Malware Analysis Report

2025-08-10 21:14

Sample ID 221011-csnazaagb8
Target e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755
SHA256 e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755
Tags
darkcomet sality backdoor evasion persistence rat spyware stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755

Threat Level: Known bad

The file e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755 was found to be: Known bad.

Malicious Activity Summary

darkcomet sality backdoor evasion persistence rat spyware stealer trojan upx

Modifies security service

Darkcomet

Modifies WinLogon for persistence

Windows security bypass

Modifies firewall policy service

UAC bypass

Sality

Darkcomet family

Disables Task Manager via registry modification

UPX packed file

Executes dropped EXE

Disables RegEdit via registry modification

Reads local data of messenger clients

Reads user/profile data of web browsers

Checks BIOS information in registry

Windows security modification

Reads data files stored by FTP clients

Deletes itself

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Enumerates connected drives

Checks whether UAC is enabled

Drops autorun.inf file

Suspicious use of SetThreadContext

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System policy modification

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-11 02:20

Signatures

Darkcomet family

darkcomet

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-11 02:20

Reported

2022-10-11 03:17

Platform

win7-20220812-en

Max time kernel

151s

Max time network

65s

Command Line

"taskhost.exe"

Signatures

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Windows\SysWOW64\notepad.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\notepad.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\notepad.exe N/A

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" C:\Windows\SysWOW64\explorer.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\notepad.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\notepad.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\notepad.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\notepad.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\notepad.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\notepad.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\notepad.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" C:\Windows\SysWOW64\notepad.exe N/A

Disables Task Manager via registry modification

evasion

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Windows\SysWOW64\explorer.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A

Reads data files stored by FTP clients

spyware stealer

Reads local data of messenger clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" C:\Windows\SysWOW64\notepad.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\G: C:\Windows\SysWOW64\notepad.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\notepad.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\notepad.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\notepad.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\notepad.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\notepad.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\notepad.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\notepad.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\notepad.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\notepad.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\notepad.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\notepad.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\notepad.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\notepad.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\notepad.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\notepad.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\notepad.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A
File opened (read-only) \??\F: C:\Windows\SysWOW64\notepad.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\notepad.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\notepad.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\notepad.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\notepad.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\autorun.inf C:\Windows\SysWOW64\notepad.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1988 set thread context of 1020 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\explorer.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe C:\Windows\SysWOW64\notepad.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\SysWOW64\explorer.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1988 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 1988 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 1988 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 1988 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 1988 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 1988 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 1988 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 1988 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 1988 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 1988 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 1988 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 1988 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 1988 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 1988 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 1988 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 1988 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 1988 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 1988 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 1988 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 1988 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 1988 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 1988 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 1988 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 1988 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 1988 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE
PID 1988 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE
PID 1988 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE
PID 1988 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE
PID 1488 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE C:\Windows\system32\taskhost.exe
PID 1488 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE C:\Windows\system32\Dwm.exe
PID 1488 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE C:\Windows\Explorer.EXE
PID 1488 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe
PID 1488 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe
PID 1488 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE C:\Windows\SysWOW64\notepad.exe
PID 1488 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE C:\Windows\SysWOW64\notepad.exe
PID 1988 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\explorer.exe
PID 1988 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\explorer.exe
PID 1988 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\explorer.exe
PID 1988 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\explorer.exe
PID 1988 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\explorer.exe
PID 1988 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\explorer.exe
PID 1020 wrote to memory of 1704 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1020 wrote to memory of 1704 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1020 wrote to memory of 1704 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1020 wrote to memory of 1704 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1020 wrote to memory of 1704 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1020 wrote to memory of 1704 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1020 wrote to memory of 1704 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1020 wrote to memory of 1704 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1020 wrote to memory of 1704 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1020 wrote to memory of 1704 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1020 wrote to memory of 1704 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1020 wrote to memory of 1704 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1020 wrote to memory of 1704 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1020 wrote to memory of 1704 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1020 wrote to memory of 1704 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1020 wrote to memory of 1704 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1020 wrote to memory of 1704 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1020 wrote to memory of 1704 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1020 wrote to memory of 1704 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1020 wrote to memory of 1704 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1020 wrote to memory of 1704 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1020 wrote to memory of 1704 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 1020 wrote to memory of 1704 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A

Processes

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe

"C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE

"C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE"

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SysWOW64\explorer.exe

"C:\Windows\SysWOW64\explorer.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 wateen.myvnc.com udp

Files

memory/1988-54-0x0000000075281000-0x0000000075283000-memory.dmp

memory/1744-55-0x0000000000000000-mapping.dmp

C:\Windupdt\winupdate.exe

MD5 2914671203fb9f6cd43c3a1890e62199
SHA1 206b053743f43a8be9db38af1400ffa8b517af77
SHA256 ef9340ae3695ac3cb6baacfce55c11a267f65a5d942b0de15e2bf211ff89759f
SHA512 d3b15fbf34ff5e8a3cf06276f8e75c9fa95e025510328c848f2746bcbc3c604e3ab3fdd4655c475067d6ab8cfeb7d8c9f0947829ce56c5b5ad449ce59e50b0d2

C:\Windupdt\winupdate.exe

MD5 6a13bb213fda4f15b7e4cc48a83dd368
SHA1 eea95805b5c0fef042c8fc59efe5aa30598db37d
SHA256 e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755
SHA512 262d590269985b9f2f0cda5228c308e04ea10d2d5b8d6f7b448879b32c6fc4f3130187512c2986a736917e10c7f4f4b569cd9147c0490e5f5128c80b6bb2565a

C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE

MD5 e6e858b315cc3cad4f6772c3ce7799c9
SHA1 2e3ded63d9c8259b0df043892b7a8003d4dc00ee
SHA256 761c8164a97f4fe2370ca5579f65b6d352408ff21979bb1fb2a1f2aaede5b168
SHA512 00f75b0e169bafb2441b81bc92437f4382e063d8c7c47269786693dec7511f126baa61de365454c92e0b4a7a50a93914eaa4d0ea5ed744fa315096807918a4ae

memory/1488-61-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\SVCHOST.EXE

MD5 e6e858b315cc3cad4f6772c3ce7799c9
SHA1 2e3ded63d9c8259b0df043892b7a8003d4dc00ee
SHA256 761c8164a97f4fe2370ca5579f65b6d352408ff21979bb1fb2a1f2aaede5b168
SHA512 00f75b0e169bafb2441b81bc92437f4382e063d8c7c47269786693dec7511f126baa61de365454c92e0b4a7a50a93914eaa4d0ea5ed744fa315096807918a4ae

\Users\Admin\AppData\Local\Temp\SVCHOST.EXE

MD5 e6e858b315cc3cad4f6772c3ce7799c9
SHA1 2e3ded63d9c8259b0df043892b7a8003d4dc00ee
SHA256 761c8164a97f4fe2370ca5579f65b6d352408ff21979bb1fb2a1f2aaede5b168
SHA512 00f75b0e169bafb2441b81bc92437f4382e063d8c7c47269786693dec7511f126baa61de365454c92e0b4a7a50a93914eaa4d0ea5ed744fa315096807918a4ae

