dcrat | 281b71841c17299fe1573634db56587f03f5da7fcd4114478fe422e9154ed28c

Analysis

user interaction
yes
max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installer.exe
Size 1.0MB
Sample260802-cb62rasarc
SHA256 281b71841c17299fe1573634db56587f03f5da7fcd4114478fe422e9154ed28c
MD5 7a935d6d8c4d7e5876d135d5192495d8
SHA1 c9c4d8755e332400711c4b95a2bfc5fd2270d94a
SHA512 6ffb69c444a9324383e5e59434cbb44fc2664744b91629e4bdf217c8479446a20f99075f5f0c47e24e3932210fe1e2aaa3f5ad6e5bb454a9aa1815643312c0e6
SSDEEP 24576:k1DS7atyFXoNvUphWgEv7BBp8zvasEp7LWncyAd7c:8DojF4SDWgEjp8zvh+LWnc57c
TLSH
T19435F109E7E405F8E0B7E67889664902E77A7C4E1771E78F03B456562F232A0DE3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution dcrat infostealer persistence rat

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x001c00000001c41c-4.dat	dcrat
behavioral1/files/0x000c00000001c55e-23.dat	dcrat
behavioral1/memory/2480-27-0x0000000000400000-0x0000000000551000-memory.dmp	dcrat
behavioral1/files/0x000c00000001c560-46.dat	dcrat
behavioral1/memory/4864-48-0x0000000000AA0000-0x0000000000B76000-memory.dmp	dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	356	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	248	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3936	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4036	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2072	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3084	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3856	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6016	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5584	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1228	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3432	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5384	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6128	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5836	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5960	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3176	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3340	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1400	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3564	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4716	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	672	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3660	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4836	1192	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4212	1192	schtasks.exe	98

