dcrat | 75bceeb7380ab269e61da5b429ed794131f986ec40bbc3f065bcfd71833638c8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 07:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
108b0072f439f8b8e423d814e215645c.exe
Size 828KB
Sample260810-h7db7syscs
SHA256 75bceeb7380ab269e61da5b429ed794131f986ec40bbc3f065bcfd71833638c8
MD5 108b0072f439f8b8e423d814e215645c
SHA1 fbcf24564eb72125a095d4c4c20dd6e13f1d676d
SHA512 1d5a78e75d5f360b1e678fa33c604e365afaa7d01e0663f565d98193d3e61f2a6784ca5322416ff8a0b36650e4ca0a637e051ca70c9f9f2f96e2914258a60dbf
SSDEEP 12288:Sjzr4mg5shusXKaRpu+FOTcW1n5n4oJK6UG4jU:Sj3hgKhumRptFtW1p42K6N4Y
TLSH
T1AE0507027E48CE82F4091277C3EF45484FB0A85166A6E31B7DBA376E56163A73C0D9DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution dcrat infostealer persistence rat

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1492-0-0x0000000000050000-0x0000000000126000-memory.dmp	dcrat
behavioral1/files/0x00070000000244f5-10.dat	dcrat

Process spawned unexpected child process 33 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2100	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4408	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1284	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4616	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4708	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	392	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4804	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	856	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3348	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1412	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1344	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1108	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4008	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3468	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4484	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4388	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4416	688	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1056	688	schtasks.exe	85

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	108b0072f439f8b8e423d814e215645c.exe

Executes dropped EXE 11 IoCs

pid	Process
3700	fontdrvhost.exe
772	smss.exe
2704	StartMenuExperienceHost.exe
3460	sihost.exe
2496	System.exe
2172	SppExtComObj.exe
3412	TextInputHost.exe
5028	csrss.exe
3820	OfficeClickToRun.exe
3568	dllhost.exe
2784	csrss.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Security\BrowserCore\en-US\StartMenuExperienceHost.exe	108b0072f439f8b8e423d814e215645c.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\en-US\StartMenuExperienceHost.exe	108b0072f439f8b8e423d814e215645c.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\55b276f4edf653	108b0072f439f8b8e423d814e215645c.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\SppExtComObj.exe	108b0072f439f8b8e423d814e215645c.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\e1ef82546f0b02	108b0072f439f8b8e423d814e215645c.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Media\27d1bcfc3c54e0	108b0072f439f8b8e423d814e215645c.exe
File created	C:\Windows\Vss\Writers\System\csrss.exe	108b0072f439f8b8e423d814e215645c.exe
File created	C:\Windows\Vss\Writers\System\886983d96e3d3e	108b0072f439f8b8e423d814e215645c.exe
File created	C:\Windows\de-DE\OfficeClickToRun.exe	108b0072f439f8b8e423d814e215645c.exe
File created	C:\Windows\de-DE\e6c9b481da804f	108b0072f439f8b8e423d814e215645c.exe
File created	C:\Windows\es-ES\smss.exe	108b0072f439f8b8e423d814e215645c.exe
File created	C:\Windows\es-ES\69ddcba757bf72	108b0072f439f8b8e423d814e215645c.exe
File created	C:\Windows\Media\System.exe	108b0072f439f8b8e423d814e215645c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2276	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	108b0072f439f8b8e423d814e215645c.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2512	schtasks.exe
4408	schtasks.exe
1284	schtasks.exe
4804	schtasks.exe
536	schtasks.exe
4008	schtasks.exe
2700	schtasks.exe
756	schtasks.exe
1344	schtasks.exe
4388	schtasks.exe
4416	schtasks.exe
2684	schtasks.exe
4708	schtasks.exe
2784	schtasks.exe
3036	schtasks.exe
640	schtasks.exe
5008	schtasks.exe
1412	schtasks.exe
4936	schtasks.exe
3468	schtasks.exe
2400	schtasks.exe
3348	schtasks.exe
208	schtasks.exe
1504	schtasks.exe
4484	schtasks.exe
1056	schtasks.exe
4616	schtasks.exe
392	schtasks.exe
856	schtasks.exe
1108	schtasks.exe
4652	schtasks.exe
2100	schtasks.exe
2028	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1492	108b0072f439f8b8e423d814e215645c.exe
1492	108b0072f439f8b8e423d814e215645c.exe
1492	108b0072f439f8b8e423d814e215645c.exe
1492	108b0072f439f8b8e423d814e215645c.exe
1492	108b0072f439f8b8e423d814e215645c.exe
1492	108b0072f439f8b8e423d814e215645c.exe
1492	108b0072f439f8b8e423d814e215645c.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	1492	108b0072f439f8b8e423d814e215645c.exe
Token: SeDebugPrivilege	3700	fontdrvhost.exe
Token: SeDebugPrivilege	772	smss.exe
Token: SeDebugPrivilege	3460	sihost.exe
Token: SeDebugPrivilege	2704	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	2496	System.exe
Token: SeDebugPrivilege	2172	SppExtComObj.exe
Token: SeDebugPrivilege	3412	TextInputHost.exe
Token: SeDebugPrivilege	5028	csrss.exe
Token: SeDebugPrivilege	3820	OfficeClickToRun.exe
Token: SeDebugPrivilege	2784	csrss.exe
Token: SeDebugPrivilege	3568	dllhost.exe
Token: SeDebugPrivilege	4300	108b0072f439f8b8e423d814e215645c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 2276	1492	108b0072f439f8b8e423d814e215645c.exe	138
PID 2276 wrote to memory of 2660	2276	cmd.exe	142
PID 2276 wrote to memory of 4300	2276	cmd.exe	146

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\108b0072f439f8b8e423d814e215645c.exe
"C:\Users\Admin\AppData\Local\Temp\108b0072f439f8b8e423d814e215645c.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\t3lCqdZrmP.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2660
- - C:\Users\Admin\AppData\Local\Temp\108b0072f439f8b8e423d814e215645c.exe
    "C:\Users\Admin\AppData\Local\Temp\108b0072f439f8b8e423d814e215645c.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Windows\es-ES\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\es-ES\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Windows\es-ES\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\AppData\Local\PeerDistRepub\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\PeerDistRepub\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Local\PeerDistRepub\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5008

C:\Recovery\WindowsRE\fontdrvhost.exe
"C:\Recovery\WindowsRE\fontdrvhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Users\Default\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:536

C:\Windows\es-ES\smss.exe
"C:\Windows\es-ES\smss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Default\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\Users\Default\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Windows\Media\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Media\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4936

C:\Program Files\Windows Security\BrowserCore\en-US\StartMenuExperienceHost.exe
"C:\Program Files\Windows Security\BrowserCore\en-US\StartMenuExperienceHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2704

C:\Users\Admin\AppData\Local\PeerDistRepub\sihost.exe
"C:\Users\Admin\AppData\Local\PeerDistRepub\sihost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Windows\Media\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\Vss\Writers\System\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\System\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\Vss\Writers\System\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Windows\de-DE\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\de-DE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3468

C:\Windows\Media\System.exe
"C:\Windows\Media\System.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Windows\de-DE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\Default\NetHood\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4388

C:\Program Files (x86)\Windows NT\Accessories\en-US\SppExtComObj.exe
"C:\Program Files (x86)\Windows NT\Accessories\en-US\SppExtComObj.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default\NetHood\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Users\Default\NetHood\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1056

C:\Users\Default\TextInputHost.exe
"C:\Users\Default\TextInputHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3412

C:\Windows\Vss\Writers\System\csrss.exe
"C:\Windows\Vss\Writers\System\csrss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5028

C:\Windows\de-DE\OfficeClickToRun.exe
"C:\Windows\de-DE\OfficeClickToRun.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3820

C:\Users\Default\NetHood\dllhost.exe
"C:\Users\Default\NetHood\dllhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3568

C:\Recovery\WindowsRE\csrss.exe
"C:\Recovery\WindowsRE\csrss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SppExtComObj.exe

Path C:\Program Files (x86)\Windows NT\Accessories\en-US\SppExtComObj.exe
Size 828KB
SHA256 75bceeb7380ab269e61da5b429ed794131f986ec40bbc3f065bcfd71833638c8
MD5 108b0072f439f8b8e423d814e215645c
SHA1 fbcf24564eb72125a095d4c4c20dd6e13f1d676d
SHA512 1d5a78e75d5f360b1e678fa33c604e365afaa7d01e0663f565d98193d3e61f2a6784ca5322416ff8a0b36650e4ca0a637e051ca70c9f9f2f96e2914258a60dbf
SSDEEP 12288:Sjzr4mg5shusXKaRpu+FOTcW1n5n4oJK6UG4jU:Sj3hgKhumRptFtW1p42K6N4Y
TLSH
T1AE0507027E48CE82F4091277C3EF45484FB0A85166A6E31B7DBA376E56163A73C0D9DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

108b0072f439f8b8e423d814e215645c.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\108b0072f439f8b8e423d814e215645c.exe.log
Size 1KB
SHA256 519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900
MD5 7f3c0ae41f0d9ae10a8985a2c327b8fb
SHA1 d58622bf6b5071beacf3b35bb505bde2000983e3
SHA512 8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125
TLSH
T10131BE7123B6F1D989163F472C6D26C003BF4329B6A0EE4CB598625EE9270175F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

System.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\System.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
TLSH
T1B521CD712376B1D889163F422C5D2A8007BF0335BA50DE1CB9A9725ED9260171F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

t3lCqdZrmP.bat

Path C:\Users\Admin\AppData\Local\Temp\t3lCqdZrmP.bat
Size 235B
SHA256 60bf27ca5393363943f4df80bb6b2858aea85a3d0221261f6c719ed1793a2dae
MD5 dcccc6ec8a809b86a6b6f7c8dccdc217
SHA1 71addc87e5b81cff20a6eb9f183c065b5dffd51d
SHA512 d79e45add598a31e83d58e0d28ca05e4799f76a6216d375b7c533ecc1cf7637a761c5ecf2f7abf8ae37ed83a5d43e84841189265f30c0fa1d1b784625bd54e67
TLSH
T16CD0A7568186C7590846381318A6258D94F71C8876D62A200795C8AC2A875AAB1A66C3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1492-0-0x0000000000050000-0x0000000000126000-memory.dmp

Download

memory/1492-1-0x000000001AE10000-0x000000001AE20000-memory.dmp

Download