Malware Analysis Report

2025-08-05 15:28

Sample ID 221019-qdlqgshaf9
Target 38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f
SHA256 38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f
Tags
darkcomet 010 persistence rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f

Threat Level: Known bad

The file 38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f was found to be: Known bad.

Malicious Activity Summary

darkcomet 010 persistence rat trojan upx

Darkcomet

Executes dropped EXE

UPX packed file

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Program crash

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-19 13:08

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-19 13:08

Reported

2022-10-19 13:38

Platform

win7-20220812-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe"

Signatures

Darkcomet

trojan rat darkcomet

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\msoffice = "C:\\Users\\Admin\\AppData\\Roaming\\MicrosoftOffice\\micoffice.exe" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1212 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe
PID 1212 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe
PID 1212 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe
PID 1212 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe
PID 1212 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe
PID 1212 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe
PID 1212 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe
PID 1212 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe
PID 1172 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe C:\Windows\SysWOW64\cmd.exe
PID 1172 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe C:\Windows\SysWOW64\cmd.exe
PID 1172 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe C:\Windows\SysWOW64\cmd.exe
PID 1172 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe C:\Windows\SysWOW64\cmd.exe
PID 1704 wrote to memory of 1588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1704 wrote to memory of 1588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1704 wrote to memory of 1588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1704 wrote to memory of 1588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1172 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 1172 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 1172 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 1172 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 1664 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 1664 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 1664 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 1664 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 1664 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 1664 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 1664 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 1664 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 1664 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 1664 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 1664 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 1664 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 1664 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 1664 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 1664 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 1664 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 1664 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 1664 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 1664 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 1664 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
PID 1664 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

Processes

C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe

"C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe"

C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe

"C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\XOLGV.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "msoffice" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe" /f

C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

"C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe"

C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

"C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe"

C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

"C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 shades.no-ip.org udp
US 204.95.99.66:1604 shades.no-ip.org tcp
US 204.95.99.66:1604 shades.no-ip.org tcp
US 204.95.99.66:1604 shades.no-ip.org tcp

Files

memory/1212-56-0x0000000002CD0000-0x0000000002DA8000-memory.dmp

memory/1172-58-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1172-63-0x00000000004085D0-mapping.dmp

memory/1172-62-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1172-61-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1172-59-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1172-65-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1172-66-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1172-69-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1172-70-0x0000000076711000-0x0000000076713000-memory.dmp

memory/1704-71-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\XOLGV.bat

MD5 f07b93136766adced3c6f0d74d869da0
SHA1 787c530f33687d758b41295e01d7a9a1bba3a467
SHA256 cd603067047c028fe12d4b099d13b3681dd698d25bc32474184e9d8edd3ed701
SHA512 050105a5f14939a37f653421b24959cc90cb082b20df5bb1a81335fd0ad5e70c740b43f1d6df0fc7324551425894668acc3af0c533c7d90ff149d84e844c2d10

memory/1588-73-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

MD5 9af6bd730a1622e152701d2658ddd665
SHA1 f6390bb376182f18b40311273d7c0a7b4ccdfb68
SHA256 e46071299afbabb1cad1d8b2cda05cd83f320e905e787495f577bcb0bf61c88b
SHA512 575b75a34aa7ab015db7f75dc99e3cc60412cde7e8e365f7e6dd759351229faa560733382c7e838be39b94cd84dbc94818005af62b86724e58ed3f7e4ba79cec

\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

MD5 9af6bd730a1622e152701d2658ddd665
SHA1 f6390bb376182f18b40311273d7c0a7b4ccdfb68
SHA256 e46071299afbabb1cad1d8b2cda05cd83f320e905e787495f577bcb0bf61c88b
SHA512 575b75a34aa7ab015db7f75dc99e3cc60412cde7e8e365f7e6dd759351229faa560733382c7e838be39b94cd84dbc94818005af62b86724e58ed3f7e4ba79cec

\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

MD5 9af6bd730a1622e152701d2658ddd665
SHA1 f6390bb376182f18b40311273d7c0a7b4ccdfb68
SHA256 e46071299afbabb1cad1d8b2cda05cd83f320e905e787495f577bcb0bf61c88b
SHA512 575b75a34aa7ab015db7f75dc99e3cc60412cde7e8e365f7e6dd759351229faa560733382c7e838be39b94cd84dbc94818005af62b86724e58ed3f7e4ba79cec

\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

MD5 9af6bd730a1622e152701d2658ddd665
SHA1 f6390bb376182f18b40311273d7c0a7b4ccdfb68
SHA256 e46071299afbabb1cad1d8b2cda05cd83f320e905e787495f577bcb0bf61c88b
SHA512 575b75a34aa7ab015db7f75dc99e3cc60412cde7e8e365f7e6dd759351229faa560733382c7e838be39b94cd84dbc94818005af62b86724e58ed3f7e4ba79cec

\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

MD5 9af6bd730a1622e152701d2658ddd665
SHA1 f6390bb376182f18b40311273d7c0a7b4ccdfb68
SHA256 e46071299afbabb1cad1d8b2cda05cd83f320e905e787495f577bcb0bf61c88b
SHA512 575b75a34aa7ab015db7f75dc99e3cc60412cde7e8e365f7e6dd759351229faa560733382c7e838be39b94cd84dbc94818005af62b86724e58ed3f7e4ba79cec

memory/1664-79-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

MD5 9af6bd730a1622e152701d2658ddd665
SHA1 f6390bb376182f18b40311273d7c0a7b4ccdfb68
SHA256 e46071299afbabb1cad1d8b2cda05cd83f320e905e787495f577bcb0bf61c88b
SHA512 575b75a34aa7ab015db7f75dc99e3cc60412cde7e8e365f7e6dd759351229faa560733382c7e838be39b94cd84dbc94818005af62b86724e58ed3f7e4ba79cec

memory/1664-83-0x0000000002D70000-0x0000000002E48000-memory.dmp

C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

MD5 9af6bd730a1622e152701d2658ddd665
SHA1 f6390bb376182f18b40311273d7c0a7b4ccdfb68
SHA256 e46071299afbabb1cad1d8b2cda05cd83f320e905e787495f577bcb0bf61c88b
SHA512 575b75a34aa7ab015db7f75dc99e3cc60412cde7e8e365f7e6dd759351229faa560733382c7e838be39b94cd84dbc94818005af62b86724e58ed3f7e4ba79cec

memory/1164-94-0x0000000000400000-0x00000000004B2000-memory.dmp

C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

MD5 9af6bd730a1622e152701d2658ddd665
SHA1 f6390bb376182f18b40311273d7c0a7b4ccdfb68
SHA256 e46071299afbabb1cad1d8b2cda05cd83f320e905e787495f577bcb0bf61c88b
SHA512 575b75a34aa7ab015db7f75dc99e3cc60412cde7e8e365f7e6dd759351229faa560733382c7e838be39b94cd84dbc94818005af62b86724e58ed3f7e4ba79cec

memory/1164-95-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/1768-91-0x00000000004085D0-mapping.dmp

memory/1164-100-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/1164-102-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/1164-104-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/1164-106-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/1164-107-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/1164-109-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/1164-112-0x000000000048F888-mapping.dmp

C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

MD5 9af6bd730a1622e152701d2658ddd665
SHA1 f6390bb376182f18b40311273d7c0a7b4ccdfb68
SHA256 e46071299afbabb1cad1d8b2cda05cd83f320e905e787495f577bcb0bf61c88b
SHA512 575b75a34aa7ab015db7f75dc99e3cc60412cde7e8e365f7e6dd759351229faa560733382c7e838be39b94cd84dbc94818005af62b86724e58ed3f7e4ba79cec

memory/1164-115-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/1164-111-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/1172-116-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1164-118-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/1164-119-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/1768-121-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1164-122-0x0000000000400000-0x00000000004B2000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-19 13:08

Reported

2022-10-19 13:39

Platform

win10v2004-20220812-en

Max time kernel

109s

Max time network

132s

Command Line

"C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe

"C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4580 -ip 4580

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 464

Network

Country Destination Domain Proto
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
NL 104.80.225.205:443 tcp
FR 40.79.150.121:443 tcp
US 8.8.8.8:53 97.97.242.52.in-addr.arpa udp
US 8.8.8.8:53 151.122.125.40.in-addr.arpa udp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp

Files

N/A