dcrat | a85a685e8753319479922d6098726906804dca6a518205ed70fd555c5289d743

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 21:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0a3e2c2bd38771605cb2eeae9c8cbc62.exe
Size 3.0MB
Sample260804-1mh13ayxes
SHA256 a85a685e8753319479922d6098726906804dca6a518205ed70fd555c5289d743
MD5 0a3e2c2bd38771605cb2eeae9c8cbc62
SHA1 9a271677e5d66df8d0b7d0677893d69ce9ab72f1
SHA512 396bbe157b2da5118cacaa0b78573a431d6d563587fd5dd40192be00bf8c602289605271f6142e203ed8264773e562ae294ae191c6a640752c83c7ef504cafa7
SSDEEP 49152:0iLfjgg4P/r0AXH3gyMaElS0a+yqQKrvVkOPR3QdE0QynCsAJWVPT7djEPt:bfjgrLJgyelE43/0LnCbYVrBjEPt
TLSH
T1E4E5D0017E45CE01F0091273C2EF494847B9A95166A6E31FBDBA37AE65523E73C0DACB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution dcrat infostealer persistence rat

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4136-1-0x0000000000590000-0x000000000089A000-memory.dmp	dcrat
behavioral2/files/0x000c00000001c57b-49.dat	dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	200	5984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	412	5984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	5984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5648	5984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	5984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	5984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1232	5984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5704	5984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	5984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4316	5984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3464	5984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	5984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	5984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	860	5984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5336	5984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3660	5984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	5984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6008	5984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3776	5984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5572	5984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	5984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	5984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	5984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	624	5984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5804	5984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	940	5984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	5984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5800	5984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3320	5984	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5244	5984	schtasks.exe	89

Executes dropped EXE 10 IoCs

pid	Process
3324	dllhost.exe
780	spoolsv.exe
1448	dllhost.exe
6024	explorer.exe
5528	dwm.exe
1076	SecurityHealthSystray.exe
776	dwm.exe
2816	dwm.exe
2572	WUDFHost.exe
4528	upfc.exe

SmartAssembly .NET packer 2 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/4136-32-0x000000001C030000-0x000000001C03C000-memory.dmp	SmartAssembly
behavioral2/memory/4136-33-0x000000001C040000-0x000000001C04A000-memory.dmp	SmartAssembly

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\explorer.exe	0a3e2c2bd38771605cb2eeae9c8cbc62.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\7a0fd90576e088	0a3e2c2bd38771605cb2eeae9c8cbc62.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\logger\WUDFHost.exe	0a3e2c2bd38771605cb2eeae9c8cbc62.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\logger\480b7989c529f6	0a3e2c2bd38771605cb2eeae9c8cbc62.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Setup\State\dllhost.exe	0a3e2c2bd38771605cb2eeae9c8cbc62.exe
File created	C:\Windows\Setup\State\5940a34987c991	0a3e2c2bd38771605cb2eeae9c8cbc62.exe
File created	C:\Windows\Setup\State\dwm.exe	0a3e2c2bd38771605cb2eeae9c8cbc62.exe
File created	C:\Windows\Setup\State\6cb0b6c459d5d3	0a3e2c2bd38771605cb2eeae9c8cbc62.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2444	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings	0a3e2c2bd38771605cb2eeae9c8cbc62.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
860	schtasks.exe
5648	schtasks.exe
3660	schtasks.exe
3776	schtasks.exe
5072	schtasks.exe
1232	schtasks.exe
4880	schtasks.exe
5572	schtasks.exe
1776	schtasks.exe
5804	schtasks.exe
412	schtasks.exe
208	schtasks.exe
1432	schtasks.exe
3464	schtasks.exe
4580	schtasks.exe
3024	schtasks.exe
5244	schtasks.exe
200	schtasks.exe
6008	schtasks.exe
624	schtasks.exe
4316	schtasks.exe
5704	schtasks.exe
5336	schtasks.exe
2252	schtasks.exe
940	schtasks.exe
2928	schtasks.exe
5800	schtasks.exe
3320	schtasks.exe
2752	schtasks.exe
2832	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4136	0a3e2c2bd38771605cb2eeae9c8cbc62.exe
4136	0a3e2c2bd38771605cb2eeae9c8cbc62.exe
4136	0a3e2c2bd38771605cb2eeae9c8cbc62.exe
4136	0a3e2c2bd38771605cb2eeae9c8cbc62.exe
4136	0a3e2c2bd38771605cb2eeae9c8cbc62.exe
4136	0a3e2c2bd38771605cb2eeae9c8cbc62.exe
4136	0a3e2c2bd38771605cb2eeae9c8cbc62.exe
4136	0a3e2c2bd38771605cb2eeae9c8cbc62.exe
4136	0a3e2c2bd38771605cb2eeae9c8cbc62.exe
4136	0a3e2c2bd38771605cb2eeae9c8cbc62.exe
4136	0a3e2c2bd38771605cb2eeae9c8cbc62.exe
4136	0a3e2c2bd38771605cb2eeae9c8cbc62.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4136	0a3e2c2bd38771605cb2eeae9c8cbc62.exe
Token: SeDebugPrivilege	3324	dllhost.exe
Token: SeDebugPrivilege	6024	explorer.exe
Token: SeDebugPrivilege	1448	dllhost.exe
Token: SeDebugPrivilege	780	spoolsv.exe
Token: SeDebugPrivilege	1076	SecurityHealthSystray.exe
Token: SeDebugPrivilege	5528	dwm.exe
Token: SeDebugPrivilege	776	dwm.exe
Token: SeDebugPrivilege	2816	dwm.exe
Token: SeDebugPrivilege	2572	WUDFHost.exe
Token: SeDebugPrivilege	4528	upfc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 2444	4136	0a3e2c2bd38771605cb2eeae9c8cbc62.exe	132
PID 2444 wrote to memory of 3204	2444	cmd.exe	134
PID 2444 wrote to memory of 2816	2444	cmd.exe	139

