darkcomet | 0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec

General

Target

0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
Size

683KB
MD5

8bb19f064991f91dca466784b13e2bb3
SHA1

517682367ad7b45ab2f4eba49bff723f033cfc6d
SHA256

0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec
SHA512

0752b19d991542ee5834d62b614ead5cdb90b365a5fed03a830cf57761fc00c6142d40f8f0da1bee0acb90e5f3aed14afdaa25e33b9ad132dbeec1a1c3286beb

Score

10^/10

darkcomet hack evasion persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

hack

C2

dianabol89.zapto.org:1604

Mutex

DC_MUTEX-MJBT6M8

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
qtA8PLYkzZVo
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe

Executes dropped EXE 4 IoCs

Processes:

JQDRLENE.exemsdcsc.exeJQDRLENE.exemsdcsc.exe

pid process

3460 JQDRLENE.exe
208 msdcsc.exe
2124 JQDRLENE.exe
2956 msdcsc.exe
Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

pid	process
3460	JQDRLENE.exe
208	msdcsc.exe
2124	JQDRLENE.exe
2956	msdcsc.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4520-137-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4520-138-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4520-139-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4520-140-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4520-141-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4520-142-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4520-143-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4520-157-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/2956-162-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/2956-163-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/2956-165-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/2956-166-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exemsdcsc.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	msdcsc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

JQDRLENE.exeJQDRLENE.exe

description	pid	process	target process
PID 3460 set thread context of 4520	3460	JQDRLENE.exe	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
PID 2124 set thread context of 2956	2124	JQDRLENE.exe	msdcsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msdcsc.exe

pid process

2956 msdcsc.exe

pid	process
2956	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
Token: SeSecurityPrivilege	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
Token: SeTakeOwnershipPrivilege	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
Token: SeLoadDriverPrivilege	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
Token: SeSystemProfilePrivilege	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
Token: SeSystemtimePrivilege	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
Token: SeProfSingleProcessPrivilege	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
Token: SeIncBasePriorityPrivilege	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
Token: SeCreatePagefilePrivilege	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
Token: SeBackupPrivilege	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
Token: SeRestorePrivilege	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
Token: SeShutdownPrivilege	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
Token: SeDebugPrivilege	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
Token: SeSystemEnvironmentPrivilege	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
Token: SeChangeNotifyPrivilege	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
Token: SeRemoteShutdownPrivilege	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
Token: SeUndockPrivilege	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
Token: SeManageVolumePrivilege	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
Token: SeImpersonatePrivilege	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
Token: SeCreateGlobalPrivilege	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
Token: 33	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
Token: 34	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
Token: 35	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
Token: 36	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
Token: SeIncreaseQuotaPrivilege	2956	msdcsc.exe
Token: SeSecurityPrivilege	2956	msdcsc.exe
Token: SeTakeOwnershipPrivilege	2956	msdcsc.exe
Token: SeLoadDriverPrivilege	2956	msdcsc.exe
Token: SeSystemProfilePrivilege	2956	msdcsc.exe
Token: SeSystemtimePrivilege	2956	msdcsc.exe
Token: SeProfSingleProcessPrivilege	2956	msdcsc.exe
Token: SeIncBasePriorityPrivilege	2956	msdcsc.exe
Token: SeCreatePagefilePrivilege	2956	msdcsc.exe
Token: SeBackupPrivilege	2956	msdcsc.exe
Token: SeRestorePrivilege	2956	msdcsc.exe
Token: SeShutdownPrivilege	2956	msdcsc.exe
Token: SeDebugPrivilege	2956	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	2956	msdcsc.exe
Token: SeChangeNotifyPrivilege	2956	msdcsc.exe
Token: SeRemoteShutdownPrivilege	2956	msdcsc.exe
Token: SeUndockPrivilege	2956	msdcsc.exe
Token: SeManageVolumePrivilege	2956	msdcsc.exe
Token: SeImpersonatePrivilege	2956	msdcsc.exe
Token: SeCreateGlobalPrivilege	2956	msdcsc.exe
Token: 33	2956	msdcsc.exe
Token: 34	2956	msdcsc.exe
Token: 35	2956	msdcsc.exe
Token: 36	2956	msdcsc.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

