Malware Analysis Report

2024-08-06 19:34

Sample ID 221123-pxbh7acd78
Target f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166
SHA256 f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166
Tags
darkcomet billy persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166

Threat Level: Known bad

The file f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166 was found to be: Known bad.

Malicious Activity Summary

darkcomet billy persistence rat trojan

Darkcomet

Adds Run key to start application

Suspicious use of SetThreadContext

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V6

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Registry Run Keys / Startup Folder
T1060
Privilege Escalation
TA0004
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040

Analysis: static1

Detonation Overview

Reported

2022-11-23 12:42

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2022-11-23 12:42

Reported

2022-11-23 13:29

Platform

win10v2004-20220812-en

Max time kernel

167s

Max time network

186s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe"

Signatures

Darkcomet

trojan rat darkcomet

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Aint-botkiller = "C:\\Users\\Admin\\AppData\\Roaming\\HJUutrhd.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1380 set thread context of 5008 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: 34 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: 35 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: 36 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1380 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1380 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1380 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 792 wrote to memory of 4660 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 792 wrote to memory of 4660 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 792 wrote to memory of 4660 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1380 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1380 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1380 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1380 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1380 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1380 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1380 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1380 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1380 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1380 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1380 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1380 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1380 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1380 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1380 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\SysWOW64\cmd.exe
PID 1380 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\SysWOW64\cmd.exe
PID 1380 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\SysWOW64\cmd.exe
PID 4828 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4828 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4828 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe

"C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dipazz16.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF33F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF33E.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Aint-botkiller" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\HJUutrhd.exe

C:\Windows\SysWOW64\reg.exe

reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Aint-botkiller" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\HJUutrhd.exe

Network

Country Destination Domain Proto
N/A 104.110.191.133:80 tcp
N/A 52.109.8.44:443 tcp
N/A 93.184.220.29:80 tcp
N/A 20.42.65.89:443 tcp
N/A 8.8.8.8:53 withgod.hopper.pw udp
N/A 72.52.215.31:5666 withgod.hopper.pw tcp
N/A 93.184.220.29:80 tcp
N/A 72.52.215.31:5666 withgod.hopper.pw tcp
N/A 104.110.191.133:80 tcp
N/A 104.110.191.133:80 tcp
N/A 72.52.215.31:5666 withgod.hopper.pw tcp
N/A 72.52.215.31:5666 withgod.hopper.pw tcp
N/A 8.8.8.8:53 14.110.152.52.in-addr.arpa udp
N/A 8.8.8.8:53 withgod.hopper.pw udp
N/A 72.52.215.31:5666 withgod.hopper.pw tcp
N/A 72.52.215.31:5666 withgod.hopper.pw tcp
N/A 72.52.215.31:5666 withgod.hopper.pw tcp

Files

memory/1380-132-0x0000000074A00000-0x0000000074FB1000-memory.dmp

memory/792-133-0x0000000000000000-mapping.dmp

\??\c:\Users\Admin\AppData\Local\Temp\dipazz16.cmdline

MD5 c5a022328fcc6e4e34597a0156c34411
SHA1 1ef11d7addc3e84fb769ea08dd60ca81dde9d2c7
SHA256 480d54d4c3fd66c0c22822ab57bac5bff19a88ed615390d622d905740968889c
SHA512 51a42f3858b69de9edd36a62af137e592de11452d52032cb34537973f8487fb85f07dffd90035d0306f85687e7f9cb67311caf22f930cdf767c5119a4ba900be

\??\c:\Users\Admin\AppData\Local\Temp\tmpECA7.tmp.txt

MD5 43b6e00e59849a715aa70242fd3a1a27
SHA1 51b7b6f9df46e55c8bf0be19ad64fd4b9f6daca7
SHA256 4d3b6444d5836a77a384adf3d4ea012aab10c1a853dae213564a8860e1f8501a
SHA512 65c20f055921c0365787f12d5a48ba8956e604a76b4307535526f98e0b9a9cd297b3e9c6d86224cf88e0b5ff1b2a0e0a75630607b7fe19520c142a2462c6ac04

memory/4660-136-0x0000000000000000-mapping.dmp

\??\c:\Users\Admin\AppData\Local\Temp\CSCF33E.tmp

MD5 17fe15ae6e1385cb3747b2f64a7a1d08
SHA1 809271dd07721e3c7f0d08428a0522e0ceb12610
SHA256 ad662685a85c99a2b0864c542864be35984f8a051c4857dab299c73b0fd8d3f5
SHA512 5e8a8ebbf02557cc40a9024b889b71c40c503087f67248154aa25ea3ccdc38954b269d03e113f133cc964504a356c11b79e9758142aa5e3a5785a3c9cc9c477e

C:\Users\Admin\AppData\Local\Temp\RESF33F.tmp

MD5 7756c25def240e0f6eca5a85270fa2b4
SHA1 a8616339ce5dceeb5da81fdecbee7eb59c8ffc39
SHA256 b4ff6f5549180944143ceb7a9215c00f0765c7b4e86d15bd55b2bb3814ccda80
SHA512 93539f873ea0989d5b94843b3b84755a00b83d1bca3b630e81f172a8e01283ac5b8cb3c06af101bb3dde29770ab3605434ebf1b82487de9f7cc8d36031092419

C:\Users\Admin\AppData\Local\Temp\dipazz16.dll

MD5 e61cc6944d62363b82162c8bec3135e9
SHA1 6f2edad059b4399a1489317518886cb6363290c4
SHA256 05cc38a25c063ae22b21a810758e192c2b71330224cc15b6a866825234555966
SHA512 60b7ef31627344570c75446aba55c0e7c58b69cceb359bd28ab61eb5a7f8f1e243eb60cff189392d077a640f01a08db596fb14e464204b0319ea6d54babbbbd0

memory/5008-140-0x0000000000000000-mapping.dmp

memory/5008-141-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/5008-142-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/5008-143-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/5008-145-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/5008-147-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/5008-148-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/5008-149-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/5008-152-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/4828-151-0x0000000000000000-mapping.dmp

memory/5008-153-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/2896-154-0x0000000000000000-mapping.dmp

memory/5008-155-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/1380-156-0x0000000074A00000-0x0000000074FB1000-memory.dmp

memory/5008-157-0x0000000000400000-0x00000000004B2000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2022-11-23 12:42

Reported

2022-11-23 13:32

Platform

win7-20221111-en

Max time kernel

241s

Max time network

336s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe"

Signatures

Darkcomet

trojan rat darkcomet

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Aint-botkiller = "C:\\Users\\Admin\\AppData\\Roaming\\XkwpEYEt.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1500 set thread context of 1724 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: 34 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A
Token: 35 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1500 wrote to memory of 680 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1500 wrote to memory of 680 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1500 wrote to memory of 680 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1500 wrote to memory of 680 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 680 wrote to memory of 296 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 680 wrote to memory of 296 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 680 wrote to memory of 296 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 680 wrote to memory of 296 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1500 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1500 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1500 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1500 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1500 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1500 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1500 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1500 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1500 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1500 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1500 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1500 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1500 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1500 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1500 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1500 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe
PID 1500 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\SysWOW64\cmd.exe
PID 1500 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\SysWOW64\cmd.exe
PID 1500 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\SysWOW64\cmd.exe
PID 1500 wrote to memory of 996 N/A C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe C:\Windows\SysWOW64\cmd.exe
PID 996 wrote to memory of 808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 996 wrote to memory of 808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 996 wrote to memory of 808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 996 wrote to memory of 808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe

"C:\Users\Admin\AppData\Local\Temp\f53947b5df2c10ef35d22e6fca08f9028fe1ff56a5adac17e6b457af3a347166.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qbj4wfmc.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES26F3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC26E3.tmp"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\applaunch.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Aint-botkiller" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\XkwpEYEt.exe

C:\Windows\SysWOW64\reg.exe

reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Aint-botkiller" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\XkwpEYEt.exe