memory/1488-64-0x0000000001E30000-0x0000000002EBE000-memory.dmp

memory/1988-65-0x0000000003200000-0x0000000003269000-memory.dmp

memory/1488-66-0x0000000000400000-0x0000000000469000-memory.dmp

memory/1488-67-0x0000000001E30000-0x0000000002EBE000-memory.dmp

memory/1488-68-0x00000000003D0000-0x00000000003D2000-memory.dmp

memory/1988-69-0x00000000031E0000-0x0000000003E2A000-memory.dmp

memory/1744-70-0x0000000000230000-0x0000000000232000-memory.dmp

memory/1020-71-0x0000000013140000-0x0000000013263000-memory.dmp

memory/1020-73-0x0000000013140000-0x0000000013263000-memory.dmp

memory/1020-74-0x00000000131D08B4-mapping.dmp

memory/1020-75-0x0000000013140000-0x0000000013263000-memory.dmp

memory/1020-77-0x0000000013140000-0x0000000013263000-memory.dmp

memory/1988-78-0x00000000031E0000-0x00000000031EF000-memory.dmp

memory/1704-79-0x0000000000000000-mapping.dmp

memory/1020-81-0x0000000013140000-0x0000000013263000-memory.dmp

memory/1020-82-0x00000000003B0000-0x00000000003B2000-memory.dmp

memory/1704-83-0x0000000000240000-0x0000000000242000-memory.dmp

memory/1488-84-0x0000000001E30000-0x0000000002EBE000-memory.dmp

memory/1488-85-0x00000000003D0000-0x00000000003D2000-memory.dmp

memory/1020-86-0x00000000003B0000-0x00000000003B2000-memory.dmp

memory/1488-87-0x0000000000400000-0x0000000000469000-memory.dmp

memory/1488-88-0x0000000001E30000-0x0000000002EBE000-memory.dmp

memory/1744-89-0x0000000002F70000-0x0000000003FFE000-memory.dmp

C:\Windows\SYSTEM.INI

MD5 16ef19c01dc6c22d9b4d9e5dc2378689
SHA1 bf089e76a2d6713c8b4997ae3c22639ec41395f1
SHA256 ae182f2ae9b4a6da3aea14e0a856eeccd586d5da61c524357204c05055e5ad01
SHA512 8d5f25643b56a3840001479114edf82ffc9fb8409d7692c05f916e2186dc83d718599ea22ca7df8c296f2ece3ae11d4d54b8fa0038a556717fbd572edbe89b09

memory/1744-91-0x0000000002F70000-0x0000000003FFE000-memory.dmp

memory/1744-92-0x0000000002F70000-0x0000000003FFE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE

MD5 e6e858b315cc3cad4f6772c3ce7799c9
SHA1 2e3ded63d9c8259b0df043892b7a8003d4dc00ee
SHA256 761c8164a97f4fe2370ca5579f65b6d352408ff21979bb1fb2a1f2aaede5b168
SHA512 00f75b0e169bafb2441b81bc92437f4382e063d8c7c47269786693dec7511f126baa61de365454c92e0b4a7a50a93914eaa4d0ea5ed744fa315096807918a4ae

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-11 02:20

Reported

2022-10-11 03:18

Platform

win10v2004-20220812-en

Max time kernel

170s

Max time network

175s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe"

Signatures

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" C:\Windows\SysWOW64\explorer.exe N/A

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" C:\Windows\SysWOW64\explorer.exe N/A

Sality

backdoor sality

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Windows\SysWOW64\explorer.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads local data of messenger clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" C:\Windows\SysWOW64\notepad.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3872 set thread context of 4320 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\explorer.exe

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3872 wrote to memory of 712 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 3872 wrote to memory of 712 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 3872 wrote to memory of 712 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 3872 wrote to memory of 712 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 3872 wrote to memory of 712 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 3872 wrote to memory of 712 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 3872 wrote to memory of 712 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 3872 wrote to memory of 712 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 3872 wrote to memory of 712 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 3872 wrote to memory of 712 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 3872 wrote to memory of 712 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 3872 wrote to memory of 712 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 3872 wrote to memory of 712 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 3872 wrote to memory of 712 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 3872 wrote to memory of 712 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 3872 wrote to memory of 712 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 3872 wrote to memory of 712 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 3872 wrote to memory of 712 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 3872 wrote to memory of 712 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 3872 wrote to memory of 712 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 3872 wrote to memory of 712 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 3872 wrote to memory of 712 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 3872 wrote to memory of 712 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\notepad.exe
PID 3872 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE
PID 3872 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE
PID 3872 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE
PID 3872 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\explorer.exe
PID 3872 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\explorer.exe
PID 3872 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\explorer.exe
PID 3872 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\explorer.exe
PID 3872 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe C:\Windows\SysWOW64\explorer.exe
PID 4320 wrote to memory of 2908 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 4320 wrote to memory of 2908 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 4320 wrote to memory of 2908 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 4320 wrote to memory of 2908 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 4320 wrote to memory of 2908 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 4320 wrote to memory of 2908 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 4320 wrote to memory of 2908 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 4320 wrote to memory of 2908 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 4320 wrote to memory of 2908 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 4320 wrote to memory of 2908 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 4320 wrote to memory of 2908 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 4320 wrote to memory of 2908 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 4320 wrote to memory of 2908 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 4320 wrote to memory of 2908 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 4320 wrote to memory of 2908 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 4320 wrote to memory of 2908 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 4320 wrote to memory of 2908 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 4320 wrote to memory of 2908 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 4320 wrote to memory of 2908 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 4320 wrote to memory of 2908 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 4320 wrote to memory of 2908 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 4320 wrote to memory of 2908 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe

"C:\Users\Admin\AppData\Local\Temp\e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755.exe"

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE

"C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE"