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\0a3e2c2bd38771605cb2eeae9c8cbc62.exe
"C:\Users\Admin\AppData\Local\Temp\0a3e2c2bd38771605cb2eeae9c8cbc62.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bXeiwu6LjD.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3204
- - C:\Windows\Setup\State\dwm.exe
    "C:\Windows\Setup\State\dwm.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthSystrayS" /sc MINUTE /mo 8 /tr "'C:\Windows.old\SecurityHealthSystray.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthSystray" /sc ONLOGON /tr "'C:\Windows.old\SecurityHealthSystray.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthSystrayS" /sc MINUTE /mo 14 /tr "'C:\Windows.old\SecurityHealthSystray.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\Setup\State\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Setup\State\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\Setup\State\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\SendTo\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Admin\SendTo\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\SendTo\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4880

C:\Windows\Setup\State\dllhost.exe
"C:\Windows\Setup\State\dllhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5572

C:\Recovery\WindowsRE\dllhost.exe
"C:\Recovery\WindowsRE\dllhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1448

C:\Users\Admin\SendTo\spoolsv.exe
"C:\Users\Admin\SendTo\spoolsv.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:780

C:\Program Files (x86)\Windows Photo Viewer\uk-UA\explorer.exe
"C:\Program Files (x86)\Windows Photo Viewer\uk-UA\explorer.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2252

C:\Recovery\WindowsRE\dwm.exe
"C:\Recovery\WindowsRE\dwm.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 7 /tr "'C:\Program Files\VideoLAN\VLC\plugins\logger\WUDFHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1776

C:\Windows.old\SecurityHealthSystray.exe
"C:\Windows.old\SecurityHealthSystray.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\plugins\logger\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 5 /tr "'C:\Program Files\VideoLAN\VLC\plugins\logger\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Windows\Setup\State\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Setup\State\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Windows\Setup\State\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5804

C:\Windows\Setup\State\dwm.exe
"C:\Windows\Setup\State\dwm.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:776

C:\Program Files\VideoLAN\VLC\plugins\logger\WUDFHost.exe
"C:\Program Files\VideoLAN\VLC\plugins\logger\WUDFHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2572

C:\Recovery\WindowsRE\upfc.exe
"C:\Recovery\WindowsRE\upfc.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bXeiwu6LjD.bat

Path C:\Users\Admin\AppData\Local\Temp\bXeiwu6LjD.bat
Size 195B
SHA256 5fe39ec90f61d8358c9d57fd0f339e370a32de915e9bf36e43541155002cf28a
MD5 4ad53aade192339bb712c04e789ef197
SHA1 5e86ab72e60647e51b3d0d926a66e979343c65ef
SHA512 a5b25da9debd2afe1e8dbd0a6ca84241e06f0bdbcd9a37190dea424fb85d95375014369a89358c2ffe17d049ca8710dc7a883491f428b4b70904ba1616e8ec35
TLSH
T1D2D0C0829002CB4408520C1348CE11CDE413380873C43A70078938293ACF87BB65E5C1
MD5 SHA1 SHA512 TLSH

Submit Download

dllhost.exe

Path C:\Windows\Setup\State\dllhost.exe
Size 3.0MB
SHA256 a85a685e8753319479922d6098726906804dca6a518205ed70fd555c5289d743
MD5 0a3e2c2bd38771605cb2eeae9c8cbc62
SHA1 9a271677e5d66df8d0b7d0677893d69ce9ab72f1
SHA512 396bbe157b2da5118cacaa0b78573a431d6d563587fd5dd40192be00bf8c602289605271f6142e203ed8264773e562ae294ae191c6a640752c83c7ef504cafa7
SSDEEP 49152:0iLfjgg4P/r0AXH3gyMaElS0a+yqQKrvVkOPR3QdE0QynCsAJWVPT7djEPt:bfjgrLJgyelE43/0LnCbYVrBjEPt
TLSH
T1E4E5D0017E45CE01F0091273C2EF494847B9A95166A6E31FBDBA37AE65523E73C0DACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4136-37-0x000000001C080000-0x000000001C08C000-memory.dmp

