0000000006290000-0x00000000062A0000-memory.dmp

Download

memory/2204-5233-0x0000000002AF0000-0x0000000002AF8000-memory.dmp

Download

memory/2204-5235-0x0000000006850000-0x0000000006866000-memory.dmp

Download

memory/2204-5236-0x0000000006630000-0x0000000006638000-memory.dmp

Download

memory/2204-5237-0x00000000069B0000-0x00000000069C0000-memory.dmp

Download

memory/2204-5238-0x0000000006880000-0x000000000688A000-memory.dmp

Download

memory/2204-5239-0x00000000068B0000-0x00000000068BC000-memory.dmp

Download

memory/2204-5240-0x00000000068C0000-0x00000000068D2000-memory.dmp

Download

memory/2204-5241-0x00000000069C0000-0x0000000006EEC000-memory.dmp

Download

memory/2204-5242-0x0000000006950000-0x000000000695C000-memory.dmp

Download

memory/2204-5243-0x0000000006960000-0x000000000696C000-memory.dmp

Download

memory/2204-5246-0x0000000007280000-0x000000000728C000-memory.dmp

Download

memory/2204-5248-0x00000000072B0000-0x0000000007342000-memory.dmp

Download

memory/2204-5247-0x00000000052A0000-0x00000000052B0000-memory.dmp

Download

memory/2204-5249-0x0000000007370000-0x000000000737C000-memory.dmp

Download

memory/2204-5245-0x0000000007270000-0x0000000007278000-memory.dmp

Download

memory/2204-5244-0x0000000006990000-0x000000000699A000-memory.dmp

Download

memory/2204-5252-0x0000000007390000-0x00000000073F6000-memory.dmp

Download

memory/2204-7369-0x00000000052A0000-0x00000000052B0000-memory.dmp

Download

memory/2204-7131-0x00000000052A0000-0x00000000052B0000-memory.dmp

Download