CrystalX RAT cmd.exe spawned from CrystalX temp payload

Daniel Jeremiah@daniyyell

•updated Jun 2, 2026•2•0•12

Detects the execution of cmd.exe when it is spawned by a temporary executable named 'svcXXX.exe' (where XXX is a 3 to 6 digit number) located in the user's AppData\Local\Temp directory. This pattern is indicative of the CrystalX RAT's behavior.