dcrat | df15b3ce100c6ea9682e9eb25fdb92810bef746dafa42f69a3fafe6f1e9f27d2

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/10/2026, 08:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
def3.exe
Size 1.2MB
Sample261019-kdk63asybs
SHA256 df15b3ce100c6ea9682e9eb25fdb92810bef746dafa42f69a3fafe6f1e9f27d2
MD5 66c00d59637442cee5b11e378d641fbe
SHA1 5fb47cb4abac5f2b97f2019c860f5ddc55d79cd8
SHA512 70c712b4fa366bcfc95b7f489b29876198c827830b8d4849b25a233b56abf6f6844731769db72deac2dc19a704d6b938f19f640e3b15306a576025a98596f7ba
SSDEEP 24576:OfYOx7M9VNpFm26g1yxPLuuKeGDOdyFg5hEAqOWbAxN3epx:OTorhmVg1yxTuuYDOo+LEANl3eH
TLSH
T1BE45231DF16781ACDD03CAB206EE87B1BA75FC630268573E5340F2284EB1EAD2E4D955
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x001500000001c44b-3.dat	dcrat
behavioral2/files/0x000e00000001c45a-18.dat	dcrat
behavioral2/memory/1500-20-0x0000000000CB0000-0x0000000000D86000-memory.dmp	dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1408	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3924	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1404	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3824	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1836	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3676	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4940	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3768	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4872	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	944	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4860	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4136	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5132	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	932	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	248	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4600	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5516	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4300	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5368	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4132	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4888	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1052	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3324	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3152	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3136	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5416	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6036	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3384	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4452	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3232	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3792	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2532	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6104	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1836	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3196	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5304	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5516	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6008	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6076	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6100	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5416	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5260	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5032	5844	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	5844	schtasks.exe	93

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Default\Documents\My Pictures\winlogon.exe	winlogon.exe
File opened (read-only)	C:\Users\Public\Documents\fontdrvhost.exe	fontdrvhost.exe