JQDRLENE.exeJQDRLENE.exemsdcsc.exe

pid process

3460 JQDRLENE.exe
2124 JQDRLENE.exe
2956 msdcsc.exe

pid	process
3460	JQDRLENE.exe
2124	JQDRLENE.exe
2956	msdcsc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exeJQDRLENE.exe0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.execmd.execmd.exemsdcsc.exeJQDRLENE.exemsdcsc.exe

description	pid	process	target process
PID 3488 wrote to memory of 3460	3488	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe	JQDRLENE.exe
PID 3488 wrote to memory of 3460	3488	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe	JQDRLENE.exe
PID 3488 wrote to memory of 3460	3488	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe	JQDRLENE.exe
PID 3460 wrote to memory of 4520	3460	JQDRLENE.exe	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
PID 3460 wrote to memory of 4520	3460	JQDRLENE.exe	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
PID 3460 wrote to memory of 4520	3460	JQDRLENE.exe	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
PID 3460 wrote to memory of 4520	3460	JQDRLENE.exe	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
PID 3460 wrote to memory of 4520	3460	JQDRLENE.exe	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
PID 3460 wrote to memory of 4520	3460	JQDRLENE.exe	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
PID 3460 wrote to memory of 4520	3460	JQDRLENE.exe	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
PID 3460 wrote to memory of 4520	3460	JQDRLENE.exe	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
PID 4520 wrote to memory of 4080	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe	cmd.exe
PID 4520 wrote to memory of 4080	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe	cmd.exe
PID 4520 wrote to memory of 4080	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe	cmd.exe
PID 4520 wrote to memory of 4712	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe	cmd.exe
PID 4520 wrote to memory of 4712	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe	cmd.exe
PID 4520 wrote to memory of 4712	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe	cmd.exe
PID 4520 wrote to memory of 780	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe	notepad.exe
PID 4520 wrote to memory of 780	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe	notepad.exe
PID 4520 wrote to memory of 780	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe	notepad.exe
PID 4520 wrote to memory of 780	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe	notepad.exe
PID 4520 wrote to memory of 780	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe	notepad.exe
PID 4520 wrote to memory of 780	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe	notepad.exe
PID 4520 wrote to memory of 780	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe	notepad.exe
PID 4520 wrote to memory of 780	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe	notepad.exe
PID 4520 wrote to memory of 780	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe	notepad.exe
PID 4520 wrote to memory of 780	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe	notepad.exe
PID 4520 wrote to memory of 780	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe	notepad.exe
PID 4520 wrote to memory of 780	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe	notepad.exe
PID 4520 wrote to memory of 780	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe	notepad.exe
PID 4520 wrote to memory of 780	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe	notepad.exe
PID 4520 wrote to memory of 780	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe	notepad.exe
PID 4520 wrote to memory of 780	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe	notepad.exe
PID 4520 wrote to memory of 780	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe	notepad.exe
PID 4080 wrote to memory of 3312	4080	cmd.exe	attrib.exe
PID 4080 wrote to memory of 3312	4080	cmd.exe	attrib.exe
PID 4080 wrote to memory of 3312	4080	cmd.exe	attrib.exe
PID 4712 wrote to memory of 4092	4712	cmd.exe	attrib.exe
PID 4712 wrote to memory of 4092	4712	cmd.exe	attrib.exe
PID 4712 wrote to memory of 4092	4712	cmd.exe	attrib.exe
PID 4520 wrote to memory of 208	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe	msdcsc.exe
PID 4520 wrote to memory of 208	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe	msdcsc.exe
PID 4520 wrote to memory of 208	4520	0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe	msdcsc.exe
PID 208 wrote to memory of 2124	208	msdcsc.exe	JQDRLENE.exe
PID 208 wrote to memory of 2124	208	msdcsc.exe	JQDRLENE.exe
PID 208 wrote to memory of 2124	208	msdcsc.exe	JQDRLENE.exe
PID 2124 wrote to memory of 2956	2124	JQDRLENE.exe	msdcsc.exe
PID 2124 wrote to memory of 2956	2124	JQDRLENE.exe	msdcsc.exe
PID 2124 wrote to memory of 2956	2124	JQDRLENE.exe	msdcsc.exe
PID 2124 wrote to memory of 2956	2124	JQDRLENE.exe	msdcsc.exe
PID 2124 wrote to memory of 2956	2124	JQDRLENE.exe	msdcsc.exe
PID 2124 wrote to memory of 2956	2124	JQDRLENE.exe	msdcsc.exe
PID 2124 wrote to memory of 2956	2124	JQDRLENE.exe	msdcsc.exe
PID 2124 wrote to memory of 2956	2124	JQDRLENE.exe	msdcsc.exe
PID 2956 wrote to memory of 4636	2956	msdcsc.exe	notepad.exe
PID 2956 wrote to memory of 4636	2956	msdcsc.exe	notepad.exe
PID 2956 wrote to memory of 4636	2956	msdcsc.exe	notepad.exe
PID 2956 wrote to memory of 4636	2956	msdcsc.exe	notepad.exe
PID 2956 wrote to memory of 4636	2956	msdcsc.exe	notepad.exe
PID 2956 wrote to memory of 4636	2956	msdcsc.exe	notepad.exe
PID 2956 wrote to memory of 4636	2956	msdcsc.exe	notepad.exe
PID 2956 wrote to memory of 4636	2956	msdcsc.exe	notepad.exe
PID 2956 wrote to memory of 4636	2956	msdcsc.exe	notepad.exe
PID 2956 wrote to memory of 4636	2956	msdcsc.exe	notepad.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

