Analysis
-
max time kernel
151s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07-11-2022 02:02
Static task
static1
Behavioral task
behavioral1
Sample
4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe
Resource
win10v2004-20220812-en
General
-
Target
4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe
-
Size
1.1MB
-
MD5
058d38212447c0e8164820368f6f3d6f
-
SHA1
8f2d6bc502fd1c863ff962dd8e59c10558017507
-
SHA256
4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75
-
SHA512
f8e569fa81ff401c340bf3367ce86113c7c4fec76e52a170b7fdd102a19c9e22ae4fce97fd843a34bd6a5b8d154b8df055395abd5490d8eedd1cdd7c5a287118
-
SSDEEP
24576:LSZxSDTIfGPjHX6AqVizETalNJiKPDtM+oXB5uc2zedaa4k9+slgf:LSTOTr36AqAzaWMFR5oadaagso
Malware Config
Extracted
darkcomet
01
geoecon.no-ip.org:1604
DC_MUTEX-CZN9ESJ
-
InstallPath
Temps\msdcsc.exe
-
gencode
BdpaYroRpCHK
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
svhost
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Temps\\msdcsc.exe" 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe -
ACProtect 1.3x - 1.4x DLL software 8 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\mak57E.tmp acprotect \Users\Admin\AppData\Local\Temp\mak57E.tmp acprotect C:\Users\Admin\AppData\Local\Temp\mak57E.tmp acprotect \Users\Admin\AppData\Local\Temp\mak57E.tmp acprotect \Users\Admin\AppData\Local\Temp\qbkEA2.tmp acprotect C:\Users\Admin\AppData\Local\Temp\qbkEA2.tmp acprotect \Users\Admin\AppData\Local\Temp\qbkEA2.tmp acprotect \Users\Admin\AppData\Local\Temp\qbkEA2.tmp acprotect -
Executes dropped EXE 5 IoCs
Processes:
thomson.exemsdcsc.exemsdcsc.exemsdcsc.exethomson.exepid process 1148 thomson.exe 728 msdcsc.exe 1108 msdcsc.exe 1076 msdcsc.exe 1352 thomson.exe -
Loads dropped DLL 11 IoCs
Processes:
4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exethomson.exe4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exemsdcsc.exemsdcsc.exethomson.exenotepad.exepid process 1928 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 1928 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 1148 thomson.exe 1292 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 1108 msdcsc.exe 1108 msdcsc.exe 1108 msdcsc.exe 1076 msdcsc.exe 1352 thomson.exe 1148 thomson.exe 1816 notepad.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Windows\\system32\\Temps\\msdcsc.exe" 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe -
Drops file in System32 directory 3 IoCs
Processes:
4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exedescription ioc process File created C:\Windows\SysWOW64\Temps\msdcsc.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe File opened for modification C:\Windows\SysWOW64\Temps\msdcsc.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe File opened for modification C:\Windows\SysWOW64\Temps\ 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exemsdcsc.exemsdcsc.exedescription pid process target process PID 1444 set thread context of 1948 1444 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1948 set thread context of 1928 1948 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1928 set thread context of 1292 1928 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 728 set thread context of 1108 728 msdcsc.exe msdcsc.exe PID 1108 set thread context of 1076 1108 msdcsc.exe msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1292 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeSecurityPrivilege 1292 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeTakeOwnershipPrivilege 1292 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeLoadDriverPrivilege 1292 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeSystemProfilePrivilege 1292 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeSystemtimePrivilege 1292 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeProfSingleProcessPrivilege 1292 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeIncBasePriorityPrivilege 1292 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeCreatePagefilePrivilege 1292 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeBackupPrivilege 1292 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeRestorePrivilege 1292 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeShutdownPrivilege 1292 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeDebugPrivilege 1292 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeSystemEnvironmentPrivilege 1292 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeChangeNotifyPrivilege 1292 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeRemoteShutdownPrivilege 1292 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeUndockPrivilege 1292 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeManageVolumePrivilege 1292 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeImpersonatePrivilege 1292 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeCreateGlobalPrivilege 1292 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: 33 1292 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: 34 1292 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: 35 1292 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeIncreaseQuotaPrivilege 1076 msdcsc.exe Token: SeSecurityPrivilege 1076 msdcsc.exe Token: SeTakeOwnershipPrivilege 1076 msdcsc.exe Token: SeLoadDriverPrivilege 1076 msdcsc.exe Token: SeSystemProfilePrivilege 1076 msdcsc.exe Token: SeSystemtimePrivilege 1076 msdcsc.exe Token: SeProfSingleProcessPrivilege 1076 msdcsc.exe Token: SeIncBasePriorityPrivilege 1076 msdcsc.exe Token: SeCreatePagefilePrivilege 1076 msdcsc.exe Token: SeBackupPrivilege 1076 msdcsc.exe Token: SeRestorePrivilege 1076 msdcsc.exe Token: SeShutdownPrivilege 1076 msdcsc.exe Token: SeDebugPrivilege 1076 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1076 msdcsc.exe Token: SeChangeNotifyPrivilege 1076 msdcsc.exe Token: SeRemoteShutdownPrivilege 1076 msdcsc.exe Token: SeUndockPrivilege 1076 msdcsc.exe Token: SeManageVolumePrivilege 1076 msdcsc.exe Token: SeImpersonatePrivilege 1076 msdcsc.exe Token: SeCreateGlobalPrivilege 1076 msdcsc.exe Token: 33 1076 msdcsc.exe Token: 34 1076 msdcsc.exe Token: 35 1076 msdcsc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
thomson.exemsdcsc.exethomson.exepid process 1148 thomson.exe 1076 msdcsc.exe 1352 thomson.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exemsdcsc.exemsdcsc.exedescription pid process target process PID 1444 wrote to memory of 1948 1444 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1444 wrote to memory of 1948 1444 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1444 wrote to memory of 1948 1444 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1444 wrote to memory of 1948 1444 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1948 wrote to memory of 1928 1948 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1948 wrote to memory of 1928 1948 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1948 wrote to memory of 1928 1948 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1948 wrote to memory of 1928 1948 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1948 wrote to memory of 1928 1948 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1948 wrote to memory of 1928 1948 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1948 wrote to memory of 1928 1948 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1948 wrote to memory of 1928 1948 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1948 wrote to memory of 1928 1948 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1948 wrote to memory of 1928 1948 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1948 wrote to memory of 1928 1948 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1928 wrote to memory of 1292 1928 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1928 wrote to memory of 1292 1928 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1928 wrote to memory of 1292 1928 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1928 wrote to memory of 1292 1928 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1928 wrote to memory of 1292 1928 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1928 wrote to memory of 1292 1928 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1928 wrote to memory of 1292 1928 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1928 wrote to memory of 1292 1928 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1928 wrote to memory of 1292 1928 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1928 wrote to memory of 1292 1928 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1928 wrote to memory of 1292 1928 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1928 wrote to memory of 1292 1928 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1928 wrote to memory of 1292 1928 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 1928 wrote to memory of 1148 1928 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe thomson.exe PID 1928 wrote to memory of 1148 1928 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe thomson.exe PID 1928 wrote to memory of 1148 1928 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe thomson.exe PID 1928 wrote to memory of 1148 1928 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe thomson.exe PID 1292 wrote to memory of 728 1292 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe msdcsc.exe PID 1292 wrote to memory of 728 1292 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe msdcsc.exe PID 1292 wrote to memory of 728 1292 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe msdcsc.exe PID 1292 wrote to memory of 728 1292 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe msdcsc.exe PID 728 wrote to memory of 1108 728 msdcsc.exe msdcsc.exe PID 728 wrote to memory of 1108 728 msdcsc.exe msdcsc.exe PID 728 wrote to memory of 1108 728 msdcsc.exe msdcsc.exe PID 728 wrote to memory of 1108 728 msdcsc.exe msdcsc.exe PID 728 wrote to memory of 1108 728 msdcsc.exe msdcsc.exe PID 728 wrote to memory of 1108 728 msdcsc.exe msdcsc.exe PID 728 wrote to memory of 1108 728 msdcsc.exe msdcsc.exe PID 728 wrote to memory of 1108 728 msdcsc.exe msdcsc.exe PID 728 wrote to memory of 1108 728 msdcsc.exe msdcsc.exe PID 728 wrote to memory of 1108 728 msdcsc.exe msdcsc.exe PID 728 wrote to memory of 1108 728 msdcsc.exe msdcsc.exe PID 1108 wrote to memory of 1076 1108 msdcsc.exe msdcsc.exe PID 1108 wrote to memory of 1076 1108 msdcsc.exe msdcsc.exe PID 1108 wrote to memory of 1076 1108 msdcsc.exe msdcsc.exe PID 1108 wrote to memory of 1076 1108 msdcsc.exe msdcsc.exe PID 1108 wrote to memory of 1076 1108 msdcsc.exe msdcsc.exe PID 1108 wrote to memory of 1076 1108 msdcsc.exe msdcsc.exe PID 1108 wrote to memory of 1076 1108 msdcsc.exe msdcsc.exe PID 1108 wrote to memory of 1076 1108 msdcsc.exe msdcsc.exe PID 1108 wrote to memory of 1076 1108 msdcsc.exe msdcsc.exe PID 1108 wrote to memory of 1076 1108 msdcsc.exe msdcsc.exe PID 1108 wrote to memory of 1076 1108 msdcsc.exe msdcsc.exe PID 1108 wrote to memory of 1076 1108 msdcsc.exe msdcsc.exe PID 1108 wrote to memory of 1076 1108 msdcsc.exe msdcsc.exe PID 1108 wrote to memory of 1352 1108 msdcsc.exe thomson.exe PID 1108 wrote to memory of 1352 1108 msdcsc.exe thomson.exe PID 1108 wrote to memory of 1352 1108 msdcsc.exe thomson.exe PID 1108 wrote to memory of 1352 1108 msdcsc.exe thomson.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe"C:\Users\Admin\AppData\Local\Temp\4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe"C:\Users\Admin\AppData\Local\Temp\4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe"C:\Users\Admin\AppData\Local\Temp\4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe"3⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe"C:\Users\Admin\AppData\Local\Temp\4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe"4⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Temps\msdcsc.exe"C:\Windows\system32\Temps\msdcsc.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Temps\msdcsc.exe"C:\Windows\SysWOW64\Temps\msdcsc.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Temps\msdcsc.exe"C:\Windows\SysWOW64\Temps\msdcsc.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\notepad.exenotepad8⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\thomson.exe"C:\Users\Admin\AppData\Local\Temp\thomson.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\thomson.exe"C:\Users\Admin\AppData\Local\Temp\thomson.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\mak57E.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Users\Admin\AppData\Local\Temp\qbkEA2.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Users\Admin\AppData\Local\Temp\thomson.exeFilesize