Executes dropped EXE 21 IoCs

pid	Process
5620	6x8z7c1xe8pq.exe
1500	fontsavescrt.exe
2664	Idle.exe
1560	System.exe
5964	Idle.exe
6072	dllhost.exe
2900	dllhost.exe
5412	sppsvc.exe
4896	RuntimeBroker.exe
1592	WUDFHost.exe
4568	dllhost.exe
5816	upfc.exe
1088	sihost.exe
2292	spoolsv.exe
4320	winlogon.exe
2836	fontdrvhost.exe
1876	Registry.exe
5408	fontdrvhost.exe
4796	RuntimeBroker.exe
1140	RuntimeBroker.exe
3008	sihost.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1208	WScript.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Defender Advanced Threat Protection\it-IT\6ccacd8608530f	fontsavescrt.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\sihost.exe	fontsavescrt.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\66fc9ff0ee96c2	fontsavescrt.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\upfc.exe	fontsavescrt.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\ea1d8f6d871115	fontsavescrt.exe
File created	C:\Program Files\VideoLAN\VLC\lua\extensions\Registry.exe	fontsavescrt.exe
File created	C:\Program Files\VideoLAN\VLC\lua\extensions\ee2ad38f3d4382	fontsavescrt.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\it-IT\Idle.exe	fontsavescrt.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\RemotePackages\RemoteDesktops\dllhost.exe	fontsavescrt.exe
File created	C:\Windows\RemotePackages\RemoteDesktops\5940a34987c991	fontsavescrt.exe
File created	C:\Windows\GameBarPresenceWriter\WUDFHost.exe	fontsavescrt.exe
File created	C:\Windows\GameBarPresenceWriter\480b7989c529f6	fontsavescrt.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\sppsvc.exe	fontsavescrt.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\0a1fd5f707cd16	fontsavescrt.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RuntimeBroker.exe	fontsavescrt.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\9e8d7a4ca61bd9	fontsavescrt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2288	cmd.exe
1136	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fontsavescrt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fontsavescrt.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6x8z7c1xe8pq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings	6x8z7c1xe8pq.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings	fontsavescrt.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1688	schtasks.exe
4940	schtasks.exe
3768	schtasks.exe
4136	schtasks.exe
248	schtasks.exe
5516	schtasks.exe
4132	schtasks.exe
4888	schtasks.exe
1408	schtasks.exe
4860	schtasks.exe
5132	schtasks.exe
6036	schtasks.exe
1836	schtasks.exe
6008	schtasks.exe
944	schtasks.exe
4300	schtasks.exe
5368	schtasks.exe
3384	schtasks.exe
8	schtasks.exe
6076	schtasks.exe
2660	schtasks.exe
5032	schtasks.exe
2884	schtasks.exe
2652	schtasks.exe
2064	schtasks.exe
2532	schtasks.exe
6104	schtasks.exe
5304	schtasks.exe
4924	schtasks.exe
1508	schtasks.exe
6100	schtasks.exe
5416	schtasks.exe
2896	schtasks.exe
3824	schtasks.exe
4872	schtasks.exe
4600	schtasks.exe
3136	schtasks.exe
1292	schtasks.exe
4452	schtasks.exe
3232	schtasks.exe
5516	schtasks.exe
1404	schtasks.exe
1064	schtasks.exe
3676	schtasks.exe
932	schtasks.exe
3152	schtasks.exe
5416	schtasks.exe
3792	schtasks.exe
5260	schtasks.exe
1052	schtasks.exe
3324	schtasks.exe
3196	schtasks.exe
3924	schtasks.exe
1836	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1500	fontsavescrt.exe
1500	fontsavescrt.exe
1500	fontsavescrt.exe
1500	fontsavescrt.exe
1500	fontsavescrt.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1500	fontsavescrt.exe
Token: SeDebugPrivilege	2664	Idle.exe
Token: SeDebugPrivilege	1560	System.exe
Token: SeDebugPrivilege	5964	Idle.exe
Token: SeDebugPrivilege	6072	dllhost.exe
Token: SeDebugPrivilege	5412	sppsvc.exe
Token: SeDebugPrivilege	4896	RuntimeBroker.exe
Token: SeDebugPrivilege	1592	WUDFHost.exe
Token: SeDebugPrivilege	4568	dllhost.exe
Token: SeDebugPrivilege	5816	upfc.exe
Token: SeDebugPrivilege	2292	spoolsv.exe
Token: SeDebugPrivilege	1088	sihost.exe
Token: SeDebugPrivilege	4320	winlogon.exe
Token: SeDebugPrivilege	2836	fontdrvhost.exe
Token: SeDebugPrivilege	1876	Registry.exe
Token: SeDebugPrivilege	5408	fontdrvhost.exe
Token: SeDebugPrivilege	4796	RuntimeBroker.exe
Token: SeDebugPrivilege	1140	RuntimeBroker.exe
Token: SeDebugPrivilege	3008	sihost.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 5620	4948	def3.exe	88
PID 5620 wrote to memory of 1208	5620	6x8z7c1xe8pq.exe	89
PID 1208 wrote to memory of 2288	1208	WScript.exe	90
PID 2288 wrote to memory of 1500	2288	cmd.exe	92
PID 1500 wrote to memory of 1136	1500	fontsavescrt.exe	181
PID 1136 wrote to memory of 5172	1136	cmd.exe	186
PID 1136 wrote to memory of 3008	1136	cmd.exe	187

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\def3.exe
"C:\Users\Admin\AppData\Local\Temp\def3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Users\Admin\AppData\Local\Temp\6x8z7c1xe8pq.exe
  "C:\Users\Admin\AppData\Local\Temp\6x8z7c1xe8pq.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5620
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Blockweb\pJr1aIP55RA.vbe"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1208
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Blockweb\YqiMeLyV76jO5n9.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2288
    - - C:\Blockweb\fontsavescrt.exe
        
