dcrat | e75b2167147b4f63599579aace6c19e7453624423a17fff91685cf87407b0b8a

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KOTON.exe
Size 2.2MB
Sample260723-pk72macl4x
SHA256 e75b2167147b4f63599579aace6c19e7453624423a17fff91685cf87407b0b8a
MD5 910be11e662edbb98ddcaa39aa7a0d44
SHA1 43daab70edf61922ebb162d87539b5589c0dcbdc
SHA512 f9914b37044e7e3a8fdcdc046f5031ff3a58a629e4230ff0605df2e2fb4e122e4d4a590ccf44b90d120c51f4c03ce1ed03cec10328b5563098a4c1c181c801e9
SSDEEP 49152:4bA3z/sbluwkphmzJis2dpaBt1Ck9enztX65251vzz:4bgw5kpgqdMBuhzck5BX
TLSH
T118B5AE017E438911F0085333CAAFD524477CAE55E6B5EF1B79E93A6E6631B923C0C9CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat trojan

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000e00000001c545-12.dat	dcrat
behavioral2/memory/1616-14-0x00000000006C0000-0x00000000008A0000-memory.dmp	dcrat

Process spawned unexpected child process 33 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3364	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	968	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4612	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3112	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4816	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3352	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3532	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3656	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4628	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1236	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3140	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4400	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4788	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5208	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3876	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2052	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3492	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4660	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	708	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4848	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3528	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3248	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4224	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5704	2616	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	2616	schtasks.exe	93

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	agentSessionnet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	agentSessionnet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	agentSessionnet.exe

Disables Task Manager via registry modification
defense_evasion

Executes dropped EXE 13 IoCs

pid	Process
1616	agentSessionnet.exe
5400	upfc.exe
1620	WUDFHost.exe
1860	OfficeClickToRun.exe
2912	StartMenuExperienceHost.exe
1304	WmiPrvSE.exe
5136	services.exe
2360	services.exe
1376	conhost.exe
3488	csrss.exe
3156	RuntimeBroker.exe
3836	agentSessionnet.exe
3352	OfficeClickToRun.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	agentSessionnet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	agentSessionnet.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2332	WScript.exe

SmartAssembly .NET packer 4 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/1616-19-0x0000000002AB0000-0x0000000002AC0000-memory.dmp	SmartAssembly
behavioral2/memory/1616-23-0x000000001B500000-0x000000001B50A000-memory.dmp	SmartAssembly
behavioral2/memory/1616-27-0x000000001B5B0000-0x000000001B5BA000-memory.dmp	SmartAssembly
behavioral2/memory/1616-30-0x000000001BEF0000-0x000000001BEFC000-memory.dmp	SmartAssembly

