Malware Analysis Report

2025-08-10 21:13

Sample ID 221011-fd3nwsfaa4
Target 06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397
SHA256 06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397
Tags
darkcomet lul persistence rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397

Threat Level: Known bad

The file 06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397 was found to be: Known bad.

Malicious Activity Summary

darkcomet lul persistence rat trojan upx

Darkcomet

Executes dropped EXE

UPX packed file

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

Program crash

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-11 04:46

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-11 04:46

Reported

2022-10-11 06:41

Platform

win7-20220812-en

Max time kernel

153s

Max time network

162s

Command Line

"C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe"

Signatures

Darkcomet

trojan rat darkcomet

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\W7.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\W7.exe" C:\Windows\SysWOW64\reg.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 944 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe
PID 944 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe
PID 944 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe
PID 944 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe
PID 944 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe
PID 944 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe
PID 944 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe
PID 944 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe
PID 944 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe
PID 1324 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe C:\Users\Admin\AppData\Roaming\Windows\W7.exe
PID 1324 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe C:\Users\Admin\AppData\Roaming\Windows\W7.exe
PID 1324 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe C:\Users\Admin\AppData\Roaming\Windows\W7.exe
PID 1324 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe C:\Users\Admin\AppData\Roaming\Windows\W7.exe
PID 572 wrote to memory of 896 N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe C:\Users\Admin\AppData\Roaming\Windows\W7.exe
PID 572 wrote to memory of 896 N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe C:\Users\Admin\AppData\Roaming\Windows\W7.exe
PID 572 wrote to memory of 896 N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe C:\Users\Admin\AppData\Roaming\Windows\W7.exe
PID 572 wrote to memory of 896 N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe C:\Users\Admin\AppData\Roaming\Windows\W7.exe
PID 572 wrote to memory of 896 N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe C:\Users\Admin\AppData\Roaming\Windows\W7.exe
PID 572 wrote to memory of 896 N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe C:\Users\Admin\AppData\Roaming\Windows\W7.exe
PID 572 wrote to memory of 896 N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe C:\Users\Admin\AppData\Roaming\Windows\W7.exe
PID 572 wrote to memory of 896 N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe C:\Users\Admin\AppData\Roaming\Windows\W7.exe
PID 572 wrote to memory of 896 N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe C:\Users\Admin\AppData\Roaming\Windows\W7.exe
PID 572 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe C:\Users\Admin\AppData\Roaming\Windows\W7.exe
PID 572 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe C:\Users\Admin\AppData\Roaming\Windows\W7.exe
PID 572 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe C:\Users\Admin\AppData\Roaming\Windows\W7.exe
PID 572 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe C:\Users\Admin\AppData\Roaming\Windows\W7.exe
PID 572 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe C:\Users\Admin\AppData\Roaming\Windows\W7.exe
PID 572 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe C:\Users\Admin\AppData\Roaming\Windows\W7.exe
PID 572 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe C:\Users\Admin\AppData\Roaming\Windows\W7.exe
PID 572 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe C:\Users\Admin\AppData\Roaming\Windows\W7.exe
PID 896 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe C:\Windows\SysWOW64\bitsadmin.exe
PID 896 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe C:\Windows\SysWOW64\bitsadmin.exe
PID 896 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe C:\Windows\SysWOW64\bitsadmin.exe
PID 896 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe C:\Windows\SysWOW64\bitsadmin.exe
PID 896 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe C:\Windows\SysWOW64\bitsadmin.exe
PID 896 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Roaming\Windows\W7.exe C:\Windows\SysWOW64\bitsadmin.exe
PID 1936 wrote to memory of 1596 N/A C:\Windows\SysWOW64\bitsadmin.exe C:\Windows\SysWOW64\cmd.exe
PID 1936 wrote to memory of 1596 N/A C:\Windows\SysWOW64\bitsadmin.exe C:\Windows\SysWOW64\cmd.exe
PID 1936 wrote to memory of 1596 N/A C:\Windows\SysWOW64\bitsadmin.exe C:\Windows\SysWOW64\cmd.exe
PID 1936 wrote to memory of 1596 N/A C:\Windows\SysWOW64\bitsadmin.exe C:\Windows\SysWOW64\cmd.exe
PID 1596 wrote to memory of 1484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1596 wrote to memory of 1484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1596 wrote to memory of 1484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1596 wrote to memory of 1484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe

"C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe"

C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe

"C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe"

C:\Users\Admin\AppData\Roaming\Windows\W7.exe

"C:\Users\Admin\AppData\Roaming\Windows\W7.exe"

C:\Users\Admin\AppData\Roaming\Windows\W7.exe

"C:\Users\Admin\AppData\Roaming\Windows\W7.exe"

C:\Users\Admin\AppData\Roaming\Windows\W7.exe

"C:\Users\Admin\AppData\Roaming\Windows\W7.exe"