Executes dropped EXE 18 IoCs

pid	Process
2480	BlueStacksInstaller.exe
3600	BlueStacksInstaller.exe
4220	Optimization.exe
4864	comruntime.exe
3888	dllhost.exe
1456	explorer.exe
3536	lsass.exe
1200	fontdrvhost.exe
5392	WUDFHost.exe
2056	Registry.exe
3004	dllhost.exe
3336	lsass.exe
1372	RuntimeBroker.exe
2240	OfficeClickToRun.exe
356	wininit.exe
256	Idle.exe
4932	RuntimeBroker.exe
1008	lsass.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2144	WScript.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\5940a34987c991	comruntime.exe
File created	C:\Program Files\Windows Media Player\uk-UA\dllhost.exe	comruntime.exe
File created	C:\Program Files\Google\Chrome\Application\lsass.exe	comruntime.exe
File created	C:\Program Files\Google\Chrome\Application\6203df4a6bafc7	comruntime.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\RuntimeBroker.exe	comruntime.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\9e8d7a4ca61bd9	comruntime.exe
File created	C:\Program Files\Windows Media Player\uk-UA\5940a34987c991	comruntime.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\WUDFHost.exe	comruntime.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\480b7989c529f6	comruntime.exe
File created	C:\Program Files (x86)\Common Files\dllhost.exe	comruntime.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\IdentityCRL\INT\wininit.exe	comruntime.exe
File created	C:\Windows\WaaS\regkeys\OfficeClickToRun.exe	comruntime.exe
File created	C:\Windows\TAPI\Idle.exe	comruntime.exe
File created	C:\Windows\Migration\WTR\7a0fd90576e088	comruntime.exe
File created	C:\Windows\L2Schemas\5b884080fd4f94	comruntime.exe
File created	C:\Windows\IdentityCRL\INT\56085415360792	comruntime.exe
File created	C:\Windows\TAPI\6ccacd8608530f	comruntime.exe
File created	C:\Windows\Migration\WTR\explorer.exe	comruntime.exe
File created	C:\Windows\L2Schemas\fontdrvhost.exe	comruntime.exe
File created	C:\Windows\Boot\EFI_EX\es-ES\fontdrvhost.exe	comruntime.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5072	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlueStacksInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Optimization.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	Installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	Installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	Installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	Installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings	Optimization.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	Installer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3936	schtasks.exe
2332	schtasks.exe
2320	schtasks.exe
2356	schtasks.exe
4836	schtasks.exe
1400	schtasks.exe
3564	schtasks.exe
2636	schtasks.exe
1228	schtasks.exe
5384	schtasks.exe
5960	schtasks.exe
4036	schtasks.exe
3432	schtasks.exe
1096	schtasks.exe
4904	schtasks.exe
4716	schtasks.exe
2288	schtasks.exe
5584	schtasks.exe
2624	schtasks.exe
2736	schtasks.exe
2416	schtasks.exe
248	schtasks.exe
3660	schtasks.exe
1832	schtasks.exe
4212	schtasks.exe
356	schtasks.exe
6016	schtasks.exe
3340	schtasks.exe
4780	schtasks.exe
2168	schtasks.exe
2072	schtasks.exe
3084	schtasks.exe
760	schtasks.exe
6128	schtasks.exe
5836	schtasks.exe
672	schtasks.exe
3856	schtasks.exe
3176	schtasks.exe
2620	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4864	comruntime.exe
4864	comruntime.exe
4864	comruntime.exe
4864	comruntime.exe
4864	comruntime.exe
4864	comruntime.exe
4864	comruntime.exe
4864	comruntime.exe
4864	comruntime.exe
4864	comruntime.exe
4864	comruntime.exe
4864	comruntime.exe
4864	comruntime.exe
4864	comruntime.exe
4864	comruntime.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	4864	comruntime.exe
Token: SeDebugPrivilege	3888	dllhost.exe
Token: SeDebugPrivilege	1456	explorer.exe
Token: SeDebugPrivilege	3536	lsass.exe
Token: SeDebugPrivilege	1200	fontdrvhost.exe
Token: SeDebugPrivilege	2056	Registry.exe
Token: SeDebugPrivilege	5392	WUDFHost.exe
Token: SeDebugPrivilege	3004	dllhost.exe
Token: SeDebugPrivilege	3336	lsass.exe
Token: SeDebugPrivilege	1372	RuntimeBroker.exe
Token: SeDebugPrivilege	2240	OfficeClickToRun.exe
Token: SeDebugPrivilege	356	wininit.exe
Token: SeDebugPrivilege	256	Idle.exe
Token: SeDebugPrivilege	4932	RuntimeBroker.exe
Token: SeDebugPrivilege	1008	lsass.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 2480	4192	Installer.exe	89
PID 2480 wrote to memory of 3600	2480	BlueStacksInstaller.exe	90
PID 2480 wrote to memory of 4220	2480	BlueStacksInstaller.exe	91
PID 3600 wrote to memory of 2712	3600	BlueStacksInstaller.exe	92
PID 4220 wrote to memory of 2144	4220	Optimization.exe	93
PID 2144 wrote to memory of 5072	2144	WScript.exe	95
PID 5072 wrote to memory of 4864	5072	cmd.exe	97
PID 4864 wrote to memory of 3336	4864	comruntime.exe	158

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Installer.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\BlueStacksInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\BlueStacksInstaller.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Users\Admin\AppData\Local\Temp\BlueStacksInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\BlueStacksInstaller.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3600
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 864
      4⤵
      PID:2712
- - C:\Users\Admin\AppData\Local\Temp\Optimization.exe
    "C:\Users\Admin\AppData\Local\Temp\Optimization.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4220
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Containerperf\pU2S30IPc5deER.vbe"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2144
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Containerperf\Ux0Yru5lNDwPCKCI.bat" "
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5072
      - C:\Containerperf\comruntime.exe
        
        "C:\Containerperf\comruntime.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4864
        