3312 attrib.exe
4092 attrib.exe

pid	process
3312	attrib.exe
4092	attrib.exe

C:\Users\Admin\AppData\Local\Temp\0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
"C:\Users\Admin\AppData\Local\Temp\0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3488

C:\Users\Admin\AppData\Local\Temp\HWCGYUDD\JQDRLENE.exe
"C:\Users\Admin\AppData\Local\Temp\HWCGYUDD\JQDRLENE.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3460

C:\Users\Admin\AppData\Local\Temp\0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe
"C:\Users\Admin\AppData\Local\Temp\0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe"
3⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4520

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe" +s +h
4⤵
- Suspicious use of WriteProcessMemory
PID:4080

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec.exe" +s +h
5⤵
- Views/modifies file attributes
PID:3312

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
4⤵
- Suspicious use of WriteProcessMemory
PID:4712

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
5⤵
- Views/modifies file attributes
PID:4092

C:\Windows\SysWOW64\notepad.exe
notepad
4⤵
PID:780

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:208

C:\Users\Admin\AppData\Local\Temp\HWCGYUDD\JQDRLENE.exe
"C:\Users\Admin\AppData\Local\Temp\HWCGYUDD\JQDRLENE.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956

C:\Windows\SysWOW64\notepad.exe
notepad
7⤵
PID:4636

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Hidden Files and Directories

2

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Hidden Files and Directories

2

T1158

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HWCGYUDD\JQDRLENE.exe
Filesize
964KB

MD5
2ee38ff20b9d582668d0ff14bde48fcf

SHA1
ccd75e289a21ee01aac4878b248f877115ea5186

SHA256
0df50d6001913e1ff647d4bec049e9806ea1ea4826324ce972e0a8caf5a02873

SHA512
7e7c0ca12c49ef6566198f68b0eb38e8f5dfc307edbfe833781b7c981042390a87cfc00aa13cce8d0db8c49ddff4bba91009d79ff5ec3f0a398925d8c0aa6346

Download Submit
C:\Users\Admin\AppData\Local\Temp\HWCGYUDD\JQDRLENE.exe
Filesize
964KB

MD5
2ee38ff20b9d582668d0ff14bde48fcf

SHA1
ccd75e289a21ee01aac4878b248f877115ea5186

SHA256
0df50d6001913e1ff647d4bec049e9806ea1ea4826324ce972e0a8caf5a02873

SHA512
7e7c0ca12c49ef6566198f68b0eb38e8f5dfc307edbfe833781b7c981042390a87cfc00aa13cce8d0db8c49ddff4bba91009d79ff5ec3f0a398925d8c0aa6346