C:\Windows\SysWOW64\bitsadmin.exe

"C:\Windows\system32\bitsadmin.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\MFUEM.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "W7.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows\W7.exe" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 grrr.no-ip.org udp
US 8.8.8.8:53 morans.no-ip.biz udp
US 8.8.8.8:53 morans.no-ip.org udp

Files

memory/944-56-0x00000000008F0000-0x00000000008F4000-memory.dmp

memory/944-73-0x00000000008F0000-0x00000000008F4000-memory.dmp

memory/944-58-0x00000000008F0000-0x00000000008F4000-memory.dmp

memory/944-59-0x00000000008F0000-0x00000000008F4000-memory.dmp

memory/944-60-0x00000000008F0000-0x00000000008F4000-memory.dmp

memory/944-74-0x00000000008F0000-0x00000000008F4000-memory.dmp

memory/944-72-0x00000000008F0000-0x00000000008F4000-memory.dmp

memory/944-71-0x00000000008F0000-0x00000000008F4000-memory.dmp

memory/944-69-0x00000000008F0000-0x00000000008F4000-memory.dmp

memory/944-68-0x00000000008F0000-0x00000000008F4000-memory.dmp

memory/944-67-0x00000000008F0000-0x00000000008F4000-memory.dmp

memory/944-63-0x00000000008F0000-0x00000000008F4000-memory.dmp

memory/944-62-0x00000000008F0000-0x00000000008F4000-memory.dmp

memory/944-75-0x00000000008F7000-0x00000000008F9000-memory.dmp

memory/1324-76-0x0000000000400000-0x0000000000410000-memory.dmp

memory/1324-77-0x0000000000400000-0x0000000000410000-memory.dmp

memory/1324-79-0x0000000000400000-0x0000000000410000-memory.dmp

memory/1324-82-0x0000000000400000-0x0000000000410000-memory.dmp

memory/1324-83-0x0000000000401890-mapping.dmp

memory/1324-87-0x0000000000400000-0x0000000000410000-memory.dmp

memory/1324-88-0x0000000075C61000-0x0000000075C63000-memory.dmp

\Users\Admin\AppData\Roaming\Windows\W7.exe

MD5 d6ad8646b9237750b612819494b04bc0
SHA1 2ad1cf8420648d1e663eec90016fdf02bc4c6c7c
SHA256 bcf353ae39a5c4bb7660c7619fe8b4a6cdc24d4c8809289a4084a7bc859d0446
SHA512 798e3ab5f159a9b92541f29c62b487dab1ea4b6cde187f236ac35fc834a1d49ff75508a5f249fad806bd086fafdcf69b00e928227be82ead4eeccc9480e03b88

\Users\Admin\AppData\Roaming\Windows\W7.exe

MD5 d6ad8646b9237750b612819494b04bc0
SHA1 2ad1cf8420648d1e663eec90016fdf02bc4c6c7c
SHA256 bcf353ae39a5c4bb7660c7619fe8b4a6cdc24d4c8809289a4084a7bc859d0446
SHA512 798e3ab5f159a9b92541f29c62b487dab1ea4b6cde187f236ac35fc834a1d49ff75508a5f249fad806bd086fafdcf69b00e928227be82ead4eeccc9480e03b88

\Users\Admin\AppData\Roaming\Windows\W7.exe

MD5 d6ad8646b9237750b612819494b04bc0
SHA1 2ad1cf8420648d1e663eec90016fdf02bc4c6c7c
SHA256 bcf353ae39a5c4bb7660c7619fe8b4a6cdc24d4c8809289a4084a7bc859d0446
SHA512 798e3ab5f159a9b92541f29c62b487dab1ea4b6cde187f236ac35fc834a1d49ff75508a5f249fad806bd086fafdcf69b00e928227be82ead4eeccc9480e03b88

\Users\Admin\AppData\Roaming\Windows\W7.exe

MD5 d6ad8646b9237750b612819494b04bc0
SHA1 2ad1cf8420648d1e663eec90016fdf02bc4c6c7c
SHA256 bcf353ae39a5c4bb7660c7619fe8b4a6cdc24d4c8809289a4084a7bc859d0446
SHA512 798e3ab5f159a9b92541f29c62b487dab1ea4b6cde187f236ac35fc834a1d49ff75508a5f249fad806bd086fafdcf69b00e928227be82ead4eeccc9480e03b88

\Users\Admin\AppData\Roaming\Windows\W7.exe

MD5 d6ad8646b9237750b612819494b04bc0
SHA1 2ad1cf8420648d1e663eec90016fdf02bc4c6c7c
SHA256 bcf353ae39a5c4bb7660c7619fe8b4a6cdc24d4c8809289a4084a7bc859d0446
SHA512 798e3ab5f159a9b92541f29c62b487dab1ea4b6cde187f236ac35fc834a1d49ff75508a5f249fad806bd086fafdcf69b00e928227be82ead4eeccc9480e03b88

memory/572-94-0x0000000000000000-mapping.dmp

memory/1324-96-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Users\Admin\AppData\Roaming\Windows\W7.exe

MD5 d6ad8646b9237750b612819494b04bc0
SHA1 2ad1cf8420648d1e663eec90016fdf02bc4c6c7c
SHA256 bcf353ae39a5c4bb7660c7619fe8b4a6cdc24d4c8809289a4084a7bc859d0446
SHA512 798e3ab5f159a9b92541f29c62b487dab1ea4b6cde187f236ac35fc834a1d49ff75508a5f249fad806bd086fafdcf69b00e928227be82ead4eeccc9480e03b88

memory/572-99-0x00000000005F7000-0x00000000005F9000-memory.dmp

C:\Users\Admin\AppData\Roaming\Windows\W7.exe

MD5 d6ad8646b9237750b612819494b04bc0
SHA1 2ad1cf8420648d1e663eec90016fdf02bc4c6c7c
SHA256 bcf353ae39a5c4bb7660c7619fe8b4a6cdc24d4c8809289a4084a7bc859d0446
SHA512 798e3ab5f159a9b92541f29c62b487dab1ea4b6cde187f236ac35fc834a1d49ff75508a5f249fad806bd086fafdcf69b00e928227be82ead4eeccc9480e03b88

memory/896-108-0x0000000000401890-mapping.dmp

memory/1480-110-0x0000000000400000-0x00000000004B7000-memory.dmp

C:\Users\Admin\AppData\Roaming\Windows\W7.exe

MD5 d6ad8646b9237750b612819494b04bc0
SHA1 2ad1cf8420648d1e663eec90016fdf02bc4c6c7c
SHA256 bcf353ae39a5c4bb7660c7619fe8b4a6cdc24d4c8809289a4084a7bc859d0446
SHA512 798e3ab5f159a9b92541f29c62b487dab1ea4b6cde187f236ac35fc834a1d49ff75508a5f249fad806bd086fafdcf69b00e928227be82ead4eeccc9480e03b88

memory/1480-112-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/1480-115-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/1480-120-0x0000000000400000-0x00000000004B7000-memory.dmp

C:\Users\Admin\AppData\Roaming\Windows\W7.exe

MD5 d6ad8646b9237750b612819494b04bc0
SHA1 2ad1cf8420648d1e663eec90016fdf02bc4c6c7c
SHA256 bcf353ae39a5c4bb7660c7619fe8b4a6cdc24d4c8809289a4084a7bc859d0446
SHA512 798e3ab5f159a9b92541f29c62b487dab1ea4b6cde187f236ac35fc834a1d49ff75508a5f249fad806bd086fafdcf69b00e928227be82ead4eeccc9480e03b88

memory/1480-118-0x00000000004B5690-mapping.dmp

memory/1480-117-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/896-121-0x0000000000400000-0x0000000000410000-memory.dmp

memory/1480-122-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/1480-124-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/1480-126-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/1480-127-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/1936-128-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\MFUEM.bat

MD5 422f78c09d2fad901947aff10115e540
SHA1 5bc69f68c1d9d6cf46233349c4a5c2a7830592de
SHA256 4ff904ef2cb6d79403ff58feadb91372b4824c851073db1c0b80db53c6beaacd
SHA512 a357b4f7335176150061ac6494e963575f77b3664c4d8b3561860dff7ecfbe4828c1c5feb6c03f5a69c886cfdfa7a2b69e1d199e976603bf62b9c2e11e234a3d

memory/1596-131-0x0000000000000000-mapping.dmp

memory/1484-132-0x0000000000000000-mapping.dmp

memory/896-133-0x0000000000400000-0x0000000000410000-memory.dmp

memory/1480-134-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/1480-135-0x0000000000400000-0x00000000004B7000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-11 04:46

Reported

2022-10-11 06:41

Platform

win10v2004-20220812-en

Max time kernel

142s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe

"C:\Users\Admin\AppData\Local\Temp\06160291415e47db3c11816c825cf81e9d9b709b894342518f67ef52a9826397.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3496 -ip 3496

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 464

Network

Country Destination Domain Proto
US 93.184.220.29:80 tcp
US 93.184.220.29:80 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
US 20.189.173.10:443 tcp
US 8.8.8.8:53 15.89.54.20.in-addr.arpa udp
US 8.8.8.8:53 f.7.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa udp
US 93.184.220.29:80 tcp

Files

memory/3496-134-0x00000000004A2000-0x00000000004A7000-memory.dmp

memory/3496-135-0x00000000004A2000-0x00000000004A7000-memory.dmp

memory/3496-137-0x00000000004A5000-0x00000000004A7000-memory.dmp

memory/3496-136-0x00000000004B1000-0x00000000004B3000-memory.dmp