Malware Analysis Report

2025-08-10 21:13

Sample ID 221011-ha4g5aaedq
Target ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81
SHA256 ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81
Tags
darkcomet riotpointbeggers evasion persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81

Threat Level: Known bad

The file ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81 was found to be: Known bad.

Malicious Activity Summary

darkcomet riotpointbeggers evasion persistence rat trojan

Darkcomet

Modifies WinLogon for persistence

Sets file to hidden

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Windows directory

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Views/modifies file attributes

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Modifies registry class

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-11 06:32

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-11 06:32

Reported

2022-10-11 08:15

Platform

win7-20220901-en

Max time kernel

45s

Max time network

49s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe"

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe

"C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe"

Network

N/A

Files

memory/1048-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

memory/1048-55-0x00000000001D0000-0x00000000001D4000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-11 06:32

Reported

2022-10-11 08:14

Platform

win10v2004-20220812-en

Max time kernel

153s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe"

Signatures

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\SysAdmin\\windesk.exe" C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysAdmin\windesk.exe N/A
N/A N/A C:\Windows\SysAdmin\windesk.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rundll32 = "C:\\Windows\\SysAdmin\\windesk.exe" C:\Windows\SysAdmin\windesk.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rundll32 = "C:\\Windows\\SysAdmin\\windesk.exe" C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SysAdmin\ C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A
File opened for modification C:\Windows\SysAdmin\windesk.exe C:\Windows\SysAdmin\windesk.exe N/A
File created C:\Windows\SysAdmin\windesk.exe C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A
File opened for modification C:\Windows\SysAdmin\windesk.exe C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysAdmin\windesk.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysAdmin\windesk.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysAdmin\windesk.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysAdmin\windesk.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysAdmin\windesk.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysAdmin\windesk.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysAdmin\windesk.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysAdmin\windesk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysAdmin\windesk.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysAdmin\windesk.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysAdmin\windesk.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysAdmin\windesk.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysAdmin\windesk.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysAdmin\windesk.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysAdmin\windesk.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysAdmin\windesk.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysAdmin\windesk.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysAdmin\windesk.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysAdmin\windesk.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysAdmin\windesk.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysAdmin\windesk.exe N/A
Token: 33 N/A C:\Windows\SysAdmin\windesk.exe N/A
Token: 34 N/A C:\Windows\SysAdmin\windesk.exe N/A
Token: 35 N/A C:\Windows\SysAdmin\windesk.exe N/A
Token: 36 N/A C:\Windows\SysAdmin\windesk.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5068 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe
PID 5068 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe
PID 5068 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe
PID 5068 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe
PID 5068 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe
PID 5068 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe
PID 5068 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe
PID 5068 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe
PID 5068 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe
PID 5068 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe
PID 5068 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe
PID 5068 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe
PID 5068 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe
PID 5068 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe
PID 4904 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe C:\Windows\SysWOW64\cmd.exe
PID 4904 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe C:\Windows\SysWOW64\cmd.exe
PID 4904 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe C:\Windows\SysWOW64\cmd.exe
PID 4904 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe C:\Windows\SysWOW64\cmd.exe
PID 4904 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe C:\Windows\SysWOW64\cmd.exe
PID 4904 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe C:\Windows\SysWOW64\cmd.exe
PID 4640 wrote to memory of 4296 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1268 wrote to memory of 1132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4640 wrote to memory of 4296 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1268 wrote to memory of 1132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4640 wrote to memory of 4296 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1268 wrote to memory of 1132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4904 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe C:\Windows\SysAdmin\windesk.exe
PID 4904 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe C:\Windows\SysAdmin\windesk.exe
PID 4904 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe C:\Windows\SysAdmin\windesk.exe
PID 4820 wrote to memory of 3436 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysAdmin\windesk.exe
PID 4820 wrote to memory of 3436 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysAdmin\windesk.exe
PID 4820 wrote to memory of 3436 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysAdmin\windesk.exe
PID 4820 wrote to memory of 3436 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysAdmin\windesk.exe
PID 4820 wrote to memory of 3436 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysAdmin\windesk.exe
PID 4820 wrote to memory of 3436 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysAdmin\windesk.exe
PID 4820 wrote to memory of 3436 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysAdmin\windesk.exe
PID 4820 wrote to memory of 3436 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysAdmin\windesk.exe
PID 4820 wrote to memory of 3436 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysAdmin\windesk.exe
PID 4820 wrote to memory of 3436 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysAdmin\windesk.exe
PID 4820 wrote to memory of 3436 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysAdmin\windesk.exe
PID 4820 wrote to memory of 3436 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysAdmin\windesk.exe
PID 4820 wrote to memory of 3436 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysAdmin\windesk.exe
PID 4820 wrote to memory of 3436 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysAdmin\windesk.exe
PID 3436 wrote to memory of 320 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysWOW64\notepad.exe
PID 3436 wrote to memory of 320 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysWOW64\notepad.exe
PID 3436 wrote to memory of 320 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysWOW64\notepad.exe
PID 3436 wrote to memory of 320 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysWOW64\notepad.exe
PID 3436 wrote to memory of 320 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysWOW64\notepad.exe
PID 3436 wrote to memory of 320 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysWOW64\notepad.exe
PID 3436 wrote to memory of 320 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysWOW64\notepad.exe
PID 3436 wrote to memory of 320 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysWOW64\notepad.exe
PID 3436 wrote to memory of 320 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysWOW64\notepad.exe
PID 3436 wrote to memory of 320 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysWOW64\notepad.exe
PID 3436 wrote to memory of 320 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysWOW64\notepad.exe
PID 3436 wrote to memory of 320 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysWOW64\notepad.exe
PID 3436 wrote to memory of 320 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysWOW64\notepad.exe
PID 3436 wrote to memory of 320 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysWOW64\notepad.exe
PID 3436 wrote to memory of 320 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysWOW64\notepad.exe
PID 3436 wrote to memory of 320 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysWOW64\notepad.exe
PID 3436 wrote to memory of 320 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysWOW64\notepad.exe
PID 3436 wrote to memory of 320 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysWOW64\notepad.exe
PID 3436 wrote to memory of 320 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysWOW64\notepad.exe
PID 3436 wrote to memory of 320 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysWOW64\notepad.exe
PID 3436 wrote to memory of 320 N/A C:\Windows\SysAdmin\windesk.exe C:\Windows\SysWOW64\notepad.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe

"C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe"

C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe

C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe" +s +h

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Users\Admin\AppData\Local\Temp\ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Users\Admin\AppData\Local\Temp" +s +h

C:\Windows\SysAdmin\windesk.exe

"C:\Windows\SysAdmin\windesk.exe"

C:\Windows\SysAdmin\windesk.exe

C:\Windows\SysAdmin\windesk.exe

C:\Windows\SysWOW64\notepad.exe

notepad

Network

Country Destination Domain Proto
US 93.184.220.29:80 tcp
NL 95.101.78.82:80 tcp
NL 104.80.225.205:443 tcp
N/A 127.0.0.1:6514 tcp
US 8.8.8.8:53 darkscouting.no-ip.biz udp
N/A 127.0.0.1:6514 tcp
N/A 127.0.0.1:6514 tcp
US 8.8.8.8:53 darkscouting.no-ip.biz udp
N/A 127.0.0.1:6514 tcp
N/A 127.0.0.1:6514 tcp
N/A 127.0.0.1:6514 tcp
US 8.8.8.8:53 darkscouting.no-ip.biz udp
N/A 127.0.0.1:6514 tcp
N/A 127.0.0.1:6514 tcp
US 8.8.8.8:53 darkscouting.no-ip.biz udp
N/A 127.0.0.1:6514 tcp
N/A 127.0.0.1:6514 tcp
US 8.8.8.8:53 darkscouting.no-ip.biz udp
N/A 127.0.0.1:6514 tcp
N/A 127.0.0.1:6514 tcp
US 8.8.8.8:53 darkscouting.no-ip.biz udp
N/A 127.0.0.1:6514 tcp
N/A 127.0.0.1:6514 tcp
US 8.8.8.8:53 darkscouting.no-ip.biz udp
N/A 127.0.0.1:6514 tcp
US 93.184.221.240:80 tcp
N/A 127.0.0.1:6514 tcp
N/A 127.0.0.1:6514 tcp
US 8.8.8.8:53 darkscouting.no-ip.biz udp
N/A 127.0.0.1:6514 tcp
N/A 127.0.0.1:6514 tcp
US 8.8.8.8:53 darkscouting.no-ip.biz udp
N/A 127.0.0.1:6514 tcp
N/A 127.0.0.1:6514 tcp
US 8.8.8.8:53 darkscouting.no-ip.biz udp
N/A 127.0.0.1:6514 tcp
N/A 127.0.0.1:6514 tcp
US 8.8.8.8:53 darkscouting.no-ip.biz udp
N/A 127.0.0.1:6514 tcp
N/A 127.0.0.1:6514 tcp
US 8.8.8.8:53 darkscouting.no-ip.biz udp
N/A 127.0.0.1:6514 tcp
N/A 127.0.0.1:6514 tcp
US 8.8.8.8:53 darkscouting.no-ip.biz udp
N/A 127.0.0.1:6514 tcp
N/A 127.0.0.1:6514 tcp
N/A 127.0.0.1:6514 tcp
US 8.8.8.8:53 darkscouting.no-ip.biz udp
N/A 127.0.0.1:6514 tcp
N/A 127.0.0.1:6514 tcp
US 8.8.8.8:53 darkscouting.no-ip.biz udp
N/A 127.0.0.1:6514 tcp
N/A 127.0.0.1:6514 tcp
US 8.8.8.8:53 darkscouting.no-ip.biz udp
N/A 127.0.0.1:6514 tcp
N/A 127.0.0.1:6514 tcp
US 8.8.8.8:53 darkscouting.no-ip.biz udp
N/A 127.0.0.1:6514 tcp
N/A 127.0.0.1:6514 tcp
US 8.8.8.8:53 darkscouting.no-ip.biz udp
N/A 127.0.0.1:6514 tcp
N/A 127.0.0.1:6514 tcp
N/A 127.0.0.1:6514 tcp
US 8.8.8.8:53 darkscouting.no-ip.biz udp
N/A 127.0.0.1:6514 tcp
N/A 127.0.0.1:6514 tcp
US 8.8.8.8:53 darkscouting.no-ip.biz udp
N/A 127.0.0.1:6514 tcp
N/A 127.0.0.1:6514 tcp
US 8.8.8.8:53 darkscouting.no-ip.biz udp
N/A 127.0.0.1:6514 tcp
N/A 127.0.0.1:6514 tcp
US 8.8.8.8:53 darkscouting.no-ip.biz udp
N/A 127.0.0.1:6514 tcp
N/A 127.0.0.1:6514 tcp
US 8.8.8.8:53 darkscouting.no-ip.biz udp
N/A 127.0.0.1:6514 tcp

Files

memory/5068-132-0x0000000000AA0000-0x0000000000AA4000-memory.dmp

memory/4904-133-0x0000000000000000-mapping.dmp

memory/4904-134-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/4904-135-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/4904-136-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/4904-137-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/1268-138-0x0000000000000000-mapping.dmp

memory/4640-139-0x0000000000000000-mapping.dmp

memory/1132-141-0x0000000000000000-mapping.dmp

memory/4296-140-0x0000000000000000-mapping.dmp

memory/4904-142-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/4820-143-0x0000000000000000-mapping.dmp

C:\Windows\SysAdmin\windesk.exe

MD5 7c2424a3c3548fe475e16d10e5e18b50
SHA1 c6a67fa3db86385781a9d6512ed3bd19ce700198
SHA256 ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81
SHA512 ee64bf32108bfe9b9156bb42edc9a28de34ed9331cd7d4ef3f049bee53beda780bdcce79d4e99072ee39ee51d73c3af623a1dd030a3d3003e10f130797ea3ce0

C:\Windows\SysAdmin\windesk.exe

MD5 7c2424a3c3548fe475e16d10e5e18b50
SHA1 c6a67fa3db86385781a9d6512ed3bd19ce700198
SHA256 ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81
SHA512 ee64bf32108bfe9b9156bb42edc9a28de34ed9331cd7d4ef3f049bee53beda780bdcce79d4e99072ee39ee51d73c3af623a1dd030a3d3003e10f130797ea3ce0

C:\Windows\SysAdmin\windesk.exe

MD5 7c2424a3c3548fe475e16d10e5e18b50
SHA1 c6a67fa3db86385781a9d6512ed3bd19ce700198
SHA256 ddc36271746a38fd0af19f43d4f76f24aba08c0b76e766f7115f9a8f494bde81
SHA512 ee64bf32108bfe9b9156bb42edc9a28de34ed9331cd7d4ef3f049bee53beda780bdcce79d4e99072ee39ee51d73c3af623a1dd030a3d3003e10f130797ea3ce0

memory/3436-146-0x0000000000000000-mapping.dmp

memory/320-151-0x0000000000000000-mapping.dmp

memory/3436-152-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/3436-153-0x0000000000400000-0x00000000004B2000-memory.dmp