Malware Analysis Report

2025-08-10 21:17

Sample ID 221011-ea1jpadcfr
Target 297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426
SHA256 297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426
Tags
darkcomet cc persistence rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426

Threat Level: Known bad

The file 297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426 was found to be: Known bad.

Malicious Activity Summary

darkcomet cc persistence rat trojan upx

Darkcomet

Executes dropped EXE

UPX packed file

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

Program crash

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-11 03:44

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-11 03:44

Reported

2022-10-11 04:23

Platform

win7-20220812-en

Max time kernel

153s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe"

Signatures

Darkcomet

trojan rat darkcomet

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\TapNet = "C:\\Users\\Admin\\AppData\\Roaming\\tapinterface\\tap.exe" C:\Windows\SysWOW64\reg.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1976 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe
PID 1976 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe
PID 1976 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe
PID 1976 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe
PID 1976 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe
PID 1976 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe
PID 1976 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe
PID 1976 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe
PID 576 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe C:\Windows\SysWOW64\cmd.exe
PID 576 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe C:\Windows\SysWOW64\cmd.exe
PID 576 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe C:\Windows\SysWOW64\cmd.exe
PID 576 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe C:\Windows\SysWOW64\cmd.exe
PID 812 wrote to memory of 2020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 812 wrote to memory of 2020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 812 wrote to memory of 2020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 812 wrote to memory of 2020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 576 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe
PID 576 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe
PID 576 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe
PID 576 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe
PID 920 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe
PID 920 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe
PID 920 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe
PID 920 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe
PID 920 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe
PID 920 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe
PID 920 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe
PID 920 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe
PID 920 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Windows\SysWOW64\svchost.exe
PID 920 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Windows\SysWOW64\svchost.exe
PID 920 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Windows\SysWOW64\svchost.exe
PID 920 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Windows\SysWOW64\svchost.exe
PID 920 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Windows\SysWOW64\svchost.exe
PID 920 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Windows\SysWOW64\svchost.exe
PID 920 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Windows\SysWOW64\svchost.exe
PID 920 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe

"C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe"

C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe

"C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\RNBOW.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TapNet" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe" /f

C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe

"C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe"

C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe

"C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe"

C:\Windows\SysWOW64\svchost.exe

"C:\Windows\system32\svchost.exe"

Network

Country Destination Domain Proto
NL 212.7.192.244:1337 tcp
NL 212.7.192.244:1337 tcp
NL 212.7.192.244:1337 tcp
NL 212.7.192.244:1337 tcp
NL 212.7.192.244:1337 tcp
NL 212.7.192.244:1337 tcp

Files

memory/1976-56-0x00000000008CF000-0x000000000090D000-memory.dmp

\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe

MD5 546c072b018550f4d7d0906a680fd3c0
SHA1 7dd5804dc559699abc96d006c05579eed1f85abe
SHA256 297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426
SHA512 789263c911a0eb94de1125e3cb441476f25eb619d5d966781371e98695a523016c59766252cdd681f8f7bc085894a86213090a89ebf4dd6ef5a324db44fd5b57

memory/576-59-0x0000000000400000-0x000000000040B000-memory.dmp

memory/576-60-0x0000000000400000-0x000000000040B000-memory.dmp

memory/576-62-0x0000000000400000-0x000000000040B000-memory.dmp

memory/576-63-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe

MD5 546c072b018550f4d7d0906a680fd3c0
SHA1 7dd5804dc559699abc96d006c05579eed1f85abe
SHA256 297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426
SHA512 789263c911a0eb94de1125e3cb441476f25eb619d5d966781371e98695a523016c59766252cdd681f8f7bc085894a86213090a89ebf4dd6ef5a324db44fd5b57

memory/576-64-0x00000000004085D0-mapping.dmp

memory/576-67-0x0000000000400000-0x000000000040B000-memory.dmp

memory/576-68-0x0000000000400000-0x000000000040B000-memory.dmp

memory/576-71-0x0000000000400000-0x000000000040B000-memory.dmp

memory/576-72-0x00000000762B1000-0x00000000762B3000-memory.dmp

memory/812-73-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\RNBOW.bat

MD5 517aa80e282d1f1a3ea764d1a5f32ed8
SHA1 990331d6b551d436d81f5aac0914b7ed7fa51136
SHA256 fc1c4d0d8ea5d27476e23c49b7dacd40cd9dac4763303ad838774984a2bdc81d
SHA512 caf370281540e19a15ac5a44204788525fb181f714bf396af2fc3f717e80c132e55e0a0db82e230c8469c29c3ab49f3a697dbb85141201405334b5420540abc7

memory/2020-75-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\tapinterface\tap.exe

MD5 54c1b78ad08f7021e76f924b8566933a
SHA1 25c1d754c0013fc81a11075b64affef6950bc10a
SHA256 67f09ed3a7dec619a9ed55ce22fa4daaec96029d867418e1bed58c9e7d084489
SHA512 38b01ff6e2ccf24a06ad94a90e317f12b21836779568d83b6112f8233783fe6a3d4db1df60ac6c2a5e5738ce8baa84b00f689cb22a53a9414d3e359758bf462e

\Users\Admin\AppData\Roaming\tapinterface\tap.exe

MD5 54c1b78ad08f7021e76f924b8566933a
SHA1 25c1d754c0013fc81a11075b64affef6950bc10a
SHA256 67f09ed3a7dec619a9ed55ce22fa4daaec96029d867418e1bed58c9e7d084489
SHA512 38b01ff6e2ccf24a06ad94a90e317f12b21836779568d83b6112f8233783fe6a3d4db1df60ac6c2a5e5738ce8baa84b00f689cb22a53a9414d3e359758bf462e

\Users\Admin\AppData\Roaming\tapinterface\tap.exe

MD5 54c1b78ad08f7021e76f924b8566933a
SHA1 25c1d754c0013fc81a11075b64affef6950bc10a
SHA256 67f09ed3a7dec619a9ed55ce22fa4daaec96029d867418e1bed58c9e7d084489
SHA512 38b01ff6e2ccf24a06ad94a90e317f12b21836779568d83b6112f8233783fe6a3d4db1df60ac6c2a5e5738ce8baa84b00f689cb22a53a9414d3e359758bf462e

\Users\Admin\AppData\Roaming\tapinterface\tap.exe

MD5 54c1b78ad08f7021e76f924b8566933a
SHA1 25c1d754c0013fc81a11075b64affef6950bc10a
SHA256 67f09ed3a7dec619a9ed55ce22fa4daaec96029d867418e1bed58c9e7d084489
SHA512 38b01ff6e2ccf24a06ad94a90e317f12b21836779568d83b6112f8233783fe6a3d4db1df60ac6c2a5e5738ce8baa84b00f689cb22a53a9414d3e359758bf462e

C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe

MD5 54c1b78ad08f7021e76f924b8566933a
SHA1 25c1d754c0013fc81a11075b64affef6950bc10a
SHA256 67f09ed3a7dec619a9ed55ce22fa4daaec96029d867418e1bed58c9e7d084489
SHA512 38b01ff6e2ccf24a06ad94a90e317f12b21836779568d83b6112f8233783fe6a3d4db1df60ac6c2a5e5738ce8baa84b00f689cb22a53a9414d3e359758bf462e

memory/920-81-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\tapinterface\tap.exe

MD5 54c1b78ad08f7021e76f924b8566933a
SHA1 25c1d754c0013fc81a11075b64affef6950bc10a
SHA256 67f09ed3a7dec619a9ed55ce22fa4daaec96029d867418e1bed58c9e7d084489
SHA512 38b01ff6e2ccf24a06ad94a90e317f12b21836779568d83b6112f8233783fe6a3d4db1df60ac6c2a5e5738ce8baa84b00f689cb22a53a9414d3e359758bf462e

memory/920-85-0x000000000058F000-0x00000000005CD000-memory.dmp

C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe

MD5 54c1b78ad08f7021e76f924b8566933a
SHA1 25c1d754c0013fc81a11075b64affef6950bc10a
SHA256 67f09ed3a7dec619a9ed55ce22fa4daaec96029d867418e1bed58c9e7d084489
SHA512 38b01ff6e2ccf24a06ad94a90e317f12b21836779568d83b6112f8233783fe6a3d4db1df60ac6c2a5e5738ce8baa84b00f689cb22a53a9414d3e359758bf462e

C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe

MD5 54c1b78ad08f7021e76f924b8566933a
SHA1 25c1d754c0013fc81a11075b64affef6950bc10a
SHA256 67f09ed3a7dec619a9ed55ce22fa4daaec96029d867418e1bed58c9e7d084489
SHA512 38b01ff6e2ccf24a06ad94a90e317f12b21836779568d83b6112f8233783fe6a3d4db1df60ac6c2a5e5738ce8baa84b00f689cb22a53a9414d3e359758bf462e

memory/1168-93-0x00000000004085D0-mapping.dmp

memory/1520-100-0x0000000000400000-0x00000000004BB000-memory.dmp

memory/1520-101-0x0000000000400000-0x00000000004BB000-memory.dmp

memory/1168-103-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1520-104-0x0000000000400000-0x00000000004BB000-memory.dmp

memory/1520-105-0x0000000000400000-0x00000000004BB000-memory.dmp

memory/1520-106-0x00000000004B8720-mapping.dmp

memory/1520-107-0x0000000000400000-0x00000000004BB000-memory.dmp

memory/576-108-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1520-111-0x0000000000400000-0x00000000004BB000-memory.dmp

memory/1520-112-0x0000000000400000-0x00000000004BB000-memory.dmp

memory/1520-113-0x0000000000400000-0x00000000004BB000-memory.dmp

memory/1168-114-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1520-115-0x0000000000400000-0x00000000004BB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-11 03:44

Reported

2022-10-11 04:24

Platform

win10v2004-20220901-en

Max time kernel

91s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe"

Signatures

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe

"C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3912 -ip 3912

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 468

Network

Country Destination Domain Proto
US 20.42.65.84:443 tcp
US 52.109.13.64:443 tcp
US 209.197.3.8:80 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
US 209.197.3.8:80 tcp
US 93.184.221.240:80 tcp
NL 104.80.229.204:443 tcp

Files

N/A