C:\Windows\SysWOW64\explorer.exe

"C:\Windows\SysWOW64\explorer.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 wateen.myvnc.com udp
US 8.8.8.8:53 wateen.myvnc.com udp
IE 13.69.239.72:443 tcp
US 8.8.8.8:53 wateen.myvnc.com udp
US 8.8.8.8:53 wateen.myvnc.com udp
US 8.8.8.8:53 wateen.myvnc.com udp
US 8.8.8.8:53 164.2.77.40.in-addr.arpa udp
US 8.8.8.8:53 wateen.myvnc.com udp
US 8.8.8.8:53 wateen.myvnc.com udp
US 8.8.8.8:53 wateen.myvnc.com udp
US 8.8.8.8:53 wateen.myvnc.com udp
US 8.8.8.8:53 d.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.5.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa udp
US 8.8.8.8:53 wateen.myvnc.com udp
US 8.8.8.8:53 wateen.myvnc.com udp
US 8.8.8.8:53 wateen.myvnc.com udp
US 8.8.8.8:53 wateen.myvnc.com udp
US 8.8.8.8:53 wateen.myvnc.com udp
US 8.8.8.8:53 wateen.myvnc.com udp
US 8.8.8.8:53 wateen.myvnc.com udp
US 8.8.8.8:53 wateen.myvnc.com udp
US 8.8.8.8:53 wateen.myvnc.com udp
US 8.8.8.8:53 wateen.myvnc.com udp
US 8.8.8.8:53 wateen.myvnc.com udp
US 8.8.8.8:53 wateen.myvnc.com udp
US 8.8.8.8:53 wateen.myvnc.com udp
US 8.8.8.8:53 wateen.myvnc.com udp
US 8.8.8.8:53 wateen.myvnc.com udp
US 8.8.8.8:53 wateen.myvnc.com udp
US 8.8.8.8:53 wateen.myvnc.com udp
US 8.8.8.8:53 wateen.myvnc.com udp
US 8.8.8.8:53 wateen.myvnc.com udp
US 8.8.8.8:53 wateen.myvnc.com udp

Files

memory/712-132-0x0000000000000000-mapping.dmp

C:\Windupdt\winupdate.exe

MD5 6a13bb213fda4f15b7e4cc48a83dd368
SHA1 eea95805b5c0fef042c8fc59efe5aa30598db37d
SHA256 e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755
SHA512 262d590269985b9f2f0cda5228c308e04ea10d2d5b8d6f7b448879b32c6fc4f3130187512c2986a736917e10c7f4f4b569cd9147c0490e5f5128c80b6bb2565a

C:\Windupdt\winupdate.exe

MD5 6a13bb213fda4f15b7e4cc48a83dd368
SHA1 eea95805b5c0fef042c8fc59efe5aa30598db37d
SHA256 e16a28f0876c0eab8e70ee7d7453c358396e577fbf83d12e05cd638289f56755
SHA512 262d590269985b9f2f0cda5228c308e04ea10d2d5b8d6f7b448879b32c6fc4f3130187512c2986a736917e10c7f4f4b569cd9147c0490e5f5128c80b6bb2565a

memory/380-135-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE

MD5 e6e858b315cc3cad4f6772c3ce7799c9
SHA1 2e3ded63d9c8259b0df043892b7a8003d4dc00ee
SHA256 761c8164a97f4fe2370ca5579f65b6d352408ff21979bb1fb2a1f2aaede5b168
SHA512 00f75b0e169bafb2441b81bc92437f4382e063d8c7c47269786693dec7511f126baa61de365454c92e0b4a7a50a93914eaa4d0ea5ed744fa315096807918a4ae

C:\Users\Admin\AppData\Local\Temp\SVCHOST.EXE

MD5 e6e858b315cc3cad4f6772c3ce7799c9
SHA1 2e3ded63d9c8259b0df043892b7a8003d4dc00ee
SHA256 761c8164a97f4fe2370ca5579f65b6d352408ff21979bb1fb2a1f2aaede5b168
SHA512 00f75b0e169bafb2441b81bc92437f4382e063d8c7c47269786693dec7511f126baa61de365454c92e0b4a7a50a93914eaa4d0ea5ed744fa315096807918a4ae

memory/380-138-0x00000000024E0000-0x000000000356E000-memory.dmp

memory/380-139-0x0000000000400000-0x0000000000469000-memory.dmp

memory/4320-140-0x0000000000000000-mapping.dmp

memory/4320-141-0x0000000013140000-0x0000000013263000-memory.dmp

memory/4320-142-0x0000000013140000-0x0000000013263000-memory.dmp

memory/4320-143-0x0000000013140000-0x0000000013263000-memory.dmp

memory/2908-144-0x0000000000000000-mapping.dmp

memory/4320-145-0x0000000013140000-0x0000000013263000-memory.dmp

memory/4320-146-0x0000000013140000-0x0000000013263000-memory.dmp