Download Submit
C:\Users\Admin\AppData\Local\Temp\HWCGYUDD\JQDRLENE.exe
Filesize
964KB

MD5
2ee38ff20b9d582668d0ff14bde48fcf

SHA1
ccd75e289a21ee01aac4878b248f877115ea5186

SHA256
0df50d6001913e1ff647d4bec049e9806ea1ea4826324ce972e0a8caf5a02873

SHA512
7e7c0ca12c49ef6566198f68b0eb38e8f5dfc307edbfe833781b7c981042390a87cfc00aa13cce8d0db8c49ddff4bba91009d79ff5ec3f0a398925d8c0aa6346

Download Submit
C:\Users\Admin\AppData\Local\Temp\HWCGYUDD\JQDRLENE.exe
Filesize
964KB

MD5
2ee38ff20b9d582668d0ff14bde48fcf

SHA1
ccd75e289a21ee01aac4878b248f877115ea5186

SHA256
0df50d6001913e1ff647d4bec049e9806ea1ea4826324ce972e0a8caf5a02873

SHA512
7e7c0ca12c49ef6566198f68b0eb38e8f5dfc307edbfe833781b7c981042390a87cfc00aa13cce8d0db8c49ddff4bba91009d79ff5ec3f0a398925d8c0aa6346

Download Submit
C:\Users\Admin\AppData\Local\Temp\HWCGYUDD\rGwUjG
Filesize
251KB

MD5
89beea19c83fa8ba7869b6218e4d426b

SHA1
3e77050911a80a01f43396306b42bffa7612a0df

SHA256
58a2ef01854c591089a7789f0257796a7c1385bd23fdad621d00ea50ee7de473

SHA512
1e1b4e00f8c221fc8454958b531916b1f990c67074f812528c5fc79e08570a7345ccd9ec589c82e91d0c1ddb4d08c54d49c8bd17eff815a205c7af46b3a1d22d

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
683KB

MD5
8bb19f064991f91dca466784b13e2bb3

SHA1
517682367ad7b45ab2f4eba49bff723f033cfc6d

SHA256
0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec

SHA512
0752b19d991542ee5834d62b614ead5cdb90b365a5fed03a830cf57761fc00c6142d40f8f0da1bee0acb90e5f3aed14afdaa25e33b9ad132dbeec1a1c3286beb

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
683KB

MD5
8bb19f064991f91dca466784b13e2bb3

SHA1
517682367ad7b45ab2f4eba49bff723f033cfc6d

SHA256
0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec

SHA512
0752b19d991542ee5834d62b614ead5cdb90b365a5fed03a830cf57761fc00c6142d40f8f0da1bee0acb90e5f3aed14afdaa25e33b9ad132dbeec1a1c3286beb

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
683KB

MD5
8bb19f064991f91dca466784b13e2bb3

SHA1
517682367ad7b45ab2f4eba49bff723f033cfc6d

SHA256
0aff8ddb4ffe9e66e64bc83259098b2f3cceaea0524bced7751d69f6026195ec

SHA512
0752b19d991542ee5834d62b614ead5cdb90b365a5fed03a830cf57761fc00c6142d40f8f0da1bee0acb90e5f3aed14afdaa25e33b9ad132dbeec1a1c3286beb

Download Submit
memory/208-149-0x0000000000000000-mapping.dmp

Download
memory/780-146-0x0000000000000000-mapping.dmp

Download
memory/2124-152-0x0000000000000000-mapping.dmp

Download
memory/2956-166-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2956-165-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2956-163-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2956-162-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2956-158-0x0000000000000000-mapping.dmp

Download
memory/3312-147-0x0000000000000000-mapping.dmp

Download
memory/3460-130-0x0000000000000000-mapping.dmp

Download
memory/4080-144-0x0000000000000000-mapping.dmp

Download
memory/4092-148-0x0000000000000000-mapping.dmp

Download
memory/4520-141-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4520-138-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4520-137-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4520-157-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4520-142-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4520-136-0x0000000000000000-mapping.dmp

Download
memory/4520-139-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4520-140-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4520-143-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4636-164-0x0000000000000000-mapping.dmp

Download
memory/4712-145-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads