Malware Analysis Report

2025-08-05 15:29

Sample ID 221019-qdks7ahaf8
Target 4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f
SHA256 4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f
Tags
darkcomet 010 persistence rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f

Threat Level: Known bad

The file 4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f was found to be: Known bad.

Malicious Activity Summary

darkcomet 010 persistence rat trojan upx

Darkcomet

UPX packed file

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Program crash

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-19 13:08

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-19 13:08

Reported

2022-10-19 13:38

Platform

win7-20220901-en

Max time kernel

149s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe"

Signatures

Darkcomet

trojan rat darkcomet

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\msoffice = "C:\\Users\\Admin\\AppData\\Roaming\\MicrosoftOffice\\micoffice.exe" C:\Windows\SysWOW64\reg.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1740 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe
PID 1740 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe
PID 1740 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe
PID 1740 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe
PID 1740 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe
PID 1740 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe
PID 1740 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe
PID 1740 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe
PID 1200 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe C:\Windows\SysWOW64\cmd.exe
PID 1200 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe C:\Windows\SysWOW64\cmd.exe
PID 1200 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe C:\Windows\SysWOW64\cmd.exe
PID 1200 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe C:\Windows\SysWOW64\cmd.exe
PID 536 wrote to memory of 572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 536 wrote to memory of 572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 536 wrote to memory of 572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 536 wrote to memory of 572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1200 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 1200 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 1200 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 1200 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 884 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 884 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 884 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 884 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 884 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 884 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 884 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 884 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 884 wrote to memory of 920 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 884 wrote to memory of 920 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 884 wrote to memory of 920 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 884 wrote to memory of 920 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 884 wrote to memory of 920 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 884 wrote to memory of 920 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 884 wrote to memory of 920 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 884 wrote to memory of 920 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 884 wrote to memory of 920 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 884 wrote to memory of 920 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 884 wrote to memory of 920 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 884 wrote to memory of 920 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 884 wrote to memory of 920 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe

"C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe"

C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe

"C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\ITYVJ.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "msoffice" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe" /f

C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

"C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe"

C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

"C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe"

C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

"C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 shades.no-ip.org udp
US 204.95.99.66:1604 shades.no-ip.org tcp
US 204.95.99.66:1604 shades.no-ip.org tcp
US 204.95.99.66:1604 shades.no-ip.org tcp
US 204.95.99.66:1604 shades.no-ip.org tcp
US 204.95.99.66:1604 shades.no-ip.org tcp

Files

memory/1740-56-0x0000000002E00000-0x0000000002ED8000-memory.dmp

memory/1200-58-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1200-59-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1200-61-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1200-62-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1200-63-0x00000000004085D0-mapping.dmp

memory/1200-65-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1200-66-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1200-69-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1200-70-0x0000000075931000-0x0000000075933000-memory.dmp

memory/536-71-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\ITYVJ.bat

MD5 f07b93136766adced3c6f0d74d869da0
SHA1 787c530f33687d758b41295e01d7a9a1bba3a467
SHA256 cd603067047c028fe12d4b099d13b3681dd698d25bc32474184e9d8edd3ed701
SHA512 050105a5f14939a37f653421b24959cc90cb082b20df5bb1a81335fd0ad5e70c740b43f1d6df0fc7324551425894668acc3af0c533c7d90ff149d84e844c2d10

memory/572-73-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

MD5 b0854ce2dd390e7824e0cf92df73923e
SHA1 257a4de4f2c89e000bc8211158d5e96ddd70acff
SHA256 6137b32220d18ad7b2a1edd568f1697022687cc40c40c32945d41acb2286d381
SHA512 4118fdd3da61b38629331600cec3643c395b9d4d41d553e00a6a6777632ec4368df49c6db8233b97b0430cc00a220323197c17903e5470be17bf6d1e19e9e555

\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

MD5 b0854ce2dd390e7824e0cf92df73923e
SHA1 257a4de4f2c89e000bc8211158d5e96ddd70acff
SHA256 6137b32220d18ad7b2a1edd568f1697022687cc40c40c32945d41acb2286d381
SHA512 4118fdd3da61b38629331600cec3643c395b9d4d41d553e00a6a6777632ec4368df49c6db8233b97b0430cc00a220323197c17903e5470be17bf6d1e19e9e555