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 withgod.hopper.pw udp
N/A 72.52.215.31:5666 withgod.hopper.pw tcp
N/A 72.52.215.31:5666 withgod.hopper.pw tcp
N/A 72.52.215.31:5666 withgod.hopper.pw tcp
N/A 72.52.215.31:5666 withgod.hopper.pw tcp
N/A 72.52.215.31:5666 withgod.hopper.pw tcp
N/A 72.52.215.31:5666 withgod.hopper.pw tcp

Files

memory/1500-54-0x0000000074FA1000-0x0000000074FA3000-memory.dmp

memory/1500-55-0x0000000073FA0000-0x000000007454B000-memory.dmp

memory/680-56-0x0000000000000000-mapping.dmp

\??\c:\Users\Admin\AppData\Local\Temp\qbj4wfmc.cmdline

MD5 da365c78ef0fbed6bceead57741d73b5
SHA1 dba4c261ce688ccd2d11e2eddcb75afce4a44320
SHA256 286fc1a667185ef471c490623a30d90141216d8d630dab96cd69089249e98332
SHA512 df97e4d7c5c04bea25f1a62ef177df86b8fc4ac502a0aed371a1ecc86ceaa7fda8727e9d13c786e946eedb9e1870d06aaea72bd547a09b639284f07afd839361

\??\c:\Users\Admin\AppData\Local\Temp\tmpD4AE.tmp.txt

MD5 43b6e00e59849a715aa70242fd3a1a27
SHA1 51b7b6f9df46e55c8bf0be19ad64fd4b9f6daca7
SHA256 4d3b6444d5836a77a384adf3d4ea012aab10c1a853dae213564a8860e1f8501a
SHA512 65c20f055921c0365787f12d5a48ba8956e604a76b4307535526f98e0b9a9cd297b3e9c6d86224cf88e0b5ff1b2a0e0a75630607b7fe19520c142a2462c6ac04

memory/296-59-0x0000000000000000-mapping.dmp

\??\c:\Users\Admin\AppData\Local\Temp\CSC26E3.tmp

MD5 710ea43addea430e3a040e5a946d63f2
SHA1 fc14f8cfabe9d0e740fee99d2083895de6be23de
SHA256 cb0ca03616598e58e22dff2d606968673ce6a5ec5afc7629271075443819b09b
SHA512 9b2e969bf82aae90c59c9f337c7d1f1df35650253fbf46be4568d11fb8db1c0db949132bd7801138f07c99e8ca9b48a5333909577843f59b980b872ae7359e37

C:\Users\Admin\AppData\Local\Temp\RES26F3.tmp

MD5 06ee99489e7555728f84de05c741fb26
SHA1 f461f66185cc4b70fa44ca6220a9717dde3ee7ae
SHA256 e94d38d6873992b34e60d7568349cbc8b02bba1a6d146aa4fc711325bbe855c0
SHA512 9416ef51d6020ef0e662cfa67ba34a18c04f02e2b7959ba857b65937c37929781b357f644aad40ec2362441e035ad61d8ff7d927c1eadf668906bc58fd8171ec

C:\Users\Admin\AppData\Local\Temp\qbj4wfmc.dll

MD5 42840dbe0a60600dd0f321440989c101
SHA1 4f559910f180c154a143c1bbe018828c7937e6bc
SHA256 2648a726d12c4654ff8ce0502fbd423c0c0fa8e3145d86da5fd097dc8c3aa1df
SHA512 ef126a6880b2f30ce3c2f84a2a6d3db4036d39ad08ce01c025c2fb0a46f26a9609eb5815f241e392bf32aa72255f49fbd6ac6a65660a74ecc0bd750eac43f1fe

memory/1724-63-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/1724-64-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/1724-66-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/1724-69-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/1724-72-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/1724-76-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/1724-79-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/1724-82-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/1500-84-0x0000000073FA0000-0x000000007454B000-memory.dmp

memory/1724-86-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/1724-88-0x000000000048F888-mapping.dmp

memory/1724-89-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/996-91-0x0000000000000000-mapping.dmp

memory/808-93-0x0000000000000000-mapping.dmp

memory/1724-92-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/1724-95-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/1724-96-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/1724-97-0x0000000000400000-0x00000000004B2000-memory.dmp