darkcomet | c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9

General

Target

c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe
Size

932KB
MD5

1dc80685c258916d30f9bf2365d76ff5
SHA1

bc0111105913d61308b5164833d31574d0391543
SHA256

c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9
SHA512

7bf344038fc679919f30f93070c666c5409d76f81b8a79cf6aeda9d356ad7b9b570de0e994b4dd20096e3b3869b63ad496361f08bbd24eaa3eea6580aa965ba2

Score

10^/10

darkcomet test server persistence rat spyware stealer trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Test Server

C2

127.0.0.1:1604

Mutex

DC_MUTEX-4XKPULH

Attributes

gencode
LBSgYfRa7QDe
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

STEWART LOGO.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	STEWART LOGO.EXE

Executes dropped EXE 6 IoCs

Processes:

taskmgr.exeSTEWART LOGO.EXESTEWART LOGO.EXEsvchost.comnotepad.exesvchost.com

pid process

3016 taskmgr.exe
760 STEWART LOGO.EXE
1016 STEWART LOGO.EXE
652 svchost.com
912 notepad.exe
2336 svchost.com
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3016	taskmgr.exe
760	STEWART LOGO.EXE
1016	STEWART LOGO.EXE
652	svchost.com
912	notepad.exe
2336	svchost.com

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\chrome.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\facebook.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\facebook.exe"	reg.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exeSTEWART LOGO.EXE

description	pid	process	target process
PID 2880 set thread context of 3016	2880	c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe	taskmgr.exe
PID 1016 set thread context of 912	1016	STEWART LOGO.EXE	notepad.exe

Drops file in Program Files directory 64 IoCs

Processes:

STEWART LOGO.EXEsvchost.com

description	ioc	process
File opened for modification	C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~4.EXE	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\Google\Update\1335~1.452\GOF5E2~1.EXE	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~2\WinMail.exe	svchost.com
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	svchost.com
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\Google\Chrome\APPLIC~1\830410~1.106\CHROME~1.EXE	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\Google\Chrome\APPLIC~1\chrome.exe	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\Google\Update\1335~1.452\GO664E~1.EXE	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\WINDOW~2\WinMail.exe	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\Google\Temp\GUM3D84.tmp\GOFB2B~1.EXE	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~3.EXE	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~2.EXE	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\Google\Chrome\APPLIC~1\830410~1.106\INSTAL~1\setup.exe	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	svchost.com
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1335~1.452\GOFB2B~1.EXE	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	svchost.com
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\Google\Chrome\APPLIC~1\830410~1.106\NOTIFI~1.EXE	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\Google\Chrome\APPLIC~1\830410~1.106\INSTAL~1\chrmstp.exe	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~1.EXE	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	STEWART LOGO.EXE
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	STEWART LOGO.EXE

Drops file in Windows directory 5 IoCs

Processes:

svchost.comsvchost.comSTEWART LOGO.EXE

description	ioc	process
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\svchost.com	STEWART LOGO.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

STEWART LOGO.EXESTEWART LOGO.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	STEWART LOGO.EXE
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings	STEWART LOGO.EXE

Modifies registry key 1 TTPs 2 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exe

pid process

3932 reg.exe
1340 reg.exe

pid	process
3932	reg.exe
1340	reg.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

Processes:

c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exeSTEWART LOGO.EXEnotepad.exe