Download

memory/4136-24-0x0000000002B10000-0x0000000002B1C000-memory.dmp

Download

memory/4136-4-0x00007FF8EAA00000-0x00007FF8EB3A4000-memory.dmp

Download

memory/4136-5-0x00007FF8EAA00000-0x00007FF8EB3A4000-memory.dmp

Download

memory/4136-6-0x00007FF8EAA00000-0x00007FF8EB3A4000-memory.dmp

Download

memory/4136-7-0x00007FF8EAA00000-0x00007FF8EB3A4000-memory.dmp

Download

memory/4136-8-0x00007FF8EAA00000-0x00007FF8EB3A4000-memory.dmp

Download

memory/4136-9-0x00007FF8EAA00000-0x00007FF8EB3A4000-memory.dmp

Download

memory/4136-10-0x00007FF8EAA00000-0x00007FF8EB3A4000-memory.dmp

Download

memory/4136-11-0x0000000001110000-0x000000000111E000-memory.dmp

Download

memory/4136-12-0x00000000011C0000-0x00000000011CE000-memory.dmp

Download

memory/4136-19-0x0000000002B00000-0x0000000002B12000-memory.dmp

Download

memory/4136-20-0x0000000002B30000-0x0000000002B3C000-memory.dmp

Download

memory/4136-31-0x000000001C020000-0x000000001C02C000-memory.dmp

Download

memory/4136-23-0x000000001BFA0000-0x000000001BFF6000-memory.dmp

Download

memory/4136-33-0x000000001C040000-0x000000001C04A000-memory.dmp

Download

memory/4136-27-0x0000000002CF0000-0x0000000002D02000-memory.dmp

Download

memory/4136-26-0x0000000002CE0000-0x0000000002CE8000-memory.dmp

Download

memory/4136-32-0x000000001C030000-0x000000001C03C000-memory.dmp

Download

memory/4136-35-0x000000001C060000-0x000000001C06E000-memory.dmp

Download

memory/4136-0-0x00007FF8EAB8F000-0x00007FF8EAB90000-memory.dmp

Download

memory/4136-36-0x000000001C070000-0x000000001C078000-memory.dmp

Download

memory/4136-3-0x00007FF8EAA00000-0x00007FF8EB3A4000-memory.dmp

Download

memory/4136-34-0x000000001C050000-0x000000001C05E000-memory.dmp

Download

memory/4136-22-0x0000000002CD0000-0x0000000002CE0000-memory.dmp

Download

memory/4136-30-0x000000001C010000-0x000000001C018000-memory.dmp

Download

memory/4136-29-0x000000001B730000-0x000000001B738000-memory.dmp

Download

memory/4136-28-0x000000001C540000-0x000000001CA68000-memory.dmp

Download

memory/4136-25-0x0000000002B20000-0x0000000002B2C000-memory.dmp

Download

memory/4136-21-0x0000000002CC0000-0x0000000002CC8000-memory.dmp

Download

memory/4136-18-0x0000000002AF0000-0x0000000002AF8000-memory.dmp

Download

memory/4136-17-0x0000000001220000-0x0000000001236000-memory.dmp

Download

memory/4136-16-0x0000000001210000-0x0000000001218000-memory.dmp

Download

memory/4136-15-0x0000000002C70000-0x0000000002CC0000-memory.dmp

Download

memory/4136-14-0x00000000011F0000-0x000000000120C000-memory.dmp

Download

memory/4136-13-0x00000000011E0000-0x00000000011E8000-memory.dmp

Download

memory/4136-43-0x00007FF8EAA00000-0x00007FF8EB3A4000-memory.dmp

Download

memory/4136-44-0x00007FF8EAA00000-0x00007FF8EB3A4000-memory.dmp

Download

memory/4136-45-0x00007FF8EAA00000-0x00007FF8EB3A4000-memory.dmp

Download

memory/4136-46-0x00007FF8EAA00000-0x00007FF8EB3A4000-memory.dmp

Download

memory/4136-2-0x00007FF8EAA00000-0x00007FF8EB3A4000-memory.dmp

Download

memory/4136-1-0x0000000000590000-0x000000000089A000-memory.dmp

Download

memory/4136-65-0x000000001D270000-0x000000001D2EC000-memory.dmp

Download

memory/4136-66-0x000000001D270000-0x000000001D2EC000-memory.dmp

Download

memory/4136-67-0x00007FF8EAA00000-0x00007FF8EB3A4000-memory.dmp

Download