Malware Analysis Report

2025-08-05 15:29

Sample ID 221019-ranlcaagc5
Target b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc
SHA256 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc
Tags
darkcomet guest16 rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc

Threat Level: Known bad

The file b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc was found to be: Known bad.

Malicious Activity Summary

darkcomet guest16 rat trojan

Darkcomet

Suspicious use of SetThreadContext

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Runs net.exe

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2022-10-19 13:59

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-19 13:59

Reported

2022-10-19 14:58

Platform

win10v2004-20220812-en

Max time kernel

151s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe"

Signatures

Darkcomet

trojan rat darkcomet

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSystemtimePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe N/A
Token: SeUndockPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe N/A
Token: SeManageVolumePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe N/A
Token: SeImpersonatePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe N/A
Token: 33 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe N/A
Token: 34 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe N/A
Token: 35 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: 36 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1368 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Windows\SysWOW64\cmd.exe
PID 1368 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Windows\SysWOW64\cmd.exe
PID 1368 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Windows\SysWOW64\cmd.exe
PID 1368 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1368 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1368 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1368 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1368 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1368 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1368 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1368 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1368 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1368 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1368 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1368 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1368 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1368 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1368 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe
PID 1368 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe
PID 1368 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe
PID 1368 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe
PID 1368 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe
PID 1368 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe
PID 1368 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe
PID 1368 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe
PID 1368 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe
PID 1368 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe
PID 1368 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe
PID 1368 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe
PID 1368 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe
PID 1368 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe
PID 2496 wrote to memory of 4644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2496 wrote to memory of 4644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 2496 wrote to memory of 4644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\net.exe
PID 4644 wrote to memory of 5032 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4644 wrote to memory of 5032 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4644 wrote to memory of 5032 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe

"C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe"

C:\Windows\SysWOW64\cmd.exe

/c net stop MpsSvc

C:\Program Files (x86)\Internet Explorer\iexplore.exe

"C:\Program Files (x86)\Internet Explorer\iexplore.exe"

C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe

C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe

C:\Windows\SysWOW64\net.exe

net stop MpsSvc

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop MpsSvc

Network

Country Destination Domain Proto
US 93.184.220.29:80 tcp
NL 104.110.191.140:80 tcp
N/A 127.0.0.1:1604 tcp
FR 40.79.150.121:443 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
NL 178.79.208.1:80 tcp
NL 178.79.208.1:80 tcp
NL 178.79.208.1:80 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
US 8.8.8.8:53 226.101.242.52.in-addr.arpa udp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp

Files

memory/2496-132-0x0000000000000000-mapping.dmp

memory/1368-133-0x0000000002340000-0x0000000002344000-memory.dmp

memory/5092-134-0x0000000000000000-mapping.dmp

memory/5092-135-0x0000000000400000-0x00000000004CA000-memory.dmp

memory/5092-136-0x0000000000400000-0x00000000004CA000-memory.dmp

memory/5092-137-0x0000000000400000-0x00000000004CA000-memory.dmp

memory/4644-138-0x0000000000000000-mapping.dmp

memory/5092-139-0x0000000000400000-0x00000000004CA000-memory.dmp

memory/5032-140-0x0000000000000000-mapping.dmp

memory/5092-141-0x0000000000400000-0x00000000004CA000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-19 13:59

Reported

2022-10-19 14:58

Platform

win7-20220901-en

Max time kernel

43s

Max time network

48s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe"

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe

"C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe"

Network

N/A

Files

memory/1712-54-0x00000000765B1000-0x00000000765B3000-memory.dmp

memory/1712-55-0x0000000000340000-0x0000000000344000-memory.dmp