        "C:\Blockweb\fontsavescrt.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Reads the TCP/IP host and domain name from the registry
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1500
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\q8g6VZoNFW.bat"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1136
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:5172
        
        C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\sihost.exe
        
        "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\sihost.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\PrintHood\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\PrintHood\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\PrintHood\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Windows\RemotePackages\RemoteDesktops\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteDesktops\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\RemotePackages\RemoteDesktops\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\it-IT\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\it-IT\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\it-IT\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 7 /tr "'C:\Windows\GameBarPresenceWriter\WUDFHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Windows\GameBarPresenceWriter\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 7 /tr "'C:\Windows\GameBarPresenceWriter\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows.old\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows.old\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows.old\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1508

C:\Users\Admin\PrintHood\Idle.exe
"C:\Users\Admin\PrintHood\Idle.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5516

C:\Recovery\WindowsRE\System.exe
"C:\Recovery\WindowsRE\System.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Blockweb\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5368

C:\Program Files\Windows Defender Advanced Threat Protection\it-IT\Idle.exe
"C:\Program Files\Windows Defender Advanced Threat Protection\it-IT\Idle.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5964

C:\Windows\RemotePackages\RemoteDesktops\dllhost.exe
"C:\Windows\RemotePackages\RemoteDesktops\dllhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Blockweb\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Blockweb\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1292

C:\Windows.old\dllhost.exe
"C:\Windows.old\dllhost.exe"
1⤵
- Executes dropped EXE
PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5416

C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\sppsvc.exe
"C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\sppsvc.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6036

C:\Users\Default User\RuntimeBroker.exe
"C:\Users\Default User\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3384

C:\Windows\GameBarPresenceWriter\WUDFHost.exe
"C:\Windows\GameBarPresenceWriter\WUDFHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Documents\My Pictures\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default\Documents\My Pictures\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3232

C:\Blockweb\dllhost.exe
"C:\Blockweb\dllhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Documents\My Pictures\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Program Files\VideoLAN\VLC\lua\extensions\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2532

C:\Program Files (x86)\Windows NT\TableTextService\en-US\upfc.exe
"C:\Program Files (x86)\Windows NT\TableTextService\en-US\upfc.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\lua\extensions\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6104

C:\Recovery\WindowsRE\spoolsv.exe
"C:\Recovery\WindowsRE\spoolsv.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2292

C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\sihost.exe
"C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\sihost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Program Files\VideoLAN\VLC\lua\extensions\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Windows.old\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows.old\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Windows.old\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6076

C:\Users\Default\Documents\My Pictures\winlogon.exe
"C:\Users\Default\Documents\My Pictures\winlogon.exe"
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4320

C:\Windows.old\fontdrvhost.exe
"C:\Windows.old\fontdrvhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Blockweb\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6100

C:\Program Files\VideoLAN\VLC\lua\extensions\Registry.exe
"C:\Program Files\VideoLAN\VLC\lua\extensions\Registry.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Blockweb\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Blockweb\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Documents\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Public\Documents\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Documents\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2896

C:\Users\Public\Documents\fontdrvhost.exe
"C:\Users\Public\Documents\fontdrvhost.exe"
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5408

C:\Blockweb\RuntimeBroker.exe
"C:\Blockweb\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4796

C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RuntimeBroker.exe
"C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

YqiMeLyV76jO5n9.bat

Path C:\Blockweb\YqiMeLyV76jO5n9.bat
Size 30B
SHA256 d2f40d725ceb4a2c6527f491907e2bc566e9b87985fa8e51ad5fa593c57fab76
MD5 65bc2eb1ccf52d9f0ef142b00fc85f39
SHA1 54d4ce52ce3aa78a83fa5868eb2b46ecd083d945
SHA512 c6c446e6e88b482fb7963398853a42c520a8b39d4953d38595be53c62b99a0e6a23b7f3a3ee10fc8cad70992c6abe802b0d554b8fa27eb9cc8f015a35c9db07c
MD5 SHA1 SHA512

