Analysis
-
max time kernel
153s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2022 02:02
Static task
static1
Behavioral task
behavioral1
Sample
4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe
Resource
win10v2004-20220812-en
General
-
Target
4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe
-
Size
1.1MB
-
MD5
058d38212447c0e8164820368f6f3d6f
-
SHA1
8f2d6bc502fd1c863ff962dd8e59c10558017507
-
SHA256
4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75
-
SHA512
f8e569fa81ff401c340bf3367ce86113c7c4fec76e52a170b7fdd102a19c9e22ae4fce97fd843a34bd6a5b8d154b8df055395abd5490d8eedd1cdd7c5a287118
-
SSDEEP
24576:LSZxSDTIfGPjHX6AqVizETalNJiKPDtM+oXB5uc2zedaa4k9+slgf:LSTOTr36AqAzaWMFR5oadaagso
Malware Config
Extracted
darkcomet
01
geoecon.no-ip.org:1604
DC_MUTEX-CZN9ESJ
-
InstallPath
Temps\msdcsc.exe
-
gencode
BdpaYroRpCHK
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
svhost
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Temps\\msdcsc.exe" 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe -
ACProtect 1.3x - 1.4x DLL software 15 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\wbi12DC.tmp acprotect C:\Users\Admin\AppData\Local\Temp\wbi12DC.tmp acprotect C:\Users\Admin\AppData\Local\Temp\wbi12DC.tmp acprotect C:\Users\Admin\AppData\Local\Temp\wbi12DC.tmp acprotect C:\Users\Admin\AppData\Local\Temp\wbi12DC.tmp acprotect C:\Users\Admin\AppData\Local\Temp\wbi12DC.tmp acprotect C:\Users\Admin\AppData\Local\Temp\wbi12DC.tmp acprotect C:\Users\Admin\AppData\Local\Temp\wbi12DC.tmp acprotect C:\Users\Admin\AppData\Local\Temp\ddi271F.tmp acprotect C:\Users\Admin\AppData\Local\Temp\ddi271F.tmp acprotect C:\Users\Admin\AppData\Local\Temp\ddi271F.tmp acprotect C:\Users\Admin\AppData\Local\Temp\ddi271F.tmp acprotect C:\Users\Admin\AppData\Local\Temp\ddi271F.tmp acprotect C:\Users\Admin\AppData\Local\Temp\ddi271F.tmp acprotect C:\Users\Admin\AppData\Local\Temp\ddi271F.tmp acprotect -
Executes dropped EXE 5 IoCs
Processes:
thomson.exemsdcsc.exemsdcsc.exemsdcsc.exethomson.exepid process 1656 thomson.exe 4944 msdcsc.exe 5012 msdcsc.exe 1880 msdcsc.exe 1268 thomson.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exemsdcsc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation msdcsc.exe -
Loads dropped DLL 13 IoCs
Processes:
thomson.exemsdcsc.exemsdcsc.exenotepad.exethomson.exepid process 1656 thomson.exe 1656 thomson.exe 5012 msdcsc.exe 5012 msdcsc.exe 1880 msdcsc.exe 1880 msdcsc.exe 2080 notepad.exe 1268 thomson.exe 1268 thomson.exe 1656 thomson.exe 1656 thomson.exe 2080 notepad.exe 2080 notepad.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Windows\\system32\\Temps\\msdcsc.exe" 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe -
Drops file in System32 directory 3 IoCs
Processes:
4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exedescription ioc process File created C:\Windows\SysWOW64\Temps\msdcsc.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe File opened for modification C:\Windows\SysWOW64\Temps\msdcsc.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe File opened for modification C:\Windows\SysWOW64\Temps\ 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exemsdcsc.exemsdcsc.exedescription pid process target process PID 4772 set thread context of 4620 4772 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 4620 set thread context of 2360 4620 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 4944 set thread context of 5012 4944 msdcsc.exe msdcsc.exe PID 5012 set thread context of 1880 5012 msdcsc.exe msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 2360 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeSecurityPrivilege 2360 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeTakeOwnershipPrivilege 2360 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeLoadDriverPrivilege 2360 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeSystemProfilePrivilege 2360 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeSystemtimePrivilege 2360 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeProfSingleProcessPrivilege 2360 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeIncBasePriorityPrivilege 2360 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeCreatePagefilePrivilege 2360 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeBackupPrivilege 2360 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeRestorePrivilege 2360 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeShutdownPrivilege 2360 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeDebugPrivilege 2360 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeSystemEnvironmentPrivilege 2360 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeChangeNotifyPrivilege 2360 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeRemoteShutdownPrivilege 2360 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeUndockPrivilege 2360 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeManageVolumePrivilege 2360 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeImpersonatePrivilege 2360 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeCreateGlobalPrivilege 2360 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: 33 2360 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: 34 2360 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: 35 2360 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: 36 2360 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe Token: SeIncreaseQuotaPrivilege 1880 msdcsc.exe Token: SeSecurityPrivilege 1880 msdcsc.exe Token: SeTakeOwnershipPrivilege 1880 msdcsc.exe Token: SeLoadDriverPrivilege 1880 msdcsc.exe Token: SeSystemProfilePrivilege 1880 msdcsc.exe Token: SeSystemtimePrivilege 1880 msdcsc.exe Token: SeProfSingleProcessPrivilege 1880 msdcsc.exe Token: SeIncBasePriorityPrivilege 1880 msdcsc.exe Token: SeCreatePagefilePrivilege 1880 msdcsc.exe Token: SeBackupPrivilege 1880 msdcsc.exe Token: SeRestorePrivilege 1880 msdcsc.exe Token: SeShutdownPrivilege 1880 msdcsc.exe Token: SeDebugPrivilege 1880 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1880 msdcsc.exe Token: SeChangeNotifyPrivilege 1880 msdcsc.exe Token: SeRemoteShutdownPrivilege 1880 msdcsc.exe Token: SeUndockPrivilege 1880 msdcsc.exe Token: SeManageVolumePrivilege 1880 msdcsc.exe Token: SeImpersonatePrivilege 1880 msdcsc.exe Token: SeCreateGlobalPrivilege 1880 msdcsc.exe Token: 33 1880 msdcsc.exe Token: 34 1880 msdcsc.exe Token: 35 1880 msdcsc.exe Token: 36 1880 msdcsc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
thomson.exemsdcsc.exethomson.exepid process 1656 thomson.exe 1880 msdcsc.exe 1268 thomson.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exemsdcsc.exemsdcsc.exemsdcsc.exedescription pid process target process PID 4772 wrote to memory of 4620 4772 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 4772 wrote to memory of 4620 4772 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 4772 wrote to memory of 4620 4772 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 4772 wrote to memory of 4620 4772 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 4772 wrote to memory of 4620 4772 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 4772 wrote to memory of 4620 4772 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 4772 wrote to memory of 4620 4772 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 4772 wrote to memory of 4620 4772 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 4772 wrote to memory of 4620 4772 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 4772 wrote to memory of 4620 4772 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 4772 wrote to memory of 4620 4772 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 4620 wrote to memory of 2360 4620 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 4620 wrote to memory of 2360 4620 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 4620 wrote to memory of 2360 4620 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 4620 wrote to memory of 2360 4620 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 4620 wrote to memory of 2360 4620 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 4620 wrote to memory of 2360 4620 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 4620 wrote to memory of 2360 4620 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 4620 wrote to memory of 2360 4620 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 4620 wrote to memory of 2360 4620 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 4620 wrote to memory of 2360 4620 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 4620 wrote to memory of 2360 4620 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 4620 wrote to memory of 2360 4620 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 4620 wrote to memory of 2360 4620 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 4620 wrote to memory of 2360 4620 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe PID 4620 wrote to memory of 1656 4620 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe thomson.exe PID 4620 wrote to memory of 1656 4620 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe thomson.exe PID 4620 wrote to memory of 1656 4620 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe thomson.exe PID 2360 wrote to memory of 4944 2360 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe msdcsc.exe PID 2360 wrote to memory of 4944 2360 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe msdcsc.exe PID 2360 wrote to memory of 4944 2360 4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe msdcsc.exe PID 4944 wrote to memory of 5012 4944 msdcsc.exe msdcsc.exe PID 4944 wrote to memory of 5012 4944 msdcsc.exe msdcsc.exe PID 4944 wrote to memory of 5012 4944 msdcsc.exe msdcsc.exe PID 4944 wrote to memory of 5012 4944 msdcsc.exe msdcsc.exe PID 4944 wrote to memory of 5012 4944 msdcsc.exe msdcsc.exe PID 4944 wrote to memory of 5012 4944 msdcsc.exe msdcsc.exe PID 4944 wrote to memory of 5012 4944 msdcsc.exe msdcsc.exe PID 4944 wrote to memory of 5012 4944 msdcsc.exe msdcsc.exe PID 4944 wrote to memory of 5012 4944 msdcsc.exe msdcsc.exe PID 4944 wrote to memory of 5012 4944 msdcsc.exe msdcsc.exe PID 4944 wrote to memory of 5012 4944 msdcsc.exe msdcsc.exe PID 5012 wrote to memory of 1880 5012 msdcsc.exe msdcsc.exe PID 5012 wrote to memory of 1880 5012 msdcsc.exe msdcsc.exe PID 5012 wrote to memory of 1880 5012 msdcsc.exe msdcsc.exe PID 5012 wrote to memory of 1880 5012 msdcsc.exe msdcsc.exe PID 5012 wrote to memory of 1880 5012 msdcsc.exe msdcsc.exe PID 5012 wrote to memory of 1880 5012 msdcsc.exe msdcsc.exe PID 5012 wrote to memory of 1880 5012 msdcsc.exe msdcsc.exe PID 5012 wrote to memory of 1880 5012 msdcsc.exe msdcsc.exe PID 5012 wrote to memory of 1880 5012 msdcsc.exe msdcsc.exe PID 5012 wrote to memory of 1880 5012 msdcsc.exe msdcsc.exe PID 5012 wrote to memory of 1880 5012 msdcsc.exe msdcsc.exe PID 5012 wrote to memory of 1880 5012 msdcsc.exe msdcsc.exe PID 5012 wrote to memory of 1880 5012 msdcsc.exe msdcsc.exe PID 5012 wrote to memory of 1880 5012 msdcsc.exe msdcsc.exe PID 1880 wrote to memory of 2080 1880 msdcsc.exe notepad.exe PID 1880 wrote to memory of 2080 1880 msdcsc.exe notepad.exe PID 1880 wrote to memory of 2080 1880 msdcsc.exe notepad.exe PID 1880 wrote to memory of 2080 1880 msdcsc.exe notepad.exe PID 1880 wrote to memory of 2080 1880 msdcsc.exe notepad.exe PID 1880 wrote to memory of 2080 1880 msdcsc.exe notepad.exe PID 1880 wrote to memory of 2080 1880 msdcsc.exe notepad.exe PID 1880 wrote to memory of 2080 1880 msdcsc.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe"C:\Users\Admin\AppData\Local\Temp\4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe"C:\Users\Admin\AppData\Local\Temp\4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe"C:\Users\Admin\AppData\Local\Temp\4787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75.exe"3⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Temps\msdcsc.exe"C:\Windows\system32\Temps\msdcsc.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Temps\msdcsc.exe"C:\Windows\SysWOW64\Temps\msdcsc.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Temps\msdcsc.exe"C:\Windows\SysWOW64\Temps\msdcsc.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad7⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\thomson.exe"C:\Users\Admin\AppData\Local\Temp\thomson.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\thomson.exe"C:\Users\Admin\AppData\Local\Temp\thomson.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ddi271F.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Users\Admin\AppData\Local\Temp\ddi271F.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Users\Admin\AppData\Local\Temp\ddi271F.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Users\Admin\AppData\Local\Temp\ddi271F.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Users\Admin\AppData\Local\Temp\ddi271F.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Users\Admin\AppData\Local\Temp\ddi271F.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Users\Admin\AppData\Local\Temp\ddi271F.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Users\Admin\AppData\Local\Temp\thomson.exeFilesize
334KB
MD5a029673ea8625b53a9698310eb95f04e
SHA1b84b27c7a11c86eaab02ff87c31c474b8945decf
SHA2563d2686496c8bc524339f26e471bfea0a17a4c186c632da468ac44460f871aef8
SHA512aa686e600a9bb0b1f93c6c9278c409db4d3236ebf42e4270b893bf19f24576a6e676c631be30787226b11c01e42b09811ba6f9210b1ff6feecc24d3645fbeb1c
-
C:\Users\Admin\AppData\Local\Temp\thomson.exeFilesize
334KB
MD5a029673ea8625b53a9698310eb95f04e
SHA1b84b27c7a11c86eaab02ff87c31c474b8945decf
SHA2563d2686496c8bc524339f26e471bfea0a17a4c186c632da468ac44460f871aef8
SHA512aa686e600a9bb0b1f93c6c9278c409db4d3236ebf42e4270b893bf19f24576a6e676c631be30787226b11c01e42b09811ba6f9210b1ff6feecc24d3645fbeb1c
-
