dcrat | f3acd382c98e29c098728d1de97133a1852609d62946207b18ed81b90e2215ff

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 15:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
036f488bda0f0a1b7deb042eac153dda.exe
Size 828KB
Sample260818-talg4avfqd
SHA256 f3acd382c98e29c098728d1de97133a1852609d62946207b18ed81b90e2215ff
MD5 036f488bda0f0a1b7deb042eac153dda
SHA1 4d0ebadd007e7ea4d5e5fc2a29d60ebd4d144ce6
SHA512 901653c3b9120becf7ee508cec2a34f4cacde5b87c69e5ed0ec7950f86b0e26b6bae57c55154a72fb178f9da8bc390b2e2004b3502ca7940f31ac87502ca453d
SSDEEP 12288:ZhQlouvvA2RtMkIQkLpaq1buGaSYpAEbP3vQXdYME7es0kJQO:7QloKvA2RtEQkLpaq1nie3yMQ0kJQO
TLSH
T15A05E7017E44CE12F0191233C2EF4A4847F499516AA6E72B7DBA376E65127E73C0DACB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution dcrat infostealer persistence rat

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4464-1-0x0000000000800000-0x00000000008D6000-memory.dmp	dcrat
behavioral2/files/0x000a000000011390-18.dat	dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5880	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4220	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4644	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5296	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1844	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1424	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	292	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	260	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4724	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5500	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5872	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4728	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4944	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5908	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1040	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	540	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4416	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3928	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6036	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5972	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6104	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4768	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1196	4124	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4392	4124	schtasks.exe	89

Executes dropped EXE 13 IoCs

pid	Process
4672	Idle.exe
1480	winlogon.exe
6056	SearchHost.exe
876	wininit.exe
2020	lsass.exe
5228	csrss.exe
2608	explorer.exe
4684	fontdrvhost.exe
3576	csrss.exe
4044	smartscreen.exe
5412	sihost.exe
5460	SecurityHealthService.exe
4640	explorer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\lv-LV\winlogon.exe	036f488bda0f0a1b7deb042eac153dda.exe
File created	C:\Windows\SysWOW64\lv-LV\cc11b995f2a76d	036f488bda0f0a1b7deb042eac153dda.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsPowerShell\wininit.exe	036f488bda0f0a1b7deb042eac153dda.exe
File created	C:\Program Files\WindowsPowerShell\56085415360792	036f488bda0f0a1b7deb042eac153dda.exe
File created	C:\Program Files (x86)\Windows NT\lsass.exe	036f488bda0f0a1b7deb042eac153dda.exe
File created	C:\Program Files\Windows Mail\SearchHost.exe	036f488bda0f0a1b7deb042eac153dda.exe
File created	C:\Program Files\Windows Mail\cfa885d449487c	036f488bda0f0a1b7deb042eac153dda.exe
File created	C:\Program Files (x86)\MSBuild\csrss.exe	036f488bda0f0a1b7deb042eac153dda.exe
File created	C:\Program Files (x86)\Internet Explorer\images\SecurityHealthService.exe	036f488bda0f0a1b7deb042eac153dda.exe
File created	C:\Program Files (x86)\Internet Explorer\images\926e3e4b62361b	036f488bda0f0a1b7deb042eac153dda.exe
File created	C:\Program Files (x86)\Windows NT\6203df4a6bafc7	036f488bda0f0a1b7deb042eac153dda.exe
File created	C:\Program Files (x86)\MSBuild\886983d96e3d3e	036f488bda0f0a1b7deb042eac153dda.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\ShellExperiences\Idle.exe	036f488bda0f0a1b7deb042eac153dda.exe
File created	C:\Windows\ShellExperiences\6ccacd8608530f	036f488bda0f0a1b7deb042eac153dda.exe
File created	C:\Windows\Offline Web Pages\fontdrvhost.exe	036f488bda0f0a1b7deb042eac153dda.exe
File created	C:\Windows\Offline Web Pages\5b884080fd4f94	036f488bda0f0a1b7deb042eac153dda.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3456	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	036f488bda0f0a1b7deb042eac153dda.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4644	schtasks.exe
5500	schtasks.exe
4728	schtasks.exe
4768	schtasks.exe
5872	schtasks.exe
4944	schtasks.exe
1892	schtasks.exe
2984	schtasks.exe
4220	schtasks.exe
5972	schtasks.exe
5880	schtasks.exe
260	schtasks.exe
4724	schtasks.exe
2612	schtasks.exe
2648	schtasks.exe
1312	schtasks.exe
292	schtasks.exe
5908	schtasks.exe
1040	schtasks.exe
3928	schtasks.exe
5060	schtasks.exe
4732	schtasks.exe
6104	schtasks.exe
4392	schtasks.exe
5296	schtasks.exe
1844	schtasks.exe
1424	schtasks.exe
2692	schtasks.exe
540	schtasks.exe
2180	schtasks.exe
4416	schtasks.exe
1196	schtasks.exe
6036	schtasks.exe
2060	schtasks.exe
2752	schtasks.exe
2124	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4464	036f488bda0f0a1b7deb042eac153dda.exe
4464	036f488bda0f0a1b7deb042eac153dda.exe
4464	036f488bda0f0a1b7deb042eac153dda.exe
4464	036f488bda0f0a1b7deb042eac153dda.exe
4464	036f488bda0f0a1b7deb042eac153dda.exe
4464	036f488bda0f0a1b7deb042eac153dda.exe
4464	036f488bda0f0a1b7deb042eac153dda.exe
4464	036f488bda0f0a1b7deb042eac153dda.exe
4464	036f488bda0f0a1b7deb042eac153dda.exe
4464	036f488bda0f0a1b7deb042eac153dda.exe
4464	036f488bda0f0a1b7deb042eac153dda.exe
4464	036f488bda0f0a1b7deb042eac153dda.exe
4464	036f488bda0f0a1b7deb042eac153dda.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	4464	036f488bda0f0a1b7deb042eac153dda.exe
Token: SeDebugPrivilege	4672	Idle.exe
Token: SeDebugPrivilege	1480	winlogon.exe
Token: SeDebugPrivilege	876	wininit.exe
Token: SeDebugPrivilege	6056	SearchHost.exe
Token: SeDebugPrivilege	2020	lsass.exe
Token: SeDebugPrivilege	5228	csrss.exe
Token: SeDebugPrivilege	2608	explorer.exe
Token: SeDebugPrivilege	3576	csrss.exe
Token: SeDebugPrivilege	4684	fontdrvhost.exe
Token: SeDebugPrivilege	4044	smartscreen.exe
Token: SeDebugPrivilege	5412	sihost.exe
Token: SeDebugPrivilege	5460	SecurityHealthService.exe
Token: SeDebugPrivilege	4640	explorer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 3456	4464	036f488bda0f0a1b7deb042eac153dda.exe	136
PID 3456 wrote to memory of 4512	3456	cmd.exe	138
PID 3456 wrote to memory of 4640	3456	cmd.exe	153

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\036f488bda0f0a1b7deb042eac153dda.exe
"C:\Users\Admin\AppData\Local\Temp\036f488bda0f0a1b7deb042eac153dda.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lQC4GFnCCW.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4512
- - C:\Recovery\WindowsRE\explorer.exe
    "C:\Recovery\WindowsRE\explorer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Windows\ShellExperiences\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\ShellExperiences\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Windows\ShellExperiences\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files\WindowsPowerShell\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files\WindowsPowerShell\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows NT\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows NT\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Mail\SearchHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHost" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Mail\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Windows\SysWOW64\lv-LV\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4724

C:\Windows\ShellExperiences\Idle.exe
"C:\Windows\ShellExperiences\Idle.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\SysWOW64\lv-LV\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Windows\SysWOW64\lv-LV\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\MSBuild\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4728

