darkcomet | d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199

General

Target

d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
Size

834KB
MD5

b1c50a7fc4f9065eb4d146e99b3ba8c9
SHA1

e05cae1327a90d4758c55a82dace360a71ae878c
SHA256

d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199
SHA512

8f3a1647be8d5a962e555be12f9f03da897d8b67d404c4b15cde4565662d129384f8bb882cd384a7e2bced0e7b885520f040896216f7f10e95399da2f75c8178
SSDEEP

12288:p+yR54BjPCAmvE6R71Ti/AAyvQo4ypD6tfn+60XhD14H/ZEg3Mk5RHdYO6IWsl:p+dBirR7hP4oFx69+Dx54REXk5R9YUl

Score

10^/10

darkcomet victims persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Victims

C2

mrchbk.noip.me:2123

Mutex

DC_MUTEX-EZ6YFTY

Attributes

gencode
4FUM8Qy2Ej7F
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Executes dropped EXE 3 IoCs

Processes:

IpOverUsbSvrc.exeAcctres.exeIpOverUsbSvrc.exe

pid process

304 IpOverUsbSvrc.exe
240 Acctres.exe
1016 IpOverUsbSvrc.exe
Loads dropped DLL 2 IoCs

Processes:

d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exeIpOverUsbSvrc.exe

pid process

1416 d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
304 IpOverUsbSvrc.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

pid	process
304	IpOverUsbSvrc.exe
240	Acctres.exe
1016	IpOverUsbSvrc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

IpOverUsbSvrc.exeIpOverUsbSvrc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Multimedia Class Scheduler = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\IpOverUsbSvrc.exe"	IpOverUsbSvrc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Multimedia Class Scheduler = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\IpOverUsbSvrc.exe"	IpOverUsbSvrc.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exeAcctres.exe

description	pid	process	target process
PID 1416 set thread context of 1524	1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe	vbc.exe
PID 240 set thread context of 788	240	Acctres.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exeIpOverUsbSvrc.exeAcctres.exe

pid	process
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
304	IpOverUsbSvrc.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
304	IpOverUsbSvrc.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
304	IpOverUsbSvrc.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
304	IpOverUsbSvrc.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
304	IpOverUsbSvrc.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
304	IpOverUsbSvrc.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
240	Acctres.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
240	Acctres.exe
1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
240	Acctres.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

Processes:

d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exevbc.exeIpOverUsbSvrc.exeAcctres.exevbc.exeIpOverUsbSvrc.exe

description	pid	process
Token: SeDebugPrivilege	1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
Token: SeIncreaseQuotaPrivilege	1524	vbc.exe
Token: SeSecurityPrivilege	1524	vbc.exe
Token: SeTakeOwnershipPrivilege	1524	vbc.exe
Token: SeLoadDriverPrivilege	1524	vbc.exe
Token: SeSystemProfilePrivilege	1524	vbc.exe
Token: SeSystemtimePrivilege	1524	vbc.exe
Token: SeProfSingleProcessPrivilege	1524	vbc.exe
Token: SeIncBasePriorityPrivilege	1524	vbc.exe
Token: SeCreatePagefilePrivilege	1524	vbc.exe
Token: SeBackupPrivilege	1524	vbc.exe
Token: SeRestorePrivilege	1524	vbc.exe
Token: SeShutdownPrivilege	1524	vbc.exe
Token: SeDebugPrivilege	1524	vbc.exe
Token: SeSystemEnvironmentPrivilege	1524	vbc.exe
Token: SeChangeNotifyPrivilege	1524	vbc.exe
Token: SeRemoteShutdownPrivilege	1524	vbc.exe
Token: SeUndockPrivilege	1524	vbc.exe
Token: SeManageVolumePrivilege	1524	vbc.exe
Token: SeImpersonatePrivilege	1524	vbc.exe
Token: SeCreateGlobalPrivilege	1524	vbc.exe
Token: 33	1524	vbc.exe
Token: 34	1524	vbc.exe
Token: 35	1524	vbc.exe
Token: SeDebugPrivilege	304	IpOverUsbSvrc.exe
Token: SeDebugPrivilege	240	Acctres.exe
Token: SeIncreaseQuotaPrivilege	788	vbc.exe
Token: SeSecurityPrivilege	788	vbc.exe
Token: SeTakeOwnershipPrivilege	788	vbc.exe
Token: SeLoadDriverPrivilege	788	vbc.exe
Token: SeSystemProfilePrivilege	788	vbc.exe
Token: SeSystemtimePrivilege	788	vbc.exe
Token: SeProfSingleProcessPrivilege	788	vbc.exe
Token: SeIncBasePriorityPrivilege	788	vbc.exe
Token: SeCreatePagefilePrivilege	788	vbc.exe
Token: SeBackupPrivilege	788	vbc.exe
Token: SeRestorePrivilege	788	vbc.exe
Token: SeShutdownPrivilege	788	vbc.exe
Token: SeDebugPrivilege	788	vbc.exe
Token: SeSystemEnvironmentPrivilege	788	vbc.exe
Token: SeChangeNotifyPrivilege	788	vbc.exe
Token: SeRemoteShutdownPrivilege	788	vbc.exe
Token: SeUndockPrivilege	788	vbc.exe
Token: SeManageVolumePrivilege	788	vbc.exe
Token: SeImpersonatePrivilege	788	vbc.exe
Token: SeCreateGlobalPrivilege	788	vbc.exe
Token: 33	788	vbc.exe
Token: 34	788	vbc.exe
Token: 35	788	vbc.exe
Token: SeDebugPrivilege	1016	IpOverUsbSvrc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