\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

MD5 b0854ce2dd390e7824e0cf92df73923e
SHA1 257a4de4f2c89e000bc8211158d5e96ddd70acff
SHA256 6137b32220d18ad7b2a1edd568f1697022687cc40c40c32945d41acb2286d381
SHA512 4118fdd3da61b38629331600cec3643c395b9d4d41d553e00a6a6777632ec4368df49c6db8233b97b0430cc00a220323197c17903e5470be17bf6d1e19e9e555

\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

MD5 b0854ce2dd390e7824e0cf92df73923e
SHA1 257a4de4f2c89e000bc8211158d5e96ddd70acff
SHA256 6137b32220d18ad7b2a1edd568f1697022687cc40c40c32945d41acb2286d381
SHA512 4118fdd3da61b38629331600cec3643c395b9d4d41d553e00a6a6777632ec4368df49c6db8233b97b0430cc00a220323197c17903e5470be17bf6d1e19e9e555

\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

MD5 b0854ce2dd390e7824e0cf92df73923e
SHA1 257a4de4f2c89e000bc8211158d5e96ddd70acff
SHA256 6137b32220d18ad7b2a1edd568f1697022687cc40c40c32945d41acb2286d381
SHA512 4118fdd3da61b38629331600cec3643c395b9d4d41d553e00a6a6777632ec4368df49c6db8233b97b0430cc00a220323197c17903e5470be17bf6d1e19e9e555

memory/884-79-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

MD5 b0854ce2dd390e7824e0cf92df73923e
SHA1 257a4de4f2c89e000bc8211158d5e96ddd70acff
SHA256 6137b32220d18ad7b2a1edd568f1697022687cc40c40c32945d41acb2286d381
SHA512 4118fdd3da61b38629331600cec3643c395b9d4d41d553e00a6a6777632ec4368df49c6db8233b97b0430cc00a220323197c17903e5470be17bf6d1e19e9e555

memory/884-83-0x0000000002ED0000-0x0000000002FA8000-memory.dmp

C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

MD5 b0854ce2dd390e7824e0cf92df73923e
SHA1 257a4de4f2c89e000bc8211158d5e96ddd70acff
SHA256 6137b32220d18ad7b2a1edd568f1697022687cc40c40c32945d41acb2286d381
SHA512 4118fdd3da61b38629331600cec3643c395b9d4d41d553e00a6a6777632ec4368df49c6db8233b97b0430cc00a220323197c17903e5470be17bf6d1e19e9e555

C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

MD5 b0854ce2dd390e7824e0cf92df73923e
SHA1 257a4de4f2c89e000bc8211158d5e96ddd70acff
SHA256 6137b32220d18ad7b2a1edd568f1697022687cc40c40c32945d41acb2286d381
SHA512 4118fdd3da61b38629331600cec3643c395b9d4d41d553e00a6a6777632ec4368df49c6db8233b97b0430cc00a220323197c17903e5470be17bf6d1e19e9e555

memory/920-96-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/1644-91-0x00000000004085D0-mapping.dmp

memory/920-94-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/920-100-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/920-103-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/920-105-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/920-107-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/920-108-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/920-110-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/920-113-0x000000000048F888-mapping.dmp

memory/920-112-0x0000000000400000-0x00000000004B2000-memory.dmp

C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

MD5 b0854ce2dd390e7824e0cf92df73923e
SHA1 257a4de4f2c89e000bc8211158d5e96ddd70acff
SHA256 6137b32220d18ad7b2a1edd568f1697022687cc40c40c32945d41acb2286d381
SHA512 4118fdd3da61b38629331600cec3643c395b9d4d41d553e00a6a6777632ec4368df49c6db8233b97b0430cc00a220323197c17903e5470be17bf6d1e19e9e555

memory/1200-115-0x0000000000400000-0x000000000040B000-memory.dmp

memory/920-116-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/920-118-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/920-119-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/1644-121-0x0000000000400000-0x000000000040B000-memory.dmp

memory/920-122-0x0000000000400000-0x00000000004B2000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-19 13:08

Reported

2022-10-19 13:38

Platform

win10v2004-20220901-en

Max time kernel

90s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe

"C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4580 -ip 4580

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 464

Network

Country Destination Domain Proto
US 20.189.173.5:443 tcp
US 8.253.208.120:80 tcp
US 8.253.208.120:80 tcp
US 8.253.208.120:80 tcp

Files

N/A