Malware Analysis Report

2025-08-05 15:28

Sample ID 221019-qra6xahgf8
Target 617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652
SHA256 617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652
Tags
darkcomet evasion persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652

Threat Level: Known bad

The file 617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652 was found to be: Known bad.

Malicious Activity Summary

darkcomet evasion persistence rat trojan

Darkcomet family

Modifies firewall policy service

Modifies WinLogon for persistence

Darkcomet

Disables RegEdit via registry modification

Executes dropped EXE

Disables Task Manager via registry modification

Drops file in Drivers directory

Loads dropped DLL

Checks computer location settings

Checks BIOS information in registry

Adds Run key to start application

Enumerates physical storage devices

Runs ping.exe

Modifies registry class

Enumerates system info in registry

Suspicious use of WriteProcessMemory

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-19 13:29

Signatures

Darkcomet family

darkcomet

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-19 13:29

Reported

2022-10-19 14:10

Platform

win7-20220812-en

Max time kernel

152s

Max time network

46s

Command Line

"C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe"

Signatures

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Windupdt\\winupdate.exe" C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1" C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A

Disables Task Manager via registry modification

evasion

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Users\\Admin\\AppData\\Roaming\\Windupdt\\winupdate.exe" C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ping.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 604 wrote to memory of 112 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe C:\Windows\SysWOW64\explorer.exe
PID 604 wrote to memory of 112 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe C:\Windows\SysWOW64\explorer.exe
PID 604 wrote to memory of 112 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe C:\Windows\SysWOW64\explorer.exe
PID 604 wrote to memory of 112 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe C:\Windows\SysWOW64\explorer.exe
PID 604 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe
PID 604 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe
PID 604 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe
PID 604 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe
PID 604 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe
PID 604 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe
PID 604 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe
PID 604 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe C:\Windows\SysWOW64\ping.exe
PID 604 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe C:\Windows\SysWOW64\ping.exe
PID 604 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe C:\Windows\SysWOW64\ping.exe
PID 604 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe C:\Windows\SysWOW64\ping.exe
PID 1664 wrote to memory of 584 N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe C:\Windows\SysWOW64\explorer.exe
PID 1664 wrote to memory of 584 N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe C:\Windows\SysWOW64\explorer.exe
PID 1664 wrote to memory of 584 N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe C:\Windows\SysWOW64\explorer.exe
PID 1664 wrote to memory of 584 N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe C:\Windows\SysWOW64\explorer.exe
PID 1664 wrote to memory of 584 N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe C:\Windows\SysWOW64\explorer.exe
PID 1664 wrote to memory of 584 N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe C:\Windows\SysWOW64\explorer.exe
PID 1664 wrote to memory of 584 N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe C:\Windows\SysWOW64\explorer.exe

Processes

C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe

"C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe"

C:\Windows\SysWOW64\explorer.exe

"C:\Windows\SysWOW64\explorer.exe"

C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe

"C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\ping.exe

ping 127.0.0.1 -n 5 > NUL del "C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe"

C:\Windows\SysWOW64\explorer.exe

"C:\Windows\SysWOW64\explorer.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 andersonby.sytes.net udp

Files

memory/604-54-0x0000000075F81000-0x0000000075F83000-memory.dmp

\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe

MD5 90beb0c7bfc299c7461ac760e7e3c603
SHA1 6a3e7386a9463dcdb6b0ac5d72d0cd25dc1bd610
SHA256 617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652
SHA512 7594acb8c06a93648bc3f6c4655240e2e4acf6ca911d9718cbddfa347bb07a14888c53efc1f81316fb588787ccf2ee85a0a797b7ddc53aca2d0fc1ee07f91671

memory/1664-56-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe

MD5 90beb0c7bfc299c7461ac760e7e3c603
SHA1 6a3e7386a9463dcdb6b0ac5d72d0cd25dc1bd610
SHA256 617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652
SHA512 7594acb8c06a93648bc3f6c4655240e2e4acf6ca911d9718cbddfa347bb07a14888c53efc1f81316fb588787ccf2ee85a0a797b7ddc53aca2d0fc1ee07f91671

C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe

MD5 90beb0c7bfc299c7461ac760e7e3c603
SHA1 6a3e7386a9463dcdb6b0ac5d72d0cd25dc1bd610
SHA256 617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652
SHA512 7594acb8c06a93648bc3f6c4655240e2e4acf6ca911d9718cbddfa347bb07a14888c53efc1f81316fb588787ccf2ee85a0a797b7ddc53aca2d0fc1ee07f91671

memory/1540-60-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe

MD5 90beb0c7bfc299c7461ac760e7e3c603
SHA1 6a3e7386a9463dcdb6b0ac5d72d0cd25dc1bd610
SHA256 617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652
SHA512 7594acb8c06a93648bc3f6c4655240e2e4acf6ca911d9718cbddfa347bb07a14888c53efc1f81316fb588787ccf2ee85a0a797b7ddc53aca2d0fc1ee07f91671

\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe

MD5 90beb0c7bfc299c7461ac760e7e3c603
SHA1 6a3e7386a9463dcdb6b0ac5d72d0cd25dc1bd610
SHA256 617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652
SHA512 7594acb8c06a93648bc3f6c4655240e2e4acf6ca911d9718cbddfa347bb07a14888c53efc1f81316fb588787ccf2ee85a0a797b7ddc53aca2d0fc1ee07f91671

\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe

MD5 90beb0c7bfc299c7461ac760e7e3c603
SHA1 6a3e7386a9463dcdb6b0ac5d72d0cd25dc1bd610
SHA256 617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652
SHA512 7594acb8c06a93648bc3f6c4655240e2e4acf6ca911d9718cbddfa347bb07a14888c53efc1f81316fb588787ccf2ee85a0a797b7ddc53aca2d0fc1ee07f91671

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-19 13:29

Reported

2022-10-19 14:10

Platform

win10v2004-20220901-en

Max time kernel

150s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe"

Signatures

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Windupdt\\winupdate.exe" C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1" C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A

Disables Task Manager via registry modification

evasion

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Users\\Admin\\AppData\\Roaming\\Windupdt\\winupdate.exe" C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ping.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3368 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe C:\Windows\SysWOW64\explorer.exe
PID 3368 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe C:\Windows\SysWOW64\explorer.exe
PID 3368 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe C:\Windows\SysWOW64\explorer.exe
PID 3368 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe
PID 3368 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe
PID 3368 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe
PID 3368 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe C:\Windows\SysWOW64\ping.exe
PID 3368 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe C:\Windows\SysWOW64\ping.exe
PID 3368 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe C:\Windows\SysWOW64\ping.exe
PID 2376 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe C:\Windows\SysWOW64\explorer.exe
PID 2376 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe C:\Windows\SysWOW64\explorer.exe
PID 2376 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe C:\Windows\SysWOW64\explorer.exe

Processes

C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe

"C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe"

C:\Windows\SysWOW64\explorer.exe

"C:\Windows\SysWOW64\explorer.exe"

C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe

"C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\ping.exe

ping 127.0.0.1 -n 5 > NUL del "C:\Users\Admin\AppData\Local\Temp\617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652.exe"

C:\Windows\SysWOW64\explorer.exe

"C:\Windows\SysWOW64\explorer.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 andersonby.sytes.net udp
US 8.8.8.8:53 andersonby.sytes.net udp
US 8.8.8.8:53 andersonby.sytes.net udp
US 8.8.8.8:53 andersonby.sytes.net udp
US 8.8.8.8:53 andersonby.sytes.net udp
US 20.42.73.24:443 tcp
US 8.8.8.8:53 andersonby.sytes.net udp
US 8.8.8.8:53 andersonby.sytes.net udp
US 8.8.8.8:53 andersonby.sytes.net udp
FR 2.18.109.224:443 tcp
US 8.8.8.8:53 andersonby.sytes.net udp
US 8.8.8.8:53 andersonby.sytes.net udp
US 8.8.8.8:53 andersonby.sytes.net udp
US 8.8.8.8:53 andersonby.sytes.net udp
NL 88.221.25.155:80 tcp
US 8.8.8.8:53 andersonby.sytes.net udp
US 8.8.8.8:53 andersonby.sytes.net udp
US 8.8.8.8:53 andersonby.sytes.net udp
NL 87.248.202.1:80 tcp
US 8.8.8.8:53 andersonby.sytes.net udp
US 8.8.8.8:53 andersonby.sytes.net udp
US 8.8.8.8:53 andersonby.sytes.net udp
US 8.8.8.8:53 andersonby.sytes.net udp
US 8.8.8.8:53 andersonby.sytes.net udp
US 8.8.8.8:53 andersonby.sytes.net udp
US 8.8.8.8:53 andersonby.sytes.net udp
US 8.8.8.8:53 andersonby.sytes.net udp
US 8.8.8.8:53 andersonby.sytes.net udp
US 8.8.8.8:53 andersonby.sytes.net udp
US 8.8.8.8:53 andersonby.sytes.net udp
US 8.8.8.8:53 andersonby.sytes.net udp
US 8.8.8.8:53 andersonby.sytes.net udp
US 8.8.8.8:53 andersonby.sytes.net udp

Files

memory/1552-132-0x0000000000000000-mapping.dmp

memory/2376-133-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe

MD5 90beb0c7bfc299c7461ac760e7e3c603
SHA1 6a3e7386a9463dcdb6b0ac5d72d0cd25dc1bd610
SHA256 617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652
SHA512 7594acb8c06a93648bc3f6c4655240e2e4acf6ca911d9718cbddfa347bb07a14888c53efc1f81316fb588787ccf2ee85a0a797b7ddc53aca2d0fc1ee07f91671

C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe

MD5 90beb0c7bfc299c7461ac760e7e3c603
SHA1 6a3e7386a9463dcdb6b0ac5d72d0cd25dc1bd610
SHA256 617f3805bc495e2bf705d44cdbb6d8a6fd79bf5e3b552e0f6fb6143bf7bb8652
SHA512 7594acb8c06a93648bc3f6c4655240e2e4acf6ca911d9718cbddfa347bb07a14888c53efc1f81316fb588787ccf2ee85a0a797b7ddc53aca2d0fc1ee07f91671

memory/4072-135-0x0000000000000000-mapping.dmp

memory/2968-137-0x0000000000000000-mapping.dmp