C:\Users\Admin\AppData\Local\Temp\thomson.exeFilesize
334KB
MD5a029673ea8625b53a9698310eb95f04e
SHA1b84b27c7a11c86eaab02ff87c31c474b8945decf
SHA2563d2686496c8bc524339f26e471bfea0a17a4c186c632da468ac44460f871aef8
SHA512aa686e600a9bb0b1f93c6c9278c409db4d3236ebf42e4270b893bf19f24576a6e676c631be30787226b11c01e42b09811ba6f9210b1ff6feecc24d3645fbeb1c
-
C:\Users\Admin\AppData\Local\Temp\wbi12DC.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Users\Admin\AppData\Local\Temp\wbi12DC.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Users\Admin\AppData\Local\Temp\wbi12DC.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Users\Admin\AppData\Local\Temp\wbi12DC.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Users\Admin\AppData\Local\Temp\wbi12DC.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Users\Admin\AppData\Local\Temp\wbi12DC.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Users\Admin\AppData\Local\Temp\wbi12DC.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Users\Admin\AppData\Local\Temp\wbi12DC.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\SysWOW64\Temps\msdcsc.exeFilesize
1.1MB
MD5058d38212447c0e8164820368f6f3d6f
SHA18f2d6bc502fd1c863ff962dd8e59c10558017507
SHA2564787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75
SHA512f8e569fa81ff401c340bf3367ce86113c7c4fec76e52a170b7fdd102a19c9e22ae4fce97fd843a34bd6a5b8d154b8df055395abd5490d8eedd1cdd7c5a287118
-
C:\Windows\SysWOW64\Temps\msdcsc.exeFilesize
1.1MB
MD5058d38212447c0e8164820368f6f3d6f
SHA18f2d6bc502fd1c863ff962dd8e59c10558017507
SHA2564787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75
SHA512f8e569fa81ff401c340bf3367ce86113c7c4fec76e52a170b7fdd102a19c9e22ae4fce97fd843a34bd6a5b8d154b8df055395abd5490d8eedd1cdd7c5a287118
-
C:\Windows\SysWOW64\Temps\msdcsc.exeFilesize
1.1MB
MD5058d38212447c0e8164820368f6f3d6f
SHA18f2d6bc502fd1c863ff962dd8e59c10558017507
SHA2564787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75
SHA512f8e569fa81ff401c340bf3367ce86113c7c4fec76e52a170b7fdd102a19c9e22ae4fce97fd843a34bd6a5b8d154b8df055395abd5490d8eedd1cdd7c5a287118
-
C:\Windows\SysWOW64\Temps\msdcsc.exeFilesize
1.1MB
MD5058d38212447c0e8164820368f6f3d6f
SHA18f2d6bc502fd1c863ff962dd8e59c10558017507
SHA2564787475f9db3bcd0753330fa904898e5ba4f63401d09a20929036e8ab512ba75
SHA512f8e569fa81ff401c340bf3367ce86113c7c4fec76e52a170b7fdd102a19c9e22ae4fce97fd843a34bd6a5b8d154b8df055395abd5490d8eedd1cdd7c5a287118
-
memory/1268-168-0x0000000000000000-mapping.dmp
-
memory/1268-189-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1268-192-0x00000000023C0000-0x0000000002433000-memory.dmpFilesize
460KB
-
memory/1268-182-0x00000000023C0000-0x0000000002433000-memory.dmpFilesize
460KB
-
memory/1268-176-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1656-193-0x00000000048F0000-0x0000000004963000-memory.dmpFilesize
460KB
-
memory/1656-147-0x00000000006B0000-0x0000000000723000-memory.dmpFilesize
460KB
-
memory/1656-190-0x00000000006B0000-0x0000000000723000-memory.dmpFilesize
460KB
-
memory/1656-148-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1656-183-0x00000000048F0000-0x0000000004963000-memory.dmpFilesize
460KB
-
memory/1656-187-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1656-142-0x0000000000000000-mapping.dmp
-
memory/1880-157-0x0000000000000000-mapping.dmp
-
memory/1880-174-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1880-175-0x0000000002790000-0x0000000002803000-memory.dmpFilesize
460KB
-
memory/1880-188-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2080-173-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/2080-186-0x0000000002E50000-0x0000000002EC3000-memory.dmpFilesize
460KB
-
memory/2080-167-0x0000000000000000-mapping.dmp
-
memory/2080-191-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/2360-137-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2360-136-0x0000000000000000-mapping.dmp
-
memory/2360-138-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2360-140-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2360-141-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4620-135-0x0000000000400000-0x0000000000500000-memory.dmpFilesize
1024KB
-
memory/4620-133-0x0000000000400000-0x0000000000500000-memory.dmpFilesize
1024KB
-
memory/4620-139-0x0000000000400000-0x0000000000500000-memory.dmpFilesize
1024KB
-
memory/4620-132-0x0000000000000000-mapping.dmp
-
memory/4944-149-0x0000000000000000-mapping.dmp
-
memory/5012-171-0x0000000001500000-0x0000000001573000-memory.dmpFilesize
460KB
-
memory/5012-170-0x0000000000400000-0x0000000000500000-memory.dmpFilesize
1024KB
-
memory/5012-152-0x0000000000000000-mapping.dmp