        C:\Program Files\Google\Chrome\Application\lsass.exe
        
        "C:\Program Files\Google\Chrome\Application\lsass.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Windows\Migration\WTR\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Windows\Migration\WTR\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Common Files\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Downloads\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Public\Downloads\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Downloads\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\uk-UA\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\uk-UA\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\uk-UA\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\javapath\WUDFHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\javapath\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\javapath\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\Application\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\Application\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Windows\L2Schemas\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\L2Schemas\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Windows\L2Schemas\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Windows.old\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows.old\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Windows.old\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Windows\IdentityCRL\INT\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\INT\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Windows\IdentityCRL\INT\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Containerperf\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Containerperf\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Containerperf\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Containerperf\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168

C:\Program Files\Windows Media Player\uk-UA\dllhost.exe
"C:\Program Files\Windows Media Player\uk-UA\dllhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3888

C:\Windows\Migration\WTR\explorer.exe
"C:\Windows\Migration\WTR\explorer.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Containerperf\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Containerperf\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Program Files\Google\Chrome\Application\lsass.exe
"C:\Program Files\Google\Chrome\Application\lsass.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Windows\TAPI\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\TAPI\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Windows\TAPI\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4212

C:\Windows\L2Schemas\fontdrvhost.exe
"C:\Windows\L2Schemas\fontdrvhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\WUDFHost.exe
"C:\Program Files (x86)\Common Files\Oracle\Java\javapath\WUDFHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5392

C:\Users\Public\Downloads\Registry.exe
"C:\Users\Public\Downloads\Registry.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2056

C:\Program Files (x86)\Common Files\dllhost.exe
"C:\Program Files (x86)\Common Files\dllhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3004

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\RuntimeBroker.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1372

C:\Containerperf\OfficeClickToRun.exe
"C:\Containerperf\OfficeClickToRun.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2240

C:\Windows\IdentityCRL\INT\wininit.exe
"C:\Windows\IdentityCRL\INT\wininit.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:356

C:\Windows\TAPI\Idle.exe
"C:\Windows\TAPI\Idle.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:256

C:\Containerperf\RuntimeBroker.exe
"C:\Containerperf\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4932

C:\Windows.old\lsass.exe
"C:\Windows.old\lsass.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ux0Yru5lNDwPCKCI.bat

Path C:\Containerperf\Ux0Yru5lNDwPCKCI.bat
Size 44B
SHA256 30b47253979712f53ed64819577f99a1d81132e2db96e85585d1cf2d99498f20
MD5 5839c82f6cdf30e5f44098f68b7172b6
SHA1 a52ca96e908e680d9b5a98db9ad1c33777cc2d64
SHA512 57d9611cf588f2692f667989a02159a2271c07a02711274ecb4d75044a08b9beeac7b38af9d7c784698772bd188ebb753af7d525bca0ee01f06d5f8d326b7436
MD5 SHA1 SHA512

Submit Download

comruntime.exe

Path C:\Containerperf\comruntime.exe
Size 828KB
SHA256 78efb35e7b51882913109c68e386b0bd2941901a451a35022bf5e5a2f018dfcb
MD5 0a9f93b87901a403fa1f1b1362455f13
SHA1 997e7cf6edd424e6346a791ad82702ebb3e2ca9c
SHA512 75aed8d73449492946b1540b94958497599f86a01ca1b7c9910b36b17f3bda841193f97568c575856b201ab5849ce9670ee7b919681a2d67e342bc521f7eb865
SSDEEP 12288:FqMPq1MAcWCBKkzRclNKAlL6NBCY+B+HIjNd1rJYCzcl:O1MAcGAClNy7iUcT1w
TLSH
T1A005F802BE44CE01F0191633D2EF454847B0A9516AEAEB2B7DBA377D591239B7C0D9CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pU2S30IPc5deER.vbe