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Uninstall Information\RCXB260.tmp	agentSessionnet.exe
File opened for modification	C:\Program Files\Uninstall Information\WUDFHost.exe	agentSessionnet.exe
File opened for modification	C:\Program Files (x86)\Google\Update\RCXC285.tmp	agentSessionnet.exe
File opened for modification	C:\Program Files (x86)\Google\Update\agentSessionnet.exe	agentSessionnet.exe
File created	C:\Program Files\Uninstall Information\480b7989c529f6	agentSessionnet.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\conhost.exe	agentSessionnet.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\088424020bedd6	agentSessionnet.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCXBE7C.tmp	agentSessionnet.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\conhost.exe	agentSessionnet.exe
File created	C:\Program Files\Uninstall Information\WUDFHost.exe	agentSessionnet.exe
File created	C:\Program Files (x86)\Google\Update\agentSessionnet.exe	agentSessionnet.exe
File created	C:\Program Files (x86)\Google\Update\5e9b767c02ad41	agentSessionnet.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\WaaS\services\sppsvc.exe	agentSessionnet.exe
File opened for modification	C:\Windows\Resources\Themes\aero\es-ES\RCXB465.tmp	agentSessionnet.exe
File opened for modification	C:\Windows\Resources\Themes\aero\es-ES\WmiPrvSE.exe	agentSessionnet.exe
File created	C:\Windows\diagnostics\index\lsass.exe	agentSessionnet.exe
File created	C:\Windows\Resources\Themes\aero\es-ES\WmiPrvSE.exe	agentSessionnet.exe
File created	C:\Windows\Resources\Themes\aero\es-ES\24dbde2999530e	agentSessionnet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5964	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KOTON.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	KOTON.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
5432	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4816	schtasks.exe
3352	schtasks.exe
3876	schtasks.exe
2052	schtasks.exe
708	schtasks.exe
3528	schtasks.exe
3364	schtasks.exe
4628	schtasks.exe
3492	schtasks.exe
2732	schtasks.exe
5704	schtasks.exe
2160	schtasks.exe
3140	schtasks.exe
4400	schtasks.exe
4660	schtasks.exe
3036	schtasks.exe
3112	schtasks.exe
1952	schtasks.exe
1236	schtasks.exe
3248	schtasks.exe
968	schtasks.exe
2736	schtasks.exe
5208	schtasks.exe
1780	schtasks.exe
2060	schtasks.exe
3532	schtasks.exe
3656	schtasks.exe
4848	schtasks.exe
2608	schtasks.exe
4788	schtasks.exe
4224	schtasks.exe
4764	schtasks.exe
4612	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1616	agentSessionnet.exe
1616	agentSessionnet.exe
1616	agentSessionnet.exe
1616	agentSessionnet.exe
1616	agentSessionnet.exe
1616	agentSessionnet.exe
1616	agentSessionnet.exe
1616	agentSessionnet.exe
1616	agentSessionnet.exe
1616	agentSessionnet.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	1616	agentSessionnet.exe
Token: SeDebugPrivilege	5400	upfc.exe
Token: SeDebugPrivilege	1620	WUDFHost.exe
Token: SeDebugPrivilege	1860	OfficeClickToRun.exe
Token: SeDebugPrivilege	2912	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	1304	WmiPrvSE.exe
Token: SeDebugPrivilege	5136	services.exe
Token: SeDebugPrivilege	2360	services.exe
Token: SeDebugPrivilege	1376	conhost.exe
Token: SeDebugPrivilege	3488	csrss.exe
Token: SeDebugPrivilege	3156	RuntimeBroker.exe
Token: SeDebugPrivilege	3836	agentSessionnet.exe
Token: SeDebugPrivilege	3352	OfficeClickToRun.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5496 wrote to memory of 2332	5496	KOTON.exe	89
PID 2332 wrote to memory of 5964	2332	WScript.exe	90
PID 5964 wrote to memory of 1616	5964	cmd.exe	92
PID 1616 wrote to memory of 3352	1616	agentSessionnet.exe	149
PID 5964 wrote to memory of 5432	5964	cmd.exe	150

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	agentSessionnet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	agentSessionnet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	agentSessionnet.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\KOTON.exe
"C:\Users\Admin\AppData\Local\Temp\KOTON.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5496
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\BridgeSurrogateMonitorsvc\fIlHIZkglX1kUdt8Xa.vbe"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\BridgeSurrogateMonitorsvc\2dpWBxRtSgaMG0J7d8jyl7GGR2DE.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5964
  - - C:\BridgeSurrogateMonitorsvc\agentSessionnet.exe
      "C:\BridgeSurrogateMonitorsvc\agentSessionnet.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1616
    - - C:\Windows.old\OfficeClickToRun.exe
        
        "C:\Windows.old\OfficeClickToRun.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3352
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:5432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 13 /tr "'C:\Program Files\Uninstall Information\WUDFHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 11 /tr "'C:\Program Files\Uninstall Information\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Windows\Resources\Themes\aero\es-ES\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\Resources\Themes\aero\es-ES\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Windows\Resources\Themes\aero\es-ES\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Downloads\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Public\Downloads\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Downloads\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Windows.old\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2736

C:\Recovery\WindowsRE\upfc.exe
"C:\Recovery\WindowsRE\upfc.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows.old\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Windows.old\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Application Data\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Admin\Application Data\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Application Data\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\BridgeSurrogateMonitorsvc\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4788

C:\Program Files\Uninstall Information\WUDFHost.exe
"C:\Program Files\Uninstall Information\WUDFHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1620

C:\Windows.old\OfficeClickToRun.exe
"C:\Windows.old\OfficeClickToRun.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\BridgeSurrogateMonitorsvc\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\BridgeSurrogateMonitorsvc\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3876

C:\Users\Public\Downloads\StartMenuExperienceHost.exe
"C:\Users\Public\Downloads\StartMenuExperienceHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2052

C:\Windows\Resources\Themes\aero\es-ES\WmiPrvSE.exe
"C:\Windows\Resources\Themes\aero\es-ES\WmiPrvSE.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1304

C:\Users\Admin\Application Data\services.exe
"C:\Users\Admin\Application Data\services.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3492

C:\BridgeSurrogateMonitorsvc\services.exe
"C:\BridgeSurrogateMonitorsvc\services.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4848

C:\Program Files (x86)\Mozilla Maintenance Service\logs\conhost.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\logs\conhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "agentSessionneta" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\Update\agentSessionnet.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "agentSessionnet" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\agentSessionnet.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "agentSessionneta" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Google\Update\agentSessionnet.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4764

C:\Recovery\WindowsRE\csrss.exe
"C:\Recovery\WindowsRE\csrss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3488

C:\Program Files (x86)\Google\Update\agentSessionnet.exe
"C:\Program Files (x86)\Google\Update\agentSessionnet.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3836

C:\Recovery\WindowsRE\RuntimeBroker.exe
"C:\Recovery\WindowsRE\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2dpWBxRtSgaMG0J7d8jyl7GGR2DE.bat

Path C:\BridgeSurrogateMonitorsvc\2dpWBxRtSgaMG0J7d8jyl7GGR2DE.bat
Size 162B
SHA256 b3d43858b280ea3fac9680332c0143b5d2285103a6840d562e5f1e7e5a464f13
MD5 08055ffba85ef6692139593a31b83009
SHA1 bb23b269effc2af734fac4b2d7dcf4f9971d7920
SHA512 d7bb41574929ce30cd45d4df56170216f9c1349f63a17b62e96dfb3cd1cca9f090f88713d60c79968f007741567b72ccd733c2937a7a0f9a15c47eee7538c02a
TLSH
T1C0C0802054058673D5917734694E55019B3B134E711093D5155B5019415719DC37C2D5
MD5 SHA1 SHA512 TLSH

Submit Download

agentSessionnet.exe

Path C:\BridgeSurrogateMonitorsvc\agentSessionnet.exe
Size 1.8MB
SHA256 3ccdd6525912d45e7af0ae3fb59cbbc4ad4d34b0febe98626f81f30d4a40c7c7
MD5 f7b63bb1a56641bae780958130e66e72
SHA1 43c88fa36bbe4d3d27e015f48a94caa159c645a0
SHA512 300b640d3e01150ee9411e5d90cf5a41879e2400fea66530d16cc86736039b23131af817bebf1473accd9114465e99e0eb3aa51f30d9b02cfd123819cb47596a
SSDEEP 49152:msbluwkphmzJis2dpaBt1Ck9enztX65251vz:mw5kpgqdMBuhzck5B
TLSH
T16795BE017E44CE11F0099273C2EF494847B0AA5966B6E71B7DBA337D66623A73C0D9CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fIlHIZkglX1kUdt8Xa.vbe

Path C:\BridgeSurrogateMonitorsvc\fIlHIZkglX1kUdt8Xa.vbe
Size 230B
SHA256 655edb2acc457ca13b24b73af52257fcf87d2895e3606aec5726c58b39ce4469
MD5 d9e589740dfcafae75cf15f7f33b9ef5
SHA1 f617e51cd6a85cb0815f0f61538da879da7ba8c2
SHA512 9bf7bc7f961271d0769c8a9e028df8eac035ac414ff323baf3c84a1aabc856a5497e2d7a9a63e3d7d7f964e3d187c31d4fa8d78436d7da308658dabe364b455b
TLSH
T174D023088FD7B384CD04F5D1C345C43D0D456BA80A008B80449CFB9322004BF343C31A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1616-20-0x0000000002C00000-0x0000000002C16000-memory.dmp

Download

memory/1616-23-0x000000001B500000-0x000000001B50A000-memory.dmp

Download

memory/1616-16-0x0000000002BE0000-0x0000000002BFC000-memory.dmp

Download

memory/1616-19-0x0000000002AB0000-0x0000000002AC0000-memory.dmp

Download

memory/1616-18-0x0000000002950000-0x0000000002958000-memory.dmp

Download

memory/1616-17-0x000000001B540000-0x000000001B590000-memory.dmp

Download

memory/1616-21-0x000000001B4F0000-0x000000001B502000-memory.dmp

Download

memory/1616-14-0x00000000006C0000-0x00000000008A0000-memory.dmp

Download

memory/1616-22-0x000000001B520000-0x000000001B530000-memory.dmp

Download

memory/1616-15-0x00000000012B0000-0x00000000012BE000-memory.dmp

Download

memory/1616-24-0x000000001B510000-0x000000001B522000-memory.dmp

Download

memory/1616-26-0x000000001B530000-0x000000001B53C000-memory.dmp

Download

memory/1616-25-0x000000001C420000-0x000000001C948000-memory.dmp

Download

memory/1616-29-0x000000001B5D0000-0x000000001B5DE000-memory.dmp

Download

memory/1616-28-0x000000001B5C0000-0x000000001B5CE000-memory.dmp

Download

memory/1616-27-0x000000001B5B0000-0x000000001B5BA000-memory.dmp

Download

memory/1616-30-0x000000001BEF0000-0x000000001BEFC000-memory.dmp

Download