Malware Analysis Report

2025-08-05 15:29

Sample ID 221019-ss5s1sdhem
Target ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782
SHA256 ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782
Tags
darkcomet persistence rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782

Threat Level: Known bad

The file ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782 was found to be: Known bad.

Malicious Activity Summary

darkcomet persistence rat trojan upx

Darkcomet

Executes dropped EXE

UPX packed file

Loads dropped DLL

Checks BIOS information in registry

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

NTFS ADS

Checks processor information in registry

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-19 15:24

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-19 15:24

Reported

2022-10-19 17:01

Platform

win7-20220812-en

Max time kernel

168s

Max time network

68s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe"

Signatures

Darkcomet

trojan rat darkcomet

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft? Windows? Operating System = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\Credentials\\audiodgi.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2024 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\cmd.exe
PID 2024 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\cmd.exe
PID 2024 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\cmd.exe
PID 2024 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\cmd.exe
PID 2024 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe
PID 2024 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe
PID 2024 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe
PID 2024 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe
PID 2024 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe
PID 2024 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe
PID 2024 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe
PID 2024 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe
PID 2024 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe
PID 2024 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe
PID 2024 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe
PID 2024 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe
PID 1364 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 1364 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 1364 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 1364 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 1364 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 1364 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 1364 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 1364 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 1364 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 1364 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 1364 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 1364 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 1364 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 1364 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 1364 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 1364 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 1364 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 1364 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 1364 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 1364 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 1364 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 1364 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 1364 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 1676 wrote to memory of 880 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe
PID 1676 wrote to memory of 880 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe
PID 1676 wrote to memory of 880 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe
PID 1676 wrote to memory of 880 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe
PID 880 wrote to memory of 804 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe
PID 880 wrote to memory of 804 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe
PID 880 wrote to memory of 804 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe
PID 880 wrote to memory of 804 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe
PID 880 wrote to memory of 804 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe
PID 880 wrote to memory of 804 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe
PID 880 wrote to memory of 804 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe
PID 880 wrote to memory of 804 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe

"C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd"

C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe

ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe

wmpmetwk.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 respe3ct.no-ip.biz udp

Files

memory/2024-54-0x0000000076031000-0x0000000076033000-memory.dmp

memory/2024-55-0x0000000074360000-0x000000007490B000-memory.dmp

memory/2004-56-0x0000000000000000-mapping.dmp

memory/1364-57-0x0000000013140000-0x000000001320B000-memory.dmp

memory/1364-58-0x0000000013140000-0x000000001320B000-memory.dmp

memory/1364-60-0x0000000013140000-0x000000001320B000-memory.dmp

memory/1364-62-0x0000000013140000-0x000000001320B000-memory.dmp

memory/1364-63-0x0000000013201070-mapping.dmp

memory/1364-64-0x0000000013140000-0x000000001320B000-memory.dmp

memory/1364-66-0x0000000013140000-0x000000001320B000-memory.dmp

memory/1364-67-0x0000000013140000-0x000000001320B000-memory.dmp

memory/1364-68-0x0000000013140000-0x000000001320B000-memory.dmp

\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe

MD5 ee0f561c8a6410b492f0cc3a79547c1e
SHA1 14995bc4eb36ba5169053fb1dba755cbba2bc386
SHA256 9f99ed2c4a40cf80d40682cbc75553396be44fad5ad9c9c4013170d24cb279ba
SHA512 ab8a2cf54d63c1553c532b299ab9dbae630660115e8dd51c28e1a50544bd42904e224fcee18026fe467f87c2ef8f58ecd50f31cf3cab3e0b9050a61552d9c335

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe

MD5 ee0f561c8a6410b492f0cc3a79547c1e
SHA1 14995bc4eb36ba5169053fb1dba755cbba2bc386
SHA256 9f99ed2c4a40cf80d40682cbc75553396be44fad5ad9c9c4013170d24cb279ba
SHA512 ab8a2cf54d63c1553c532b299ab9dbae630660115e8dd51c28e1a50544bd42904e224fcee18026fe467f87c2ef8f58ecd50f31cf3cab3e0b9050a61552d9c335

memory/1676-70-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe

MD5 ee0f561c8a6410b492f0cc3a79547c1e
SHA1 14995bc4eb36ba5169053fb1dba755cbba2bc386
SHA256 9f99ed2c4a40cf80d40682cbc75553396be44fad5ad9c9c4013170d24cb279ba
SHA512 ab8a2cf54d63c1553c532b299ab9dbae630660115e8dd51c28e1a50544bd42904e224fcee18026fe467f87c2ef8f58ecd50f31cf3cab3e0b9050a61552d9c335

memory/364-74-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe

MD5 90ac06a2414f7e75aed6dcb016eb41b0
SHA1 8b2a95f7626309bdf010e90b7319f46ea6f96a4f
SHA256 ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782
SHA512 0b221f4abf897863eed2cd0c7e74f7c89dcc03efd268e1b4a5dcda5c702baece726b037e0063c97693233b62c799cfa656d094994fbf27686de1a88358ecbed4

\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe

MD5 90ac06a2414f7e75aed6dcb016eb41b0
SHA1 8b2a95f7626309bdf010e90b7319f46ea6f96a4f
SHA256 ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782
SHA512 0b221f4abf897863eed2cd0c7e74f7c89dcc03efd268e1b4a5dcda5c702baece726b037e0063c97693233b62c799cfa656d094994fbf27686de1a88358ecbed4

memory/880-79-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe

MD5 90ac06a2414f7e75aed6dcb016eb41b0
SHA1 8b2a95f7626309bdf010e90b7319f46ea6f96a4f
SHA256 ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782
SHA512 0b221f4abf897863eed2cd0c7e74f7c89dcc03efd268e1b4a5dcda5c702baece726b037e0063c97693233b62c799cfa656d094994fbf27686de1a88358ecbed4

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe

MD5 90ac06a2414f7e75aed6dcb016eb41b0
SHA1 8b2a95f7626309bdf010e90b7319f46ea6f96a4f
SHA256 ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782
SHA512 0b221f4abf897863eed2cd0c7e74f7c89dcc03efd268e1b4a5dcda5c702baece726b037e0063c97693233b62c799cfa656d094994fbf27686de1a88358ecbed4

memory/1364-82-0x00000000131C6000-0x0000000013202000-memory.dmp

memory/1676-84-0x0000000074360000-0x000000007490B000-memory.dmp

memory/880-87-0x0000000074360000-0x000000007490B000-memory.dmp

memory/880-90-0x0000000074360000-0x000000007490B000-memory.dmp

memory/804-92-0x0000000013201070-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe

MD5 90ac06a2414f7e75aed6dcb016eb41b0
SHA1 8b2a95f7626309bdf010e90b7319f46ea6f96a4f
SHA256 ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782
SHA512 0b221f4abf897863eed2cd0c7e74f7c89dcc03efd268e1b4a5dcda5c702baece726b037e0063c97693233b62c799cfa656d094994fbf27686de1a88358ecbed4

memory/804-99-0x00000000131C6000-0x0000000013202000-memory.dmp

memory/2024-100-0x0000000074360000-0x000000007490B000-memory.dmp

memory/1364-101-0x00000000131C6000-0x0000000013202000-memory.dmp

memory/1676-102-0x0000000074360000-0x000000007490B000-memory.dmp

memory/880-103-0x0000000074360000-0x000000007490B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-19 15:24

Reported

2022-10-19 17:01

Platform

win10v2004-20220812-en

Max time kernel

176s

Max time network

194s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe"

Signatures

Darkcomet

trojan rat darkcomet

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft? Windows? Operating System = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\Credentials\\audiodgi.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Temp\wmpnetvk.exe:ZONE.identifier C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 900 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\cmd.exe
PID 900 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\cmd.exe
PID 900 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\cmd.exe
PID 900 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe
PID 900 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe
PID 900 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe
PID 900 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe
PID 900 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe
PID 900 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe
PID 900 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe
PID 900 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe
PID 4216 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 4216 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 4216 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 4216 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 4216 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 4216 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 4216 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 4216 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 4216 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 4216 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 4216 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 4216 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 4216 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 4216 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 4216 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 4216 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 4216 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 4216 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 4216 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 4216 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 4216 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 4216 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Windows\SysWOW64\notepad.exe
PID 900 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe
PID 900 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe
PID 900 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe
PID 4604 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe
PID 4604 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe
PID 4604 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe
PID 5000 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe
PID 5000 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe
PID 5000 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe
PID 5000 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe
PID 5000 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe
PID 5000 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe
PID 5000 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe
PID 5000 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe

"C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd"

C:\Users\Admin\AppData\Local\Temp\ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe

ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe

wmpmetwk.exe

Network

Country Destination Domain Proto
US 93.184.221.240:80 tcp
DE 20.52.64.200:443 tcp
US 8.8.8.8:53 respe3ct.no-ip.biz udp
US 8.8.8.8:53 respe3ct.no-ip.biz udp
US 8.8.8.8:53 respe3ct.no-ip.biz udp
US 8.8.8.8:53 respe3ct.no-ip.biz udp
US 8.8.8.8:53 respe3ct.no-ip.biz udp
US 8.8.8.8:53 respe3ct.no-ip.biz udp
US 8.8.8.8:53 respe3ct.no-ip.biz udp
US 8.8.8.8:53 respe3ct.no-ip.biz udp
US 8.8.8.8:53 respe3ct.no-ip.biz udp
US 8.8.8.8:53 respe3ct.no-ip.biz udp
US 8.8.8.8:53 respe3ct.no-ip.biz udp
US 8.8.8.8:53 respe3ct.no-ip.biz udp
US 8.8.8.8:53 respe3ct.no-ip.biz udp
US 8.8.8.8:53 respe3ct.no-ip.biz udp
US 8.8.8.8:53 respe3ct.no-ip.biz udp
US 8.8.8.8:53 respe3ct.no-ip.biz udp
US 8.8.8.8:53 respe3ct.no-ip.biz udp
US 8.8.8.8:53 respe3ct.no-ip.biz udp
US 8.8.8.8:53 respe3ct.no-ip.biz udp
US 8.8.8.8:53 respe3ct.no-ip.biz udp
US 8.8.8.8:53 respe3ct.no-ip.biz udp
US 8.8.8.8:53 respe3ct.no-ip.biz udp
US 8.8.8.8:53 respe3ct.no-ip.biz udp
US 8.8.8.8:53 respe3ct.no-ip.biz udp
US 8.8.8.8:53 respe3ct.no-ip.biz udp
US 8.8.8.8:53 respe3ct.no-ip.biz udp
US 8.8.8.8:53 respe3ct.no-ip.biz udp
US 8.8.8.8:53 respe3ct.no-ip.biz udp
US 8.8.8.8:53 respe3ct.no-ip.biz udp
US 8.8.8.8:53 udp

Files

memory/900-132-0x0000000075310000-0x00000000758C1000-memory.dmp

memory/4984-133-0x0000000000000000-mapping.dmp

memory/4216-134-0x0000000000000000-mapping.dmp

memory/4216-135-0x0000000013140000-0x000000001320B000-memory.dmp

memory/4216-136-0x0000000013140000-0x000000001320B000-memory.dmp

memory/4216-137-0x0000000013140000-0x000000001320B000-memory.dmp

memory/4216-138-0x0000000013140000-0x000000001320B000-memory.dmp

memory/4216-139-0x0000000013140000-0x000000001320B000-memory.dmp

memory/2032-140-0x0000000000000000-mapping.dmp

memory/4604-141-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe

MD5 ee0f561c8a6410b492f0cc3a79547c1e
SHA1 14995bc4eb36ba5169053fb1dba755cbba2bc386
SHA256 9f99ed2c4a40cf80d40682cbc75553396be44fad5ad9c9c4013170d24cb279ba
SHA512 ab8a2cf54d63c1553c532b299ab9dbae630660115e8dd51c28e1a50544bd42904e224fcee18026fe467f87c2ef8f58ecd50f31cf3cab3e0b9050a61552d9c335

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe

MD5 ee0f561c8a6410b492f0cc3a79547c1e
SHA1 14995bc4eb36ba5169053fb1dba755cbba2bc386
SHA256 9f99ed2c4a40cf80d40682cbc75553396be44fad5ad9c9c4013170d24cb279ba
SHA512 ab8a2cf54d63c1553c532b299ab9dbae630660115e8dd51c28e1a50544bd42904e224fcee18026fe467f87c2ef8f58ecd50f31cf3cab3e0b9050a61552d9c335

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe

MD5 90ac06a2414f7e75aed6dcb016eb41b0
SHA1 8b2a95f7626309bdf010e90b7319f46ea6f96a4f
SHA256 ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782
SHA512 0b221f4abf897863eed2cd0c7e74f7c89dcc03efd268e1b4a5dcda5c702baece726b037e0063c97693233b62c799cfa656d094994fbf27686de1a88358ecbed4

memory/5000-145-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe

MD5 90ac06a2414f7e75aed6dcb016eb41b0
SHA1 8b2a95f7626309bdf010e90b7319f46ea6f96a4f
SHA256 ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782
SHA512 0b221f4abf897863eed2cd0c7e74f7c89dcc03efd268e1b4a5dcda5c702baece726b037e0063c97693233b62c799cfa656d094994fbf27686de1a88358ecbed4

memory/3964-147-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe

MD5 90ac06a2414f7e75aed6dcb016eb41b0
SHA1 8b2a95f7626309bdf010e90b7319f46ea6f96a4f
SHA256 ed4473bf72c40216fed4b6ea51e772b4c9847b24a44423adabff5c5dea3fe782
SHA512 0b221f4abf897863eed2cd0c7e74f7c89dcc03efd268e1b4a5dcda5c702baece726b037e0063c97693233b62c799cfa656d094994fbf27686de1a88358ecbed4

memory/4604-154-0x0000000075310000-0x00000000758C1000-memory.dmp

memory/5000-155-0x0000000075310000-0x00000000758C1000-memory.dmp

memory/900-156-0x0000000075310000-0x00000000758C1000-memory.dmp

memory/4604-157-0x0000000075310000-0x00000000758C1000-memory.dmp

memory/5000-158-0x0000000075310000-0x00000000758C1000-memory.dmp