description	pid	process
Token: SeDebugPrivilege	2880	c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe
Token: SeDebugPrivilege	1016	STEWART LOGO.EXE
Token: SeIncreaseQuotaPrivilege	912	notepad.exe
Token: SeSecurityPrivilege	912	notepad.exe
Token: SeTakeOwnershipPrivilege	912	notepad.exe
Token: SeLoadDriverPrivilege	912	notepad.exe
Token: SeSystemProfilePrivilege	912	notepad.exe
Token: SeSystemtimePrivilege	912	notepad.exe
Token: SeProfSingleProcessPrivilege	912	notepad.exe
Token: SeIncBasePriorityPrivilege	912	notepad.exe
Token: SeCreatePagefilePrivilege	912	notepad.exe
Token: SeBackupPrivilege	912	notepad.exe
Token: SeRestorePrivilege	912	notepad.exe
Token: SeShutdownPrivilege	912	notepad.exe
Token: SeDebugPrivilege	912	notepad.exe
Token: SeSystemEnvironmentPrivilege	912	notepad.exe
Token: SeChangeNotifyPrivilege	912	notepad.exe
Token: SeRemoteShutdownPrivilege	912	notepad.exe
Token: SeUndockPrivilege	912	notepad.exe
Token: SeManageVolumePrivilege	912	notepad.exe
Token: SeImpersonatePrivilege	912	notepad.exe
Token: SeCreateGlobalPrivilege	912	notepad.exe
Token: 33	912	notepad.exe
Token: 34	912	notepad.exe
Token: 35	912	notepad.exe
Token: 36	912	notepad.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

notepad.exe

pid process

912 notepad.exe

pid	process
912	notepad.exe

Suspicious use of WriteProcessMemory 54 IoCs

Processes:

c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.execmd.exetaskmgr.exeSTEWART LOGO.EXESTEWART LOGO.EXEsvchost.comcmd.exesvchost.comcmd.exe

description	pid	process	target process
PID 2880 wrote to memory of 3884	2880	c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe	cmd.exe
PID 2880 wrote to memory of 3884	2880	c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe	cmd.exe
PID 2880 wrote to memory of 3884	2880	c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe	cmd.exe
PID 3884 wrote to memory of 3932	3884	cmd.exe	reg.exe
PID 3884 wrote to memory of 3932	3884	cmd.exe	reg.exe
PID 3884 wrote to memory of 3932	3884	cmd.exe	reg.exe
PID 2880 wrote to memory of 3016	2880	c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe	taskmgr.exe
PID 2880 wrote to memory of 3016	2880	c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe	taskmgr.exe
PID 2880 wrote to memory of 3016	2880	c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe	taskmgr.exe
PID 2880 wrote to memory of 3016	2880	c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe	taskmgr.exe
PID 2880 wrote to memory of 3016	2880	c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe	taskmgr.exe
PID 2880 wrote to memory of 3016	2880	c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe	taskmgr.exe
PID 2880 wrote to memory of 3016	2880	c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe	taskmgr.exe
PID 2880 wrote to memory of 3016	2880	c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe	taskmgr.exe
PID 2880 wrote to memory of 3016	2880	c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe	taskmgr.exe
PID 2880 wrote to memory of 3016	2880	c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe	taskmgr.exe
PID 3016 wrote to memory of 760	3016	taskmgr.exe	STEWART LOGO.EXE
PID 3016 wrote to memory of 760	3016	taskmgr.exe	STEWART LOGO.EXE
PID 3016 wrote to memory of 760	3016	taskmgr.exe	STEWART LOGO.EXE
PID 760 wrote to memory of 1016	760	STEWART LOGO.EXE	STEWART LOGO.EXE
PID 760 wrote to memory of 1016	760	STEWART LOGO.EXE	STEWART LOGO.EXE
PID 760 wrote to memory of 1016	760	STEWART LOGO.EXE	STEWART LOGO.EXE
PID 1016 wrote to memory of 652	1016	STEWART LOGO.EXE	svchost.com
PID 1016 wrote to memory of 652	1016	STEWART LOGO.EXE	svchost.com
PID 1016 wrote to memory of 652	1016	STEWART LOGO.EXE	svchost.com
PID 652 wrote to memory of 860	652	svchost.com	cmd.exe
PID 652 wrote to memory of 860	652	svchost.com	cmd.exe
PID 652 wrote to memory of 860	652	svchost.com	cmd.exe
PID 1016 wrote to memory of 912	1016	STEWART LOGO.EXE	notepad.exe
PID 1016 wrote to memory of 912	1016	STEWART LOGO.EXE	notepad.exe
PID 1016 wrote to memory of 912	1016	STEWART LOGO.EXE	notepad.exe
PID 1016 wrote to memory of 912	1016	STEWART LOGO.EXE	notepad.exe
PID 1016 wrote to memory of 912	1016	STEWART LOGO.EXE	notepad.exe
PID 1016 wrote to memory of 912	1016	STEWART LOGO.EXE	notepad.exe
PID 1016 wrote to memory of 912	1016	STEWART LOGO.EXE	notepad.exe
PID 1016 wrote to memory of 912	1016	STEWART LOGO.EXE	notepad.exe
PID 1016 wrote to memory of 912	1016	STEWART LOGO.EXE	notepad.exe
PID 1016 wrote to memory of 912	1016	STEWART LOGO.EXE	notepad.exe
PID 1016 wrote to memory of 912	1016	STEWART LOGO.EXE	notepad.exe
PID 1016 wrote to memory of 912	1016	STEWART LOGO.EXE	notepad.exe
PID 1016 wrote to memory of 912	1016	STEWART LOGO.EXE	notepad.exe
PID 1016 wrote to memory of 912	1016	STEWART LOGO.EXE	notepad.exe
PID 860 wrote to memory of 1340	860	cmd.exe	reg.exe
PID 860 wrote to memory of 1340	860	cmd.exe	reg.exe
PID 860 wrote to memory of 1340	860	cmd.exe	reg.exe
PID 1016 wrote to memory of 2336	1016	STEWART LOGO.EXE	svchost.com
PID 1016 wrote to memory of 2336	1016	STEWART LOGO.EXE	svchost.com
PID 1016 wrote to memory of 2336	1016	STEWART LOGO.EXE	svchost.com
PID 2336 wrote to memory of 3680	2336	svchost.com	cmd.exe
PID 2336 wrote to memory of 3680	2336	svchost.com	cmd.exe
PID 2336 wrote to memory of 3680	2336	svchost.com	cmd.exe
PID 3680 wrote to memory of 2692	3680	cmd.exe	choice.exe
PID 3680 wrote to memory of 2692	3680	cmd.exe	choice.exe
PID 3680 wrote to memory of 2692	3680	cmd.exe	choice.exe