1524 vbc.exe

pid	process
1524	vbc.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exeIpOverUsbSvrc.exeAcctres.exe

description	pid	process	target process
PID 1416 wrote to memory of 1524	1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe	vbc.exe
PID 1416 wrote to memory of 1524	1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe	vbc.exe
PID 1416 wrote to memory of 1524	1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe	vbc.exe
PID 1416 wrote to memory of 1524	1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe	vbc.exe
PID 1416 wrote to memory of 1524	1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe	vbc.exe
PID 1416 wrote to memory of 1524	1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe	vbc.exe
PID 1416 wrote to memory of 1524	1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe	vbc.exe
PID 1416 wrote to memory of 1524	1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe	vbc.exe
PID 1416 wrote to memory of 1524	1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe	vbc.exe
PID 1416 wrote to memory of 1524	1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe	vbc.exe
PID 1416 wrote to memory of 1524	1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe	vbc.exe
PID 1416 wrote to memory of 1524	1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe	vbc.exe
PID 1416 wrote to memory of 1524	1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe	vbc.exe
PID 1416 wrote to memory of 304	1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe	IpOverUsbSvrc.exe
PID 1416 wrote to memory of 304	1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe	IpOverUsbSvrc.exe
PID 1416 wrote to memory of 304	1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe	IpOverUsbSvrc.exe
PID 1416 wrote to memory of 304	1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe	IpOverUsbSvrc.exe
PID 304 wrote to memory of 240	304	IpOverUsbSvrc.exe	Acctres.exe
PID 304 wrote to memory of 240	304	IpOverUsbSvrc.exe	Acctres.exe
PID 304 wrote to memory of 240	304	IpOverUsbSvrc.exe	Acctres.exe
PID 304 wrote to memory of 240	304	IpOverUsbSvrc.exe	Acctres.exe
PID 1416 wrote to memory of 1016	1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe	IpOverUsbSvrc.exe
PID 1416 wrote to memory of 1016	1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe	IpOverUsbSvrc.exe
PID 1416 wrote to memory of 1016	1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe	IpOverUsbSvrc.exe
PID 1416 wrote to memory of 1016	1416	d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe	IpOverUsbSvrc.exe
PID 240 wrote to memory of 788	240	Acctres.exe	vbc.exe
PID 240 wrote to memory of 788	240	Acctres.exe	vbc.exe
PID 240 wrote to memory of 788	240	Acctres.exe	vbc.exe
PID 240 wrote to memory of 788	240	Acctres.exe	vbc.exe
PID 240 wrote to memory of 788	240	Acctres.exe	vbc.exe
PID 240 wrote to memory of 788	240	Acctres.exe	vbc.exe
PID 240 wrote to memory of 788	240	Acctres.exe	vbc.exe
PID 240 wrote to memory of 788	240	Acctres.exe	vbc.exe
PID 240 wrote to memory of 788	240	Acctres.exe	vbc.exe
PID 240 wrote to memory of 788	240	Acctres.exe	vbc.exe
PID 240 wrote to memory of 788	240	Acctres.exe	vbc.exe
PID 240 wrote to memory of 788	240	Acctres.exe	vbc.exe
PID 240 wrote to memory of 788	240	Acctres.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
"C:\Users\Admin\AppData\Local\Temp\d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1524

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IpOverUsbSvrc.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IpOverUsbSvrc.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:304

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:240

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:788

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IpOverUsbSvrc.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IpOverUsbSvrc.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1016

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
Filesize
834KB

MD5
b1c50a7fc4f9065eb4d146e99b3ba8c9

SHA1
e05cae1327a90d4758c55a82dace360a71ae878c

SHA256
d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199

SHA512
8f3a1647be8d5a962e555be12f9f03da897d8b67d404c4b15cde4565662d129384f8bb882cd384a7e2bced0e7b885520f040896216f7f10e95399da2f75c8178

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
Filesize
834KB

MD5
b1c50a7fc4f9065eb4d146e99b3ba8c9

SHA1
e05cae1327a90d4758c55a82dace360a71ae878c

SHA256
d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199

SHA512
8f3a1647be8d5a962e555be12f9f03da897d8b67d404c4b15cde4565662d129384f8bb882cd384a7e2bced0e7b885520f040896216f7f10e95399da2f75c8178

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IpOverUsbSvrc.exe
Filesize
17KB

MD5
fd03ff313a655e0b59dce81044bc6341

SHA1
0fa0dc26876f636956c3de82685bdbbc8ad3ef86

SHA256
1f1c8c1458eaee47a448513db52ddb536406146d48793c3c24f41eb72b13cec9

SHA512
00fdf54987cb8abd0c68619e02991aeb50e5509ea56b0e5fa613ac29fddcc57c585cd0e5be055cb5c6563828b6a631666fe6e7004dada7607ddd903659264ddd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IpOverUsbSvrc.exe
Filesize
17KB

MD5
fd03ff313a655e0b59dce81044bc6341

SHA1
0fa0dc26876f636956c3de82685bdbbc8ad3ef86

SHA256
1f1c8c1458eaee47a448513db52ddb536406146d48793c3c24f41eb72b13cec9

SHA512
00fdf54987cb8abd0c68619e02991aeb50e5509ea56b0e5fa613ac29fddcc57c585cd0e5be055cb5c6563828b6a631666fe6e7004dada7607ddd903659264ddd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IpOverUsbSvrc.exe
Filesize
17KB

MD5
fd03ff313a655e0b59dce81044bc6341

SHA1
0fa0dc26876f636956c3de82685bdbbc8ad3ef86

SHA256
1f1c8c1458eaee47a448513db52ddb536406146d48793c3c24f41eb72b13cec9

SHA512
00fdf54987cb8abd0c68619e02991aeb50e5509ea56b0e5fa613ac29fddcc57c585cd0e5be055cb5c6563828b6a631666fe6e7004dada7607ddd903659264ddd

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
Filesize
834KB

MD5
b1c50a7fc4f9065eb4d146e99b3ba8c9

SHA1
e05cae1327a90d4758c55a82dace360a71ae878c

SHA256
d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199

SHA512
8f3a1647be8d5a962e555be12f9f03da897d8b67d404c4b15cde4565662d129384f8bb882cd384a7e2bced0e7b885520f040896216f7f10e95399da2f75c8178

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\IpOverUsbSvrc.exe
Filesize
17KB

MD5
fd03ff313a655e0b59dce81044bc6341

SHA1
0fa0dc26876f636956c3de82685bdbbc8ad3ef86

SHA256
1f1c8c1458eaee47a448513db52ddb536406146d48793c3c24f41eb72b13cec9

SHA512
00fdf54987cb8abd0c68619e02991aeb50e5509ea56b0e5fa613ac29fddcc57c585cd0e5be055cb5c6563828b6a631666fe6e7004dada7607ddd903659264ddd

Download Submit
memory/240-90-0x0000000074520000-0x0000000074ACB000-memory.dmp

Filesize
5.7MB

Download
memory/240-87-0x0000000000000000-mapping.dmp

Download
memory/240-91-0x0000000074520000-0x0000000074ACB000-memory.dmp

Filesize
5.7MB

Download
memory/304-92-0x0000000074520000-0x0000000074ACB000-memory.dmp

Filesize
5.7MB

Download
memory/304-83-0x0000000074520000-0x0000000074ACB000-memory.dmp

Filesize
5.7MB

Download
memory/304-81-0x0000000074520000-0x0000000074ACB000-memory.dmp

Filesize
5.7MB

Download
memory/304-77-0x0000000000000000-mapping.dmp

Download
memory/788-112-0x000000000048F888-mapping.dmp

Download
memory/788-116-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1016-93-0x0000000000000000-mapping.dmp

Download
memory/1016-96-0x0000000074520000-0x0000000074ACB000-memory.dmp

Filesize
5.7MB

Download
memory/1016-117-0x0000000074520000-0x0000000074ACB000-memory.dmp

Filesize
5.7MB

Download
memory/1416-55-0x0000000074520000-0x0000000074ACB000-memory.dmp

Filesize
5.7MB

Download
memory/1416-54-0x0000000075E81000-0x0000000075E83000-memory.dmp

Filesize
8KB

Download
memory/1416-56-0x0000000074520000-0x0000000074ACB000-memory.dmp

Filesize
5.7MB

Download
memory/1524-76-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1524-58-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1524-57-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1524-84-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1524-82-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1524-60-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1524-62-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1524-64-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1524-66-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1524-73-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1524-72-0x000000000048F888-mapping.dmp

Download
memory/1524-71-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1524-69-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1524-67-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads