dcrat | 24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
Size 885KB
Sample260910-ltm62aap6s
SHA256 24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37
MD5 e924a577c8f4a3ddc430a04935906172
SHA1 3a9afe5026233457bd7b47431cf91344d44637c3
SHA512 2ae2671816adcaa867c2812e836f5e4d4cf5c3d34ec7ccbea600f966f44d52b4045915e16f46696ec4eb132c9ab19e020f5f9e070d2c094b3d63ab81eaaefc58
SSDEEP 12288:clNE5VnZuh+ZIlXJBH5SP2I/lwvDT77/wOKsV42i3GULVaHeopyyx:clNCv6XJ5BClaXfD9vUha+u
TLSH
T12E1575342EEA102AF173AF7D9AE07596DA6EB6A33707995D00B103C60723B42DDD153E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution dcrat infostealer persistence rat

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1284-0-0x0000000000020000-0x0000000000104000-memory.dmp	dcrat
behavioral1/memory/1284-0-0x0000000000020000-0x0000000000104000-memory.dmp	family_dcrat_v2
behavioral1/files/0x0007000000024420-18.dat	dcrat
behavioral1/files/0x0007000000024420-18.dat	family_dcrat_v2

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4196	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3228	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3776	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2780	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5036	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1548	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3460	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3352	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3644	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3328	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3484	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3156	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2100	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3736	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3924	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4136	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4112	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	700	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4336	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1772	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	988	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4900	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4600	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	412	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3728	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3824	676	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	676	schtasks.exe	84

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe

Executes dropped EXE 14 IoCs

pid	Process
4148	spoolsv.exe
2792	services.exe
204	WUDFHost.exe
1320	WUDFHost.exe
3804	taskhostw.exe
2648	StartMenuExperienceHost.exe
3480	services.exe
4384	RuntimeBroker.exe
3920	dllhost.exe
2292	Registry.exe
4236	smss.exe
4688	wininit.exe
2624	services.exe
964	WUDFHost.exe

SmartAssembly .NET packer 2 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral1/memory/1284-4-0x000000001B230000-0x000000001B240000-memory.dmp	SmartAssembly
behavioral1/memory/1284-6-0x000000001B260000-0x000000001B26A000-memory.dmp	SmartAssembly

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\spoolsv.exe	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File created	C:\Program Files\7-Zip\Lang\f3b6ecef712a24	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File created	C:\Program Files\VideoLAN\VLC\locale\StartMenuExperienceHost.exe	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File created	C:\Program Files\Windows Sidebar\9e8d7a4ca61bd9	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File opened for modification	C:\Program Files\7-Zip\Lang\RCX415.tmp	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\RCX429.tmp	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File opened for modification	C:\Program Files\Windows Sidebar\RCX480.tmp	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File created	C:\Program Files\7-Zip\Lang\spoolsv.exe	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File created	C:\Program Files\VideoLAN\VLC\locale\55b276f4edf653	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File created	C:\Program Files\Windows Sidebar\RuntimeBroker.exe	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File opened for modification	C:\Program Files\7-Zip\Lang\RCX3E5.tmp	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\RCX418.tmp	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File opened for modification	C:\Program Files\Windows Sidebar\RCX481.tmp	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\Prefetch\ReadyBoot\480b7989c529f6	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File opened for modification	C:\Windows\bcastdvr\RCX42B.tmp	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\RCX4E5.tmp	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File created	C:\Windows\bcastdvr\WUDFHost.exe	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File created	C:\Windows\ModemLogs\Registry.exe	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File created	C:\Windows\ModemLogs\ee2ad38f3d4382	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File opened for modification	C:\Windows\en-US\RCX491.tmp	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File opened for modification	C:\Windows\en-US\RCX492.tmp	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\RCX4E6.tmp	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File opened for modification	C:\Windows\Panther\RCX45E.tmp	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File created	C:\Windows\bcastdvr\480b7989c529f6	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File created	C:\Windows\Panther\69ddcba757bf72	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File created	C:\Windows\en-US\5940a34987c991	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File created	C:\Windows\Prefetch\ReadyBoot\WUDFHost.exe	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File opened for modification	C:\Windows\bcastdvr\RCX42A.tmp	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File opened for modification	C:\Windows\ModemLogs\RCX4A4.tmp	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File created	C:\Windows\Panther\smss.exe	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File opened for modification	C:\Windows\ModemLogs\RCX493.tmp	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File opened for modification	C:\Windows\Panther\RCX46F.tmp	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
File created	C:\Windows\en-US\dllhost.exe	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4732	schtasks.exe
3728	schtasks.exe
4556	schtasks.exe
3352	schtasks.exe
3644	schtasks.exe
2024	schtasks.exe
988	schtasks.exe
2564	schtasks.exe
3328	schtasks.exe
3484	schtasks.exe
2948	schtasks.exe
4900	schtasks.exe
4600	schtasks.exe
3824	schtasks.exe
4196	schtasks.exe
3460	schtasks.exe
3924	schtasks.exe
760	schtasks.exe
3776	schtasks.exe
4136	schtasks.exe
1504	schtasks.exe
3228	schtasks.exe
4112	schtasks.exe
2140	schtasks.exe
4336	schtasks.exe
1772	schtasks.exe
412	schtasks.exe
3156	schtasks.exe
2100	schtasks.exe
4928	schtasks.exe
1548	schtasks.exe
3736	schtasks.exe
1856	schtasks.exe
548	schtasks.exe
700	schtasks.exe
1736	schtasks.exe
2780	schtasks.exe
2760	schtasks.exe
5036	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1284	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	1284	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
Token: SeDebugPrivilege	4148	spoolsv.exe
Token: SeDebugPrivilege	2792	services.exe
Token: SeDebugPrivilege	204	WUDFHost.exe
Token: SeDebugPrivilege	1320	WUDFHost.exe
Token: SeDebugPrivilege	3804	taskhostw.exe
Token: SeDebugPrivilege	3480	services.exe
Token: SeDebugPrivilege	2648	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	4384	RuntimeBroker.exe
Token: SeDebugPrivilege	3920	dllhost.exe
Token: SeDebugPrivilege	2292	Registry.exe
Token: SeDebugPrivilege	2624	services.exe
Token: SeDebugPrivilege	4688	wininit.exe
Token: SeDebugPrivilege	4236	smss.exe
Token: SeDebugPrivilege	964	WUDFHost.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 3480	1284	24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe
"C:\Users\Admin\AppData\Local\Temp\24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Users\Public\Desktop\services.exe
  "C:\Users\Public\Desktop\services.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files\7-Zip\Lang\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files\7-Zip\Lang\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Program Files\VideoLAN\VLC\locale\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\locale\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Program Files\VideoLAN\VLC\locale\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 9 /tr "'C:\Windows\bcastdvr\WUDFHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Windows\bcastdvr\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 12 /tr "'C:\Windows\bcastdvr\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\WUDFHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Users\Default User\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Desktop\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Public\Desktop\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Desktop\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\Panther\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Panther\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Windows\Panther\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Sidebar\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4136

C:\Program Files\7-Zip\Lang\spoolsv.exe
"C:\Program Files\7-Zip\Lang\spoolsv.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Sidebar\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Windows\en-US\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\en-US\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Windows\en-US\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Windows\ModemLogs\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\ModemLogs\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:700

C:\Users\Public\Desktop\services.exe
"C:\Users\Public\Desktop\services.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2792

C:\Users\Default User\WUDFHost.exe
"C:\Users\Default User\WUDFHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Windows\ModemLogs\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Application Data\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Default\Application Data\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:988

C:\Windows\bcastdvr\WUDFHost.exe
"C:\Windows\bcastdvr\WUDFHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Application Data\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 8 /tr "'C:\Windows\Prefetch\ReadyBoot\WUDFHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 5 /tr "'C:\Windows\Prefetch\ReadyBoot\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Recovery\WindowsRE\taskhostw.exe
"C:\Recovery\WindowsRE\taskhostw.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3804

C:\Program Files\VideoLAN\VLC\locale\StartMenuExperienceHost.exe
"C:\Program Files\VideoLAN\VLC\locale\StartMenuExperienceHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2648

C:\Program Files\Windows Sidebar\RuntimeBroker.exe
"C:\Program Files\Windows Sidebar\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4384

C:\Windows\en-US\dllhost.exe
"C:\Windows\en-US\dllhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3920

C:\Windows\ModemLogs\Registry.exe
"C:\Windows\ModemLogs\Registry.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2292

C:\Windows\Panther\smss.exe
"C:\Windows\Panther\smss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4236

C:\Users\Default\Application Data\services.exe
"C:\Users\Default\Application Data\services.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\Recovery\WindowsRE\wininit.exe
"C:\Recovery\WindowsRE\wininit.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4688

C:\Windows\Prefetch\ReadyBoot\WUDFHost.exe
"C:\Windows\Prefetch\ReadyBoot\WUDFHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WUDFHost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WUDFHost.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
TLSH
T1B521CD712376B1D889163F422C5D2A8007BF0335BA50DE1CB9A9725ED9260171F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

WUDFHost.exe

Path C:\Users\Default\WUDFHost.exe
Size 885KB
SHA256 24534827afe179a6e623971fad06df4448a87889f74fb6ca7d920b190b529b37
MD5 e924a577c8f4a3ddc430a04935906172
SHA1 3a9afe5026233457bd7b47431cf91344d44637c3
SHA512 2ae2671816adcaa867c2812e836f5e4d4cf5c3d34ec7ccbea600f966f44d52b4045915e16f46696ec4eb132c9ab19e020f5f9e070d2c094b3d63ab81eaaefc58
SSDEEP 12288:clNE5VnZuh+ZIlXJBH5SP2I/lwvDT77/wOKsV42i3GULVaHeopyyx:clNCv6XJ5BClaXfD9vUha+u
TLSH
T12E1575342EEA102AF173AF7D9AE07596DA6EB6A33707995D00B103C60723B42DDD153E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1284-0-0x0000000000020000-0x0000000000104000-memory.dmp

Download

memory/1284-1-0x000000001AE20000-0x000000001AE30000-memory.dmp

Download

memory/1284-2-0x000000001AE00000-0x000000001AE1C000-memory.dmp

Download

memory/1284-4-0x000000001B230000-0x000000001B240000-memory.dmp

Download

memory/1284-3-0x000000001B280000-0x000000001B2D0000-memory.dmp

Download

memory/1284-5-0x000000001B240000-0x000000001B256000-memory.dmp

Download

memory/1284-9-0x000000001B2E0000-0x000000001B2EC000-memory.dmp

Download

memory/1284-8-0x000000001B2D0000-0x000000001B2D8000-memory.dmp

Download

memory/1284-7-0x000000001B270000-0x000000001B27E000-memory.dmp

Download

memory/1284-6-0x000000001B260000-0x000000001B26A000-memory.dmp

Download