c2187e67fa488c35774a01ad87eeed302ea8ac0553155cae33b044d34455882f | Triage

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
19-07-2022 09:43

Sharing

Report Analysis Logs

General

Target

DARKCOMET 5.3.1 Fixed/DARKCOMET 5.3.1/Celesty Binder/Celesty.exe
Size

2.7MB
MD5

c3009ee63bc661d9ea75eaeb256448ca
SHA1

45eb01150756df432e25eed44d976442473356de
SHA256

0bb88564a22bfd6d9ad6e4d8efa9077792a7b6094c2a0f865d70c43e11507352
SHA512

96f5847fbeef95df1309e97a4bc3d786a5f5c19b87e804f12d88b4473a0b50291c40407a3d95a2d5d78031f03be76da47f1846a73c7802ddae46a38ac4634e67

Score

1^/10

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Celesty.exe

pid process

764 Celesty.exe
764 Celesty.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Celesty.exe

pid process

764 Celesty.exe
764 Celesty.exe

C:\Users\Admin\AppData\Local\Temp\DARKCOMET 5.3.1 Fixed\DARKCOMET 5.3.1\Celesty Binder\Celesty.exe
"C:\Users\Admin\AppData\Local\Temp\DARKCOMET 5.3.1 Fixed\DARKCOMET 5.3.1\Celesty Binder\Celesty.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:764

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/764-54-0x00000000754B1000-0x00000000754B3000-memory.dmp

Filesize
8KB

Download