darkcomet | add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc

General

Target

add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
Size

838KB
MD5

fd9f795b049b201663898b3b840dec32
SHA1

26b4a2d63443b1ea20afab2bead3da3514f92e35
SHA256

add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc
SHA512

df26f973aa106c021e49290e2d949c0e7fea955332838d2f6e8856bde4aa112545413286943d3d9c6a60b16eb5603a693b2a1de103a12608dbb42411c7a9521c
SSDEEP

12288:exy8TP40QeYKbQ4wgMUMDSH+Mf3vW9RLGAcypv69CiGc1uWxU8Fy:UtTP4a1dMDSHytGvMY/qOU

Score

10^/10

darkcomet guest16_min persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16_min

C2

customersservicebx.uni.me:2121

Mutex

DCMIN_MUTEX-UZ6AB7L

Attributes

gencode
s8XX3Rqr3xKD
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Executes dropped EXE 3 IoCs

Processes:

WUDHost.exeAcctres.exeWUDHost.exe

pid process

1780 WUDHost.exe
1700 Acctres.exe
2008 WUDHost.exe
Loads dropped DLL 2 IoCs

Processes:

add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exeWUDHost.exe

pid process

1644 add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1780 WUDHost.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

pid	process
1780	WUDHost.exe
1700	Acctres.exe
2008	WUDHost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WUDHost.exeWUDHost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Boot File Servicing Utility = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WUDHost.exe"	WUDHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Boot File Servicing Utility = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WUDHost.exe"	WUDHost.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exeAcctres.exe

description	pid	process	target process
PID 1644 set thread context of 1332	1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe	vbc.exe
PID 1700 set thread context of 756	1700	Acctres.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exeWUDHost.exeAcctres.exe

pid	process
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1780	WUDHost.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1780	WUDHost.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1780	WUDHost.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1780	WUDHost.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1780	WUDHost.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1780	WUDHost.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1700	Acctres.exe
1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
1700	Acctres.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

Processes:

add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exevbc.exeWUDHost.exeAcctres.exevbc.exeWUDHost.exe

description	pid	process
Token: SeDebugPrivilege	1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
Token: SeIncreaseQuotaPrivilege	1332	vbc.exe
Token: SeSecurityPrivilege	1332	vbc.exe
Token: SeTakeOwnershipPrivilege	1332	vbc.exe
Token: SeLoadDriverPrivilege	1332	vbc.exe
Token: SeSystemProfilePrivilege	1332	vbc.exe
Token: SeSystemtimePrivilege	1332	vbc.exe
Token: SeProfSingleProcessPrivilege	1332	vbc.exe
Token: SeIncBasePriorityPrivilege	1332	vbc.exe
Token: SeCreatePagefilePrivilege	1332	vbc.exe
Token: SeBackupPrivilege	1332	vbc.exe
Token: SeRestorePrivilege	1332	vbc.exe
Token: SeShutdownPrivilege	1332	vbc.exe
Token: SeDebugPrivilege	1332	vbc.exe
Token: SeSystemEnvironmentPrivilege	1332	vbc.exe
Token: SeChangeNotifyPrivilege	1332	vbc.exe
Token: SeRemoteShutdownPrivilege	1332	vbc.exe
Token: SeUndockPrivilege	1332	vbc.exe
Token: SeManageVolumePrivilege	1332	vbc.exe
Token: SeImpersonatePrivilege	1332	vbc.exe
Token: SeCreateGlobalPrivilege	1332	vbc.exe
Token: 33	1332	vbc.exe
Token: 34	1332	vbc.exe
Token: 35	1332	vbc.exe
Token: SeDebugPrivilege	1780	WUDHost.exe
Token: SeDebugPrivilege	1700	Acctres.exe
Token: SeIncreaseQuotaPrivilege	756	vbc.exe
Token: SeSecurityPrivilege	756	vbc.exe
Token: SeTakeOwnershipPrivilege	756	vbc.exe
Token: SeLoadDriverPrivilege	756	vbc.exe
Token: SeSystemProfilePrivilege	756	vbc.exe
Token: SeSystemtimePrivilege	756	vbc.exe
Token: SeProfSingleProcessPrivilege	756	vbc.exe
Token: SeIncBasePriorityPrivilege	756	vbc.exe
Token: SeCreatePagefilePrivilege	756	vbc.exe
Token: SeBackupPrivilege	756	vbc.exe
Token: SeRestorePrivilege	756	vbc.exe
Token: SeShutdownPrivilege	756	vbc.exe
Token: SeDebugPrivilege	756	vbc.exe
Token: SeSystemEnvironmentPrivilege	756	vbc.exe
Token: SeChangeNotifyPrivilege	756	vbc.exe
Token: SeRemoteShutdownPrivilege	756	vbc.exe
Token: SeUndockPrivilege	756	vbc.exe
Token: SeManageVolumePrivilege	756	vbc.exe
Token: SeImpersonatePrivilege	756	vbc.exe
Token: SeCreateGlobalPrivilege	756	vbc.exe
Token: 33	756	vbc.exe
Token: 34	756	vbc.exe
Token: 35	756	vbc.exe
Token: SeDebugPrivilege	2008	WUDHost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

1332 vbc.exe

pid	process
1332	vbc.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exeWUDHost.exeAcctres.exe

description	pid	process	target process
PID 1644 wrote to memory of 1332	1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe	vbc.exe
PID 1644 wrote to memory of 1332	1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe	vbc.exe
PID 1644 wrote to memory of 1332	1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe	vbc.exe
PID 1644 wrote to memory of 1332	1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe	vbc.exe
PID 1644 wrote to memory of 1332	1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe	vbc.exe
PID 1644 wrote to memory of 1332	1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe	vbc.exe
PID 1644 wrote to memory of 1332	1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe	vbc.exe
PID 1644 wrote to memory of 1332	1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe	vbc.exe
PID 1644 wrote to memory of 1332	1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe	vbc.exe
PID 1644 wrote to memory of 1332	1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe	vbc.exe
PID 1644 wrote to memory of 1332	1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe	vbc.exe
PID 1644 wrote to memory of 1332	1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe	vbc.exe
PID 1644 wrote to memory of 1332	1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe	vbc.exe
PID 1644 wrote to memory of 1780	1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe	WUDHost.exe
PID 1644 wrote to memory of 1780	1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe	WUDHost.exe
PID 1644 wrote to memory of 1780	1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe	WUDHost.exe
PID 1644 wrote to memory of 1780	1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe	WUDHost.exe
PID 1780 wrote to memory of 1700	1780	WUDHost.exe	Acctres.exe
PID 1780 wrote to memory of 1700	1780	WUDHost.exe	Acctres.exe
PID 1780 wrote to memory of 1700	1780	WUDHost.exe	Acctres.exe
PID 1780 wrote to memory of 1700	1780	WUDHost.exe	Acctres.exe
PID 1644 wrote to memory of 2008	1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe	WUDHost.exe
PID 1644 wrote to memory of 2008	1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe	WUDHost.exe
PID 1644 wrote to memory of 2008	1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe	WUDHost.exe
PID 1644 wrote to memory of 2008	1644	add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe	WUDHost.exe
PID 1700 wrote to memory of 756	1700	Acctres.exe	vbc.exe
PID 1700 wrote to memory of 756	1700	Acctres.exe	vbc.exe
PID 1700 wrote to memory of 756	1700	Acctres.exe	vbc.exe
PID 1700 wrote to memory of 756	1700	Acctres.exe	vbc.exe
PID 1700 wrote to memory of 756	1700	Acctres.exe	vbc.exe
PID 1700 wrote to memory of 756	1700	Acctres.exe	vbc.exe
PID 1700 wrote to memory of 756	1700	Acctres.exe	vbc.exe
PID 1700 wrote to memory of 756	1700	Acctres.exe	vbc.exe
PID 1700 wrote to memory of 756	1700	Acctres.exe	vbc.exe
PID 1700 wrote to memory of 756	1700	Acctres.exe	vbc.exe
PID 1700 wrote to memory of 756	1700	Acctres.exe	vbc.exe
PID 1700 wrote to memory of 756	1700	Acctres.exe	vbc.exe
PID 1700 wrote to memory of 756	1700	Acctres.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe
"C:\Users\Admin\AppData\Local\Temp\add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1332

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1780

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:756

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Scripting

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe

Filesize
838KB

MD5
fd9f795b049b201663898b3b840dec32

SHA1
26b4a2d63443b1ea20afab2bead3da3514f92e35

SHA256
add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc

SHA512
df26f973aa106c021e49290e2d949c0e7fea955332838d2f6e8856bde4aa112545413286943d3d9c6a60b16eb5603a693b2a1de103a12608dbb42411c7a9521c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe

Filesize
838KB

MD5
fd9f795b049b201663898b3b840dec32

SHA1
26b4a2d63443b1ea20afab2bead3da3514f92e35

SHA256
add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc

SHA512
df26f973aa106c021e49290e2d949c0e7fea955332838d2f6e8856bde4aa112545413286943d3d9c6a60b16eb5603a693b2a1de103a12608dbb42411c7a9521c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe

Filesize
7KB

MD5
346cc610f2a43754fbd2ad0bd4d67edf

SHA1
06fb84bd968978f834820ddfd59075e8d1e21759

SHA256
c214b3c08c5abd9c178cb566a6b2beb5026ec1a54197e8bd403d2e3af90e0e74

SHA512
eb9fd2dbd7f53b642384311a8f10547c78ae29263cc7d64b3fc2056fb818ddc0c7c80a42d4596c3557a0ac42dcf7d9198f6d742088f7336c4d7868acb52ca940

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe

Filesize
7KB

MD5
346cc610f2a43754fbd2ad0bd4d67edf

SHA1
06fb84bd968978f834820ddfd59075e8d1e21759

SHA256
c214b3c08c5abd9c178cb566a6b2beb5026ec1a54197e8bd403d2e3af90e0e74

SHA512
eb9fd2dbd7f53b642384311a8f10547c78ae29263cc7d64b3fc2056fb818ddc0c7c80a42d4596c3557a0ac42dcf7d9198f6d742088f7336c4d7868acb52ca940

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe

Filesize
7KB

MD5
346cc610f2a43754fbd2ad0bd4d67edf

SHA1
06fb84bd968978f834820ddfd59075e8d1e21759

SHA256
c214b3c08c5abd9c178cb566a6b2beb5026ec1a54197e8bd403d2e3af90e0e74

SHA512
eb9fd2dbd7f53b642384311a8f10547c78ae29263cc7d64b3fc2056fb818ddc0c7c80a42d4596c3557a0ac42dcf7d9198f6d742088f7336c4d7868acb52ca940

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe

Filesize
838KB

MD5
fd9f795b049b201663898b3b840dec32

SHA1
26b4a2d63443b1ea20afab2bead3da3514f92e35

SHA256
add1e6472d8e7694d798eb95aba0bb15105c828c585ae22a173fc0f6b1f0d6bc

SHA512
df26f973aa106c021e49290e2d949c0e7fea955332838d2f6e8856bde4aa112545413286943d3d9c6a60b16eb5603a693b2a1de103a12608dbb42411c7a9521c

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe

Filesize
7KB

MD5
346cc610f2a43754fbd2ad0bd4d67edf

SHA1
06fb84bd968978f834820ddfd59075e8d1e21759

SHA256
c214b3c08c5abd9c178cb566a6b2beb5026ec1a54197e8bd403d2e3af90e0e74

SHA512
eb9fd2dbd7f53b642384311a8f10547c78ae29263cc7d64b3fc2056fb818ddc0c7c80a42d4596c3557a0ac42dcf7d9198f6d742088f7336c4d7868acb52ca940

Download Submit
memory/756-116-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/756-112-0x000000000048F888-mapping.dmp

Download
memory/1332-67-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1332-69-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1332-71-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1332-72-0x000000000048F888-mapping.dmp

Download
memory/1332-73-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1332-75-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1332-57-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1332-62-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1332-66-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1332-64-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1332-58-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1332-82-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1332-60-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1332-84-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1644-54-0x0000000075E51000-0x0000000075E53000-memory.dmp

Filesize
8KB

Download
memory/1644-56-0x0000000074E30000-0x00000000753DB000-memory.dmp

Filesize
5.7MB

Download
memory/1644-55-0x0000000074E30000-0x00000000753DB000-memory.dmp

Filesize
5.7MB

Download
memory/1700-87-0x0000000000000000-mapping.dmp

Download
memory/1700-90-0x0000000074E30000-0x00000000753DB000-memory.dmp

Filesize
5.7MB

Download
memory/1700-91-0x0000000074E30000-0x00000000753DB000-memory.dmp

Filesize
5.7MB

Download
memory/1780-83-0x0000000074E30000-0x00000000753DB000-memory.dmp

Filesize
5.7MB

Download
memory/1780-81-0x0000000074E30000-0x00000000753DB000-memory.dmp

Filesize
5.7MB

Download
memory/1780-92-0x0000000074E30000-0x00000000753DB000-memory.dmp

Filesize
5.7MB

Download
memory/1780-77-0x0000000000000000-mapping.dmp

Download
memory/2008-93-0x0000000000000000-mapping.dmp

Download
memory/2008-96-0x0000000074E30000-0x00000000753DB000-memory.dmp

Filesize
5.7MB

Download
memory/2008-117-0x0000000074E30000-0x00000000753DB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads