Malware Analysis Report

2025-08-05 15:29

Sample ID 221019-sfefascgh6
Target bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706
SHA256 bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706
Tags
darkcomet cc persistence rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706

Threat Level: Known bad

The file bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706 was found to be: Known bad.

Malicious Activity Summary

darkcomet cc persistence rat trojan upx

Darkcomet

Executes dropped EXE

UPX packed file

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Program crash

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-19 15:03

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-19 15:03

Reported

2022-10-19 16:41

Platform

win7-20220812-en

Max time kernel

152s

Max time network

167s

Command Line

"C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe"

Signatures

Darkcomet

trojan rat darkcomet

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\TapNet = "C:\\Users\\Admin\\AppData\\Roaming\\tapinterface\\tap.exe" C:\Windows\SysWOW64\reg.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1008 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe
PID 1008 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe
PID 1008 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe
PID 1008 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe
PID 1008 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe
PID 1008 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe
PID 1008 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe
PID 1008 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe
PID 1600 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe C:\Windows\SysWOW64\cmd.exe
PID 1600 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe C:\Windows\SysWOW64\cmd.exe
PID 1600 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe C:\Windows\SysWOW64\cmd.exe
PID 1600 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe C:\Windows\SysWOW64\cmd.exe
PID 1324 wrote to memory of 1456 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1324 wrote to memory of 1456 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1324 wrote to memory of 1456 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1324 wrote to memory of 1456 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1600 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe
PID 1600 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe
PID 1600 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe
PID 1600 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe
PID 560 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe
PID 560 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe
PID 560 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe
PID 560 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe
PID 560 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe
PID 560 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe
PID 560 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe
PID 560 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe
PID 560 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Windows\SysWOW64\svchost.exe
PID 560 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Windows\SysWOW64\svchost.exe
PID 560 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Windows\SysWOW64\svchost.exe
PID 560 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Windows\SysWOW64\svchost.exe
PID 560 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Windows\SysWOW64\svchost.exe
PID 560 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Windows\SysWOW64\svchost.exe
PID 560 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Windows\SysWOW64\svchost.exe
PID 560 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe

"C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe"

C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe

"C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\GMRCA.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "TapNet" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe" /f

C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe

"C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe"

C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe

"C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe"

C:\Windows\SysWOW64\svchost.exe

"C:\Windows\system32\svchost.exe"

Network

Country Destination Domain Proto
NL 212.7.192.244:1337 tcp
NL 212.7.192.244:1337 tcp
NL 212.7.192.244:1337 tcp
NL 212.7.192.244:1337 tcp
NL 212.7.192.244:1337 tcp

Files

memory/1008-56-0x00000000005EF000-0x000000000062D000-memory.dmp

\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe

MD5 83003c24123609acdec44b1263f6d66d
SHA1 7154c1219a0b151051d930c6cc2063a170425d18
SHA256 bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706
SHA512 7f562d8bde844bc153e1743487c7594c520a2e44b3d732472a140af534c2b68dea4f18144c893196267ff81d22f13c4e6abc7112a27540324ede6ff61054f535

memory/1600-59-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1600-60-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1600-62-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1600-63-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1600-64-0x00000000004085D0-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe

MD5 83003c24123609acdec44b1263f6d66d
SHA1 7154c1219a0b151051d930c6cc2063a170425d18
SHA256 bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706
SHA512 7f562d8bde844bc153e1743487c7594c520a2e44b3d732472a140af534c2b68dea4f18144c893196267ff81d22f13c4e6abc7112a27540324ede6ff61054f535

memory/1600-67-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1600-68-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1600-71-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1600-72-0x0000000075C51000-0x0000000075C53000-memory.dmp

memory/1600-73-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1324-74-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\GMRCA.bat

MD5 517aa80e282d1f1a3ea764d1a5f32ed8
SHA1 990331d6b551d436d81f5aac0914b7ed7fa51136
SHA256 fc1c4d0d8ea5d27476e23c49b7dacd40cd9dac4763303ad838774984a2bdc81d
SHA512 caf370281540e19a15ac5a44204788525fb181f714bf396af2fc3f717e80c132e55e0a0db82e230c8469c29c3ab49f3a697dbb85141201405334b5420540abc7

memory/1456-76-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\tapinterface\tap.exe

MD5 c11f85a2b0977f5d0cb82b54a931bdb0
SHA1 0f17cebed26a4ab0c590aab40f87c6e60468eafd
SHA256 ee4f1ddecbfa190fe8bbf87bfa080752fd0ac3bfbdc0148d6f7a3b9b4672d493
SHA512 8db757a469f6d191ddacf5fc81d04b4f5a9170005fb93a72b0c0d2daebbb3f86420b976cc47ced983710e63c78c4b5bbcd87fe8bb23e0a3d98f1b784fb548057

\Users\Admin\AppData\Roaming\tapinterface\tap.exe

MD5 c11f85a2b0977f5d0cb82b54a931bdb0
SHA1 0f17cebed26a4ab0c590aab40f87c6e60468eafd
SHA256 ee4f1ddecbfa190fe8bbf87bfa080752fd0ac3bfbdc0148d6f7a3b9b4672d493
SHA512 8db757a469f6d191ddacf5fc81d04b4f5a9170005fb93a72b0c0d2daebbb3f86420b976cc47ced983710e63c78c4b5bbcd87fe8bb23e0a3d98f1b784fb548057

\Users\Admin\AppData\Roaming\tapinterface\tap.exe

MD5 c11f85a2b0977f5d0cb82b54a931bdb0
SHA1 0f17cebed26a4ab0c590aab40f87c6e60468eafd
SHA256 ee4f1ddecbfa190fe8bbf87bfa080752fd0ac3bfbdc0148d6f7a3b9b4672d493
SHA512 8db757a469f6d191ddacf5fc81d04b4f5a9170005fb93a72b0c0d2daebbb3f86420b976cc47ced983710e63c78c4b5bbcd87fe8bb23e0a3d98f1b784fb548057

\Users\Admin\AppData\Roaming\tapinterface\tap.exe

MD5 c11f85a2b0977f5d0cb82b54a931bdb0
SHA1 0f17cebed26a4ab0c590aab40f87c6e60468eafd
SHA256 ee4f1ddecbfa190fe8bbf87bfa080752fd0ac3bfbdc0148d6f7a3b9b4672d493
SHA512 8db757a469f6d191ddacf5fc81d04b4f5a9170005fb93a72b0c0d2daebbb3f86420b976cc47ced983710e63c78c4b5bbcd87fe8bb23e0a3d98f1b784fb548057

\Users\Admin\AppData\Roaming\tapinterface\tap.exe

MD5 c11f85a2b0977f5d0cb82b54a931bdb0
SHA1 0f17cebed26a4ab0c590aab40f87c6e60468eafd
SHA256 ee4f1ddecbfa190fe8bbf87bfa080752fd0ac3bfbdc0148d6f7a3b9b4672d493
SHA512 8db757a469f6d191ddacf5fc81d04b4f5a9170005fb93a72b0c0d2daebbb3f86420b976cc47ced983710e63c78c4b5bbcd87fe8bb23e0a3d98f1b784fb548057

memory/560-82-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe

MD5 c11f85a2b0977f5d0cb82b54a931bdb0
SHA1 0f17cebed26a4ab0c590aab40f87c6e60468eafd
SHA256 ee4f1ddecbfa190fe8bbf87bfa080752fd0ac3bfbdc0148d6f7a3b9b4672d493
SHA512 8db757a469f6d191ddacf5fc81d04b4f5a9170005fb93a72b0c0d2daebbb3f86420b976cc47ced983710e63c78c4b5bbcd87fe8bb23e0a3d98f1b784fb548057

memory/560-86-0x000000000061F000-0x000000000065D000-memory.dmp

C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe

MD5 c11f85a2b0977f5d0cb82b54a931bdb0
SHA1 0f17cebed26a4ab0c590aab40f87c6e60468eafd
SHA256 ee4f1ddecbfa190fe8bbf87bfa080752fd0ac3bfbdc0148d6f7a3b9b4672d493
SHA512 8db757a469f6d191ddacf5fc81d04b4f5a9170005fb93a72b0c0d2daebbb3f86420b976cc47ced983710e63c78c4b5bbcd87fe8bb23e0a3d98f1b784fb548057

memory/1536-94-0x00000000004085D0-mapping.dmp

C:\Users\Admin\AppData\Roaming\tapinterface\tap.exe

MD5 c11f85a2b0977f5d0cb82b54a931bdb0
SHA1 0f17cebed26a4ab0c590aab40f87c6e60468eafd
SHA256 ee4f1ddecbfa190fe8bbf87bfa080752fd0ac3bfbdc0148d6f7a3b9b4672d493
SHA512 8db757a469f6d191ddacf5fc81d04b4f5a9170005fb93a72b0c0d2daebbb3f86420b976cc47ced983710e63c78c4b5bbcd87fe8bb23e0a3d98f1b784fb548057

memory/1536-101-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1348-103-0x0000000000400000-0x00000000004BB000-memory.dmp

memory/1348-104-0x0000000000400000-0x00000000004BB000-memory.dmp

memory/1348-106-0x0000000000400000-0x00000000004BB000-memory.dmp

memory/1348-107-0x0000000000400000-0x00000000004BB000-memory.dmp

memory/1348-108-0x00000000004B8720-mapping.dmp

memory/1600-110-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1348-109-0x0000000000400000-0x00000000004BB000-memory.dmp

memory/1348-112-0x0000000000400000-0x00000000004BB000-memory.dmp

memory/1348-113-0x0000000000400000-0x00000000004BB000-memory.dmp

memory/1348-114-0x0000000000400000-0x00000000004BB000-memory.dmp

memory/1536-115-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1348-116-0x0000000000400000-0x00000000004BB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-19 15:03

Reported

2022-10-19 16:42

Platform

win10v2004-20220812-en

Max time kernel

176s

Max time network

198s

Command Line

"C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe"

Signatures

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe

"C:\Users\Admin\AppData\Local\Temp\bb7f3eda45f6778f485ba585195cad9cfd7535ea0d5ec26962abafe7034cb706.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4676 -ip 4676

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 464

Network

Country Destination Domain Proto
US 93.184.220.29:80 tcp
NL 95.101.78.106:80 tcp
US 20.44.10.122:443 tcp
US 72.21.81.240:80 tcp
NL 104.110.191.133:80 tcp
NL 104.110.191.133:80 tcp
NL 104.110.191.133:80 tcp

Files

N/A