C:\Users\Admin\AppData\Local\Temp\c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe
"C:\Users\Admin\AppData\Local\Temp\c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /V chrome.exe /T REG_SZ /D C:\Users\Admin\AppData\Local\Temp\chrome.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:3884

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /V chrome.exe /T REG_SZ /D C:\Users\Admin\AppData\Local\Temp\chrome.exe
3⤵
- Adds Run key to start application
- Modifies registry key
PID:3932

C:\Users\Admin\AppData\Local\Temp\taskmgr.exe
C:\Users\Admin\AppData\Local\Temp\taskmgr.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016

C:\Users\Admin\AppData\Local\Temp\STEWART LOGO.EXE
"C:\Users\Admin\AppData\Local\Temp\STEWART LOGO.EXE"
3⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:760

C:\Users\Admin\AppData\Local\Temp\3582-490\STEWART LOGO.EXE
"C:\Users\Admin\AppData\Local\Temp\3582-490\STEWART LOGO.EXE"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1016

C:\Windows\svchost.com
"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /V facebook.exe /T REG_SZ /D C:\Users\Admin\AppData\Local\Temp\facebook.exe
5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:652

C:\Windows\SysWOW64\cmd.exe
C:\Windows\System32\cmd.exe /C REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /V facebook.exe /T REG_SZ /D C:\Users\Admin\AppData\Local\Temp\facebook.exe
6⤵
- Suspicious use of WriteProcessMemory
PID:860

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /V facebook.exe /T REG_SZ /D C:\Users\Admin\AppData\Local\Temp\facebook.exe
7⤵
- Adds Run key to start application
- Modifies registry key
PID:1340

C:\Users\Admin\AppData\Local\Temp\notepad.exe
C:\Users\Admin\AppData\Local\Temp\notepad.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:912

C:\Windows\svchost.com
"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del C:\Users\Admin\AppData\Local\Temp\3582-490\STEWART LOGO.EXE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2336

C:\Windows\SysWOW64\cmd.exe
C:\Windows\System32\cmd.exe /C choice /C Y /N /D Y /T 3 & Del C:\Users\Admin\AppData\Local\Temp\3582-490\STEWART LOGO.EXE
6⤵
- Suspicious use of WriteProcessMemory
PID:3680

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
7⤵
PID:2692

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE

Download Submit
C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE

Download Submit
C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe

Download Submit
C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe

Download Submit
C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe

Download Submit
C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe

Download Submit
C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE

Download Submit
C:\PROGRA~2\Google\Chrome\APPLIC~1\830410~1.106\CHROME~1.EXE

Download Submit
C:\PROGRA~2\Google\Chrome\APPLIC~1\830410~1.106\ELEVAT~1.EXE

Download Submit
C:\PROGRA~2\Google\Chrome\APPLIC~1\830410~1.106\INSTAL~1\chrmstp.exe

Download Submit
C:\PROGRA~2\Google\Chrome\APPLIC~1\830410~1.106\INSTAL~1\setup.exe

Download Submit
C:\PROGRA~2\Google\Chrome\APPLIC~1\830410~1.106\NOTIFI~1.EXE

Download Submit
C:\PROGRA~2\Google\Chrome\APPLIC~1\CHROME~1.EXE

Download Submit
C:\PROGRA~2\Google\Chrome\APPLIC~1\chrome.exe

Download Submit
C:\PROGRA~2\Google\Temp\GUM3D84.tmp\GOFB2B~1.EXE

Download Submit
C:\PROGRA~2\Google\Update\1335~1.452\GO664E~1.EXE

Download Submit
C:\PROGRA~2\Google\Update\1335~1.452\GOBD5D~1.EXE

Download Submit
C:\PROGRA~2\Google\Update\1335~1.452\GOF5E2~1.EXE

Download Submit
C:\PROGRA~2\Google\Update\1335~1.452\GOFB2B~1.EXE

Download Submit
C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~1.EXE

Download Submit
C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~2.EXE

Download Submit
C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~3.EXE

Download Submit
C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~4.EXE

Download Submit
C:\PROGRA~2\Google\Update\DISABL~1.EXE

Download Submit
C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE

Download Submit
C:\PROGRA~2\MOZILL~1\UNINST~1.EXE

Download Submit
C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe

Download Submit
C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE

Download Submit
C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE

Download Submit
C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE

Download Submit
C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE

Download Submit
C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\181510~1.001\FILECO~1.EXE

Download Submit
C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\181510~1.001\FILESY~1.EXE

Download Submit
C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\ONEDRI~1.EXE

Download Submit
C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\OneDrive.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\STEWART LOGO.EXE

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\STEWART LOGO.EXE

Download Submit
C:\Users\Admin\AppData\Local\Temp\STEWART LOGO.EXE

Download Submit
C:\Users\Admin\AppData\Local\Temp\STEWART LOGO.EXE

Download Submit
C:\Users\Admin\AppData\Local\Temp\facebook.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\notepad.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\notepad.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\taskmgr.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\taskmgr.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5023.tmp

Download Submit
C:\Windows\directx.sys

Download Submit
C:\Windows\svchost.com

Download Submit
C:\Windows\svchost.com

Download Submit
C:\Windows\svchost.com

Download Submit
C:\odt\OFFICE~1.EXE

Download Submit
memory/652-13-0x0000000000000000-mapping.dmp

Download
memory/760-7-0x0000000000000000-mapping.dmp

Download
memory/860-17-0x0000000000000000-mapping.dmp

Download
memory/912-18-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/912-23-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/912-20-0x000000000048F888-mapping.dmp

Download
memory/1016-10-0x0000000000000000-mapping.dmp

Download
memory/1340-24-0x0000000000000000-mapping.dmp

Download
memory/2336-75-0x0000000000000000-mapping.dmp

Download
memory/2692-79-0x0000000000000000-mapping.dmp

Download
memory/3016-2-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/3016-3-0x0000000000403248-mapping.dmp

Download
memory/3016-6-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/3680-78-0x0000000000000000-mapping.dmp

Download
memory/3884-0-0x0000000000000000-mapping.dmp

Download
memory/3932-1-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads