Malware Analysis Report

2025-08-10 21:13

Sample ID 221011-gzw9nshhgr
Target fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e
SHA256 fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e
Tags
darkcomet online persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e

Threat Level: Known bad

The file fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e was found to be: Known bad.

Malicious Activity Summary

darkcomet online persistence rat trojan

Modifies WinLogon for persistence

Darkcomet

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-11 06:15

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-11 06:15

Reported

2022-10-11 07:49

Platform

win10v2004-20220901-en

Max time kernel

150s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe"

Signatures

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 920 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe
PID 920 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe
PID 920 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe
PID 920 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe
PID 920 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe
PID 920 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe
PID 920 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe
PID 920 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe
PID 920 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe
PID 920 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe
PID 920 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe
PID 920 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe
PID 920 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe
PID 4492 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
PID 4492 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
PID 4492 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
PID 3380 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
PID 3380 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
PID 3380 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
PID 3380 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
PID 3380 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
PID 3380 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
PID 3380 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
PID 3380 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
PID 3380 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
PID 3380 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
PID 3380 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
PID 3380 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
PID 3380 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
PID 3192 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 3192 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 3192 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 3192 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 3192 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 3192 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 3192 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 3192 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 3192 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 3192 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 3192 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 3192 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 3192 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 3192 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 3192 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 3192 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 3192 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 3192 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 3192 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 3192 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 3192 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 3192 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe

"C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe"

C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe

C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe

C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe

"C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"

C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe

C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe

C:\Windows\SysWOW64\notepad.exe

notepad

Network

Country Destination Domain Proto
US 8.8.8.8:53 nomsrat.sytes.net udp
US 8.8.8.8:53 nomsrat.sytes.net udp
US 8.8.8.8:53 nomsrat.sytes.net udp
US 20.42.65.84:443 tcp
US 8.8.8.8:53 nomsrat.sytes.net udp
US 8.8.8.8:53 nomsrat.sytes.net udp
US 8.8.8.8:53 nomsrat.sytes.net udp
US 8.8.8.8:53 nomsrat.sytes.net udp
US 8.8.8.8:53 nomsrat.sytes.net udp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
US 8.8.8.8:53 nomsrat.sytes.net udp
US 8.8.8.8:53 nomsrat.sytes.net udp
US 8.8.8.8:53 nomsrat.sytes.net udp
US 8.8.8.8:53 nomsrat.sytes.net udp
US 8.8.8.8:53 nomsrat.sytes.net udp
US 93.184.221.240:80 tcp
US 8.8.8.8:53 nomsrat.sytes.net udp
US 8.8.8.8:53 nomsrat.sytes.net udp
NL 104.80.229.204:443 tcp
US 8.8.8.8:53 nomsrat.sytes.net udp
US 8.8.8.8:53 nomsrat.sytes.net udp
US 8.8.8.8:53 nomsrat.sytes.net udp
US 8.8.8.8:53 nomsrat.sytes.net udp
US 8.8.8.8:53 nomsrat.sytes.net udp
US 8.8.8.8:53 nomsrat.sytes.net udp
US 8.8.8.8:53 nomsrat.sytes.net udp
US 8.8.8.8:53 nomsrat.sytes.net udp
US 8.8.8.8:53 nomsrat.sytes.net udp
US 8.8.8.8:53 nomsrat.sytes.net udp
US 8.8.8.8:53 nomsrat.sytes.net udp
US 8.8.8.8:53 nomsrat.sytes.net udp
US 8.8.8.8:53 nomsrat.sytes.net udp
US 8.8.8.8:53 nomsrat.sytes.net udp
US 8.8.8.8:53 nomsrat.sytes.net udp

Files

memory/4492-132-0x0000000000000000-mapping.dmp

memory/4492-133-0x0000000000400000-0x00000000004CA000-memory.dmp

memory/4492-134-0x0000000000400000-0x00000000004CA000-memory.dmp

memory/4492-135-0x0000000000400000-0x00000000004CA000-memory.dmp

memory/4492-136-0x0000000000400000-0x00000000004CA000-memory.dmp

memory/3380-137-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe

MD5 60be5a06e0c4b00ba862f92c7e2b0a45
SHA1 4a4b2ea657429c71f83aeb054b0c91ef73a6fa80
SHA256 fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e
SHA512 9f4706ee20226ec48b997ed8beaad277a05045fcfb8ace9c25f49b4c71e7fe8cfa2335af93258c0f6c1028622a53ccfe237a3dcf4e2f3d0bf00f712cecea787a

C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe

MD5 60be5a06e0c4b00ba862f92c7e2b0a45
SHA1 4a4b2ea657429c71f83aeb054b0c91ef73a6fa80
SHA256 fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e
SHA512 9f4706ee20226ec48b997ed8beaad277a05045fcfb8ace9c25f49b4c71e7fe8cfa2335af93258c0f6c1028622a53ccfe237a3dcf4e2f3d0bf00f712cecea787a

memory/3192-140-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe

MD5 60be5a06e0c4b00ba862f92c7e2b0a45
SHA1 4a4b2ea657429c71f83aeb054b0c91ef73a6fa80
SHA256 fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e
SHA512 9f4706ee20226ec48b997ed8beaad277a05045fcfb8ace9c25f49b4c71e7fe8cfa2335af93258c0f6c1028622a53ccfe237a3dcf4e2f3d0bf00f712cecea787a

memory/3504-145-0x0000000000000000-mapping.dmp

memory/3192-146-0x0000000000400000-0x00000000004CA000-memory.dmp

memory/3192-147-0x0000000000400000-0x00000000004CA000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-11 06:15

Reported

2022-10-11 07:50

Platform

win7-20220812-en

Max time kernel

40s

Max time network

44s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe

"C:\Users\Admin\AppData\Local\Temp\fb4cd6a6485ddf6c6f0325e6b795cfd85d24ac962b025c7b4d70d8c265e8591e.exe"

Network

N/A

Files

N/A