C:\Windows\SysWOW64\lv-LV\winlogon.exe
"C:\Windows\SysWOW64\lv-LV\winlogon.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1480

C:\Program Files\Windows Mail\SearchHost.exe
"C:\Program Files\Windows Mail\SearchHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6056

C:\Program Files\WindowsPowerShell\wininit.exe
"C:\Program Files\WindowsPowerShell\wininit.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2984

C:\Program Files (x86)\Windows NT\lsass.exe
"C:\Program Files (x86)\Windows NT\lsass.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthServiceS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\images\SecurityHealthService.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthService" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\images\SecurityHealthService.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthServiceS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\images\SecurityHealthService.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows.old\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows.old\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows.old\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Windows\Offline Web Pages\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Windows\Offline Web Pages\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Windows.old\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows.old\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Windows.old\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\smartscreen.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smartscreen" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smartscreen.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\smartscreen.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3928

C:\Program Files (x86)\MSBuild\csrss.exe
"C:\Program Files (x86)\MSBuild\csrss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5228

C:\Recovery\WindowsRE\explorer.exe
"C:\Recovery\WindowsRE\explorer.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Windows\Offline Web Pages\fontdrvhost.exe
"C:\Windows\Offline Web Pages\fontdrvhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4684

C:\Windows.old\csrss.exe
"C:\Windows.old\csrss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3576

C:\Recovery\WindowsRE\smartscreen.exe
"C:\Recovery\WindowsRE\smartscreen.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4044

C:\Windows.old\sihost.exe
"C:\Windows.old\sihost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5412

C:\Program Files (x86)\Internet Explorer\images\SecurityHealthService.exe
"C:\Program Files (x86)\Internet Explorer\images\SecurityHealthService.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lQC4GFnCCW.bat

Path C:\Users\Admin\AppData\Local\Temp\lQC4GFnCCW.bat
Size 199B
SHA256 bb151ab98b8a432878a46b1848b91ecffbb7b91b104b2d50481260a913dd308c
MD5 d2bb5d6ed7aa1f592fd0552d8555da2f
SHA1 d1171a30256bafa87aabbbda2b46f5863b53fa22
SHA512 e6b92bf1a0009526d4815e81db08aba36dd3d08337ee0d53e2125902a0e8dedcf2c663c9ac1d83d6474d5e64727d6605455966b9945ca12a0fee4090e1d9c75f
TLSH
T1ACD022829002CA0808A24D03886F528CA127289AF5C826300AA618B82A4B467718A6C2
MD5 SHA1 SHA512 TLSH

Submit Download

Idle.exe

Path C:\Windows\ShellExperiences\Idle.exe
Size 828KB
SHA256 f3acd382c98e29c098728d1de97133a1852609d62946207b18ed81b90e2215ff
MD5 036f488bda0f0a1b7deb042eac153dda
SHA1 4d0ebadd007e7ea4d5e5fc2a29d60ebd4d144ce6
SHA512 901653c3b9120becf7ee508cec2a34f4cacde5b87c69e5ed0ec7950f86b0e26b6bae57c55154a72fb178f9da8bc390b2e2004b3502ca7940f31ac87502ca453d
SSDEEP 12288:ZhQlouvvA2RtMkIQkLpaq1buGaSYpAEbP3vQXdYME7es0kJQO:7QloKvA2RtEQkLpaq1nie3yMQ0kJQO
TLSH
T15A05E7017E44CE12F0191233C2EF4A4847F499516AA6E72B7DBA376E65127E73C0DACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4464-12-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/4464-11-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/4464-5-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/4464-6-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/4464-8-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/4464-9-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/4464-0-0x00007FFCEB4CF000-0x00007FFCEB4D0000-memory.dmp

Download

memory/4464-3-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/4464-10-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/4464-13-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/4464-15-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/4464-2-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/4464-1-0x0000000000800000-0x00000000008D6000-memory.dmp

Download

memory/4464-36-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download