Submit Download

fontsavescrt.exe

Path C:\Blockweb\fontsavescrt.exe
Size 829KB
SHA256 209c63b44ac512c5e34b1ebb5d6a48357f6e198304e24c6066ce75079acb25fd
MD5 1ba70e3a8536a06f7ae432e4f624df17
SHA1 dcadc8c9d0a968df1934a214636995258474018e
SHA512 5c00a2ae748ce4a3123fe62cda8dc4cd79fd8e45ad3599450999f0bf2393f1265e03771c9996cfde8d656177f8a8269c31aa2ea9b098e615bd1365aba59c1ab0
SSDEEP 12288:CSuBevgIuFYu5F4yaFvBaSAfASUQoGrQf5aSKw7dQo5T:mevgZFYu5AvBaSFwMfX7dQIT
TLSH
T12505F701BE44CE51F0091633C3EF554987B4AC5166A6E32B7DBA3BAE15123AB3D0D9CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pJr1aIP55RA.vbe

Path C:\Blockweb\pJr1aIP55RA.vbe
Size 200B
SHA256 8e5c1ab3346542db7c3ea6ac4a2bd6b10806dc306d92d1ce723ba12238022d20
MD5 6f139b49709f2ff7104adac3c690eb89
SHA1 73d5518821b6021b0961ddd0d4f10d0b8a0eab44
SHA512 857236f5ddea694a512c857af9dabffb74074178437e80a2ab2dbcfeafac48fad532cf31e76d2171cd6db8c30f5357335d999a5346eaef30d2c9a44059a3af57
TLSH
T168D0233C555FB3E4CD1545D6C351C42D1ED15FD46A415761446CD4479440476345C369
MD5 SHA1 SHA512 TLSH

Submit Download

6x8z7c1xe8pq.exe

Path C:\Users\Admin\AppData\Local\Temp\6x8z7c1xe8pq.exe
Size 1.1MB
SHA256 0e1231bec4b939654f3a58620b46fb26c47d6297001d91a81d71e166341777c8
MD5 0cd50c1ac5ffdb2370637d71ec954d3c
SHA1 62ada4db7a2071b1b5c621328f68fcad128da5a0
SHA512 08e8ae0773b4a4bf4f2bdde0ee5cfa22a2153aeb8ab5d0cadfe093fee6a6e9904f60a20a245c4ae42414afd995f5145e37b35ba86f301ce7546fa5bc9a0f5705
SSDEEP 24576:U2G/nvxW3Ww0tYevgZFYu5AvBaSFwMfX7dQITA:UbA30rEZArwJ
TLSH
T1CE454A01BE44CA11F0181633C3FF550487B4AC506AA6E72B7EB93B6E55223977D1DACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

q8g6VZoNFW.bat

Path C:\Users\Admin\AppData\Local\Temp\q8g6VZoNFW.bat
Size 235B
SHA256 7a9f30a7b8c1cc3ae3b272128ea12a799d8e4f3a22a7d7bad9ad1465678b422f
MD5 b06525723f1a0a13df1422225e67b1a9
SHA1 8e0d5a95516dd8713e87f06107711d7d319c8e2b
SHA512 92f6ad5a053518a71dd0abf4614af75793c45862a7867820a214f35b024b53acd189b68772162c3fc338fd358719739ad98ea45c7c22d501ba3fccf049388025
TLSH
T165D02301E300C78700332C8A0F2D154C70230C5D73C05DB00BCA0459DA8B87EF19F2C1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1500-20-0x0000000000CB0000-0x0000000000D86000-memory.dmp

Download

memory/4948-15-0x00007FF680090000-0x00007FF6800A5000-memory.dmp

Download