Path C:\Containerperf\pU2S30IPc5deER.vbe
Size 214B
SHA256 d6861b43aae0d32c6affe096a057ffa071ca3872d4618fef9f851920491631ec
MD5 07dcfe26b773a136742d9b9fc31848fb
SHA1 519df040e669cfd32565d9572887126f2dd004df
SHA512 d361423f4b1e1492ba86d1bf879a06066f09b39be13a15fdf0bbc9868ed0f15fd4a9d26eac30b16f89c389f9ba533229322ad8487df76d500c0ab4ca4f120982
TLSH
T135D0A71496A7A654844E2545F301947A6961FF4ADB38565602EECE01D301657302C2C8
MD5 SHA1 SHA512 TLSH

Submit Download

BlueStacksInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\BlueStacksInstaller.exe
Size 168KB
SHA256 daea9478f3d0934fcc3108d6fecce82a40a9f2eb6df8f81bc9054975960f1ece
MD5 1292297da4596eef979ba3c77a3d0bcf
SHA1 21f0df5cdd507c9263de3951ded9b01c99642c04
SHA512 be6a0dc9079a64642b0a49319074470b7e98fd91e6193ca0798ef0f98b56a0dd0ebf96de2557d73f459a75c0b0f8d89a4a6a0f50eaa50fd8aa690ea7021c23c6
SSDEEP 3072:Q3Da7OQI4uhBBTQLqk7eVpcrOZVB+IDsktMNNudv94HD:Aa0HAqKQpKHj
TLSH
T191F30A4437F88928F2FF5FBA29B245154B75B587DA71CB1E0AC3049E0A71740DA26BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Optimization.exe

Path C:\Users\Admin\AppData\Local\Temp\Optimization.exe
Size 1.1MB
SHA256 f71c9ff720a1f600d28c195d748dfe7517932b55d431388e5130b9b538f0e79e
MD5 4480b7502d1eb006ac932df778c1c1d0
SHA1 1f506b24003fcf249aa785ce183655346f41bcfa
SHA512 198ba1b278776dd07f4fdcd69caa1b14e00d48ebedd97ad33e856b0c6b6dfe9357c0345b14593a2b55ea9dfc1e74960098704e5c411ff2d89b90acce10fe85c3
SSDEEP 12288:aRZ+IoG/n9IQxW3OBsee2X+t4RbhqMPq1MAcWCBKkzRclNKAlL6NBCY+B+HIjNdd:U2G/nvxW3Ww0ta1MAcGAClNy7iUcT1wE
TLSH
T1E0454A01BE44CA11F0191633C2FF450847B4BC116AAAEB2B7EBA376D59123977D1DACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlueStacksInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\BlueStacksInstaller.exe
Size 1.3MB
SHA256 971ef79b68aa20eb9c7d485d1c49bcec8401b2a508c0e4b3ad85af604628bd40
MD5 609ee0602248a3e52e3cd850a9dc92f6
SHA1 d023f1afc84f9ce53e3e33c96a708a9d8b46c475
SHA512 773af0c7471f3923266a8c326d2ca2c624ace630c5041fa8ce9d36a3142b45f6a720700af0912042e40cc5b7d4cfcaa2d47ebabf1f73bedd85c81d979547593d
SSDEEP 24576:mEe2G/nvxW3Ww0ta1MAcGAClNy7iUcT1w6:qbA30apAzi7
TLSH
T1EE556B01BE84C911F0691633C2FF450447B0BC116AAAEB2F3EBA376D59213967D1DADB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2480-27-0x0000000000400000-0x0000000000551000-memory.dmp

Download

memory/3600-28-0x0000000001260000-0x0000000001270000-memory.dmp

Download

memory/3600-30-0x000000001BE70000-0x000000001C380000-memory.dmp

Download

memory/3600-31-0x000000001C4C0000-0x000000001C5F6000-memory.dmp

Download

memory/4864-48-0x0000000000AA0000-0x0000000000B76000-memory.dmp

Download