334KB
MD5a029673ea8625b53a9698310eb95f04e
SHA1b84b27c7a11c86eaab02ff87c31c474b8945decf
SHA2563d2686496c8bc524339f26e471bfea0a17a4c186c632da468ac44460f871aef8
SHA512aa686e600a9bb0b1f93c6c9278c409db4d3236ebf42e4270b893bf19f24576a6e676c631be30787226b11c01e42b09811ba6f9210b1ff6feecc24d3645fbeb1c
-
C:\Users\Admin\AppData\Local\Temp\thomson.exeFilesize
334KB
MD5a029673ea8625b53a9698310eb95f04e
SHA1b84b27c7a11c86eaab02ff87c31c474b8945decf
SHA2563d2686496c8bc524339f26e471bfea0a17a4c186c632da468ac44460f871aef8
SHA512aa686e600a9bb0b1f93c6c9278c409db4d3236ebf42e4270b893bf19f24576a6e676c631be30787226b11c01e42b09811ba6f9210b1ff6feecc24d3645fbeb1c
-
C:\Users\Admin\AppData\Local\Temp\thomson.exeFilesize
334KB
MD5a029673ea8625b53a9698310eb95f04e
SHA1b84b27c7a11c86eaab02ff87c31c474b8945decf
SHA2563d2686496c8bc524339f26e471bfea0a17a4c186c632da468ac44460f871aef8
SHA512aa686e600a9bb0b1f93c6c9278c409db4d3236ebf42e4270b893bf19f24576a6e676c631be30787226b11c01e42b09811ba6f9210b1ff6feecc24d3645fbeb1c
-
C:\Windows\SysWOW64\Temps\msdcsc.exeFilesize
1.1MB
MD5058d38212447c0e8164820368f6f3d6f
SHA18f2d6bc502fd1c863ff962dd8e59c10558017507
SHA2564787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75
SHA512f8e569fa81ff401c340bf3367ce86113c7c4fec76e52a170b7fdd102a19c9e22ae4fce97fd843a34bd6a5b8d154b8df055395abd5490d8eedd1cdd7c5a287118
-
C:\Windows\SysWOW64\Temps\msdcsc.exeFilesize
1.1MB
MD5058d38212447c0e8164820368f6f3d6f
SHA18f2d6bc502fd1c863ff962dd8e59c10558017507
SHA2564787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75
SHA512f8e569fa81ff401c340bf3367ce86113c7c4fec76e52a170b7fdd102a19c9e22ae4fce97fd843a34bd6a5b8d154b8df055395abd5490d8eedd1cdd7c5a287118
-
C:\Windows\SysWOW64\Temps\msdcsc.exeFilesize
1.1MB
MD5058d38212447c0e8164820368f6f3d6f
SHA18f2d6bc502fd1c863ff962dd8e59c10558017507
SHA2564787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75
SHA512f8e569fa81ff401c340bf3367ce86113c7c4fec76e52a170b7fdd102a19c9e22ae4fce97fd843a34bd6a5b8d154b8df055395abd5490d8eedd1cdd7c5a287118
-
C:\Windows\SysWOW64\Temps\msdcsc.exeFilesize
1.1MB
MD5058d38212447c0e8164820368f6f3d6f
SHA18f2d6bc502fd1c863ff962dd8e59c10558017507
SHA2564787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75
SHA512f8e569fa81ff401c340bf3367ce86113c7c4fec76e52a170b7fdd102a19c9e22ae4fce97fd843a34bd6a5b8d154b8df055395abd5490d8eedd1cdd7c5a287118
-
\Users\Admin\AppData\Local\Temp\mak57E.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
\Users\Admin\AppData\Local\Temp\mak57E.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
\Users\Admin\AppData\Local\Temp\mak57E.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
\Users\Admin\AppData\Local\Temp\qbkEA2.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
\Users\Admin\AppData\Local\Temp\qbkEA2.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
\Users\Admin\AppData\Local\Temp\qbkEA2.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
\Users\Admin\AppData\Local\Temp\thomson.exeFilesize
334KB
MD5a029673ea8625b53a9698310eb95f04e
SHA1b84b27c7a11c86eaab02ff87c31c474b8945decf
SHA2563d2686496c8bc524339f26e471bfea0a17a4c186c632da468ac44460f871aef8
SHA512aa686e600a9bb0b1f93c6c9278c409db4d3236ebf42e4270b893bf19f24576a6e676c631be30787226b11c01e42b09811ba6f9210b1ff6feecc24d3645fbeb1c
-
\Users\Admin\AppData\Local\Temp\thomson.exeFilesize
334KB
MD5a029673ea8625b53a9698310eb95f04e
SHA1b84b27c7a11c86eaab02ff87c31c474b8945decf
SHA2563d2686496c8bc524339f26e471bfea0a17a4c186c632da468ac44460f871aef8
SHA512aa686e600a9bb0b1f93c6c9278c409db4d3236ebf42e4270b893bf19f24576a6e676c631be30787226b11c01e42b09811ba6f9210b1ff6feecc24d3645fbeb1c
-
\Users\Admin\AppData\Local\Temp\thomson.exeFilesize
334KB
MD5a029673ea8625b53a9698310eb95f04e
SHA1b84b27c7a11c86eaab02ff87c31c474b8945decf
SHA2563d2686496c8bc524339f26e471bfea0a17a4c186c632da468ac44460f871aef8
SHA512aa686e600a9bb0b1f93c6c9278c409db4d3236ebf42e4270b893bf19f24576a6e676c631be30787226b11c01e42b09811ba6f9210b1ff6feecc24d3645fbeb1c
-
\Users\Admin\AppData\Local\Temp\thomson.exeFilesize
334KB
MD5a029673ea8625b53a9698310eb95f04e
SHA1b84b27c7a11c86eaab02ff87c31c474b8945decf
SHA2563d2686496c8bc524339f26e471bfea0a17a4c186c632da468ac44460f871aef8
SHA512aa686e600a9bb0b1f93c6c9278c409db4d3236ebf42e4270b893bf19f24576a6e676c631be30787226b11c01e42b09811ba6f9210b1ff6feecc24d3645fbeb1c
-
\Windows\SysWOW64\Temps\msdcsc.exeFilesize
1.1MB
MD5058d38212447c0e8164820368f6f3d6f
SHA18f2d6bc502fd1c863ff962dd8e59c10558017507
SHA2564787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75
SHA512f8e569fa81ff401c340bf3367ce86113c7c4fec76e52a170b7fdd102a19c9e22ae4fce97fd843a34bd6a5b8d154b8df055395abd5490d8eedd1cdd7c5a287118
-
memory/728-98-0x0000000000000000-mapping.dmp
-
memory/1076-130-0x000000000048F888-mapping.dmp
-
memory/1076-144-0x00000000004C0000-0x0000000000533000-memory.dmpFilesize
460KB
-
memory/1076-143-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1076-157-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1108-110-0x0000000000401110-mapping.dmp
-
memory/1108-140-0x0000000000400000-0x0000000000500000-memory.dmpFilesize
1024KB
-
memory/1108-142-0x0000000000810000-0x0000000000883000-memory.dmpFilesize
460KB
-
memory/1108-159-0x0000000000810000-0x0000000000883000-memory.dmpFilesize
460KB
-
memory/1148-96-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1148-94-0x0000000000560000-0x00000000005D3000-memory.dmpFilesize
460KB
-
memory/1148-158-0x0000000000560000-0x00000000005D3000-memory.dmpFilesize
460KB
-
memory/1148-156-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1148-155-0x0000000002DA0000-0x0000000002E13000-memory.dmpFilesize
460KB
-
memory/1148-89-0x0000000000000000-mapping.dmp
-
memory/1292-68-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1292-75-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1292-83-0x000000000048F888-mapping.dmp
-
memory/1292-82-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1292-80-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1292-78-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1292-77-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1292-84-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1292-73-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1292-71-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1292-69-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1292-86-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1292-95-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1352-139-0x0000000000000000-mapping.dmp
-
memory/1352-153-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1352-154-0x0000000000590000-0x0000000000603000-memory.dmpFilesize
460KB
-
memory/1816-146-0x0000000000000000-mapping.dmp
-
memory/1816-152-0x00000000003B0000-0x0000000000423000-memory.dmpFilesize
460KB
-
memory/1928-63-0x0000000000400000-0x0000000000500000-memory.dmpFilesize
1024KB
-
memory/1928-60-0x0000000000400000-0x0000000000500000-memory.dmpFilesize
1024KB
-
memory/1928-59-0x0000000000400000-0x0000000000500000-memory.dmpFilesize
1024KB
-
memory/1928-58-0x0000000000400000-0x0000000000500000-memory.dmpFilesize
1024KB
-
memory/1928-61-0x0000000000400000-0x0000000000500000-memory.dmpFilesize
1024KB
-
memory/1928-64-0x0000000000401110-mapping.dmp
-
memory/1928-66-0x0000000075D71000-0x0000000075D73000-memory.dmpFilesize
8KB
-
memory/1928-92-0x0000000000400000-0x0000000000500000-memory.dmpFilesize
1024KB
-
memory/1928-56-0x0000000000400000-0x0000000000500000-memory.dmpFilesize
1024KB
-
memory/1928-67-0x0000000000400000-0x0000000000500000-memory.dmpFilesize
1024KB
-
memory/1928-55-0x0000000000400000-0x0000000000500000-memory.dmpFilesize
1024KB
-
memory/1948-54-0x0000000000FB188E-mapping.dmp