darkcomet | f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9

General

Target

f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
Size

755KB
MD5

b31929cf07815e0cfd3f3c32fe49dc2f
SHA1

7fc8a85285388a5f2ff951960178e0a3746e033f
SHA256

f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9
SHA512

05c6c06e3be5ae22971e53233e4f1d040a016c30192a7f3348b2650f6b48c4192d5bcb99cb37909776350556c7356290f5231c2e21616dfd232c0a70f368333a
SSDEEP

12288:qebXK0f0YgZMxvSgB81A4uBS8rH7FL/r9OExzA+vYguk2zUsVlv/j/mraY6v2WU:nXKSgOSmCH8rBDVxnCYsrHYkx

Score

10^/10

darkcomet new---victim persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

New---Victim

C2

freewayblaze.zapto.org:1604

Mutex

DC_MUTEX-NTT55ZM

Attributes

gencode
eoRhVbsCy5oj
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Executes dropped EXE 1 IoCs

Processes:

IpOverUsbSvrc.exe

pid process

548 IpOverUsbSvrc.exe
Loads dropped DLL 1 IoCs

Processes:

f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe

pid process

1088 f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe

pid	process
548	IpOverUsbSvrc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

IpOverUsbSvrc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Multimedia Class Scheduler = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\IpOverUsbSvrc.exe"	IpOverUsbSvrc.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe

description	pid	process	target process
PID 1088 set thread context of 1524	1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exeIpOverUsbSvrc.exe

pid	process
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
548	IpOverUsbSvrc.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
548	IpOverUsbSvrc.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
548	IpOverUsbSvrc.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
548	IpOverUsbSvrc.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
548	IpOverUsbSvrc.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
548	IpOverUsbSvrc.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
548	IpOverUsbSvrc.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
548	IpOverUsbSvrc.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
548	IpOverUsbSvrc.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
548	IpOverUsbSvrc.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
548	IpOverUsbSvrc.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
548	IpOverUsbSvrc.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
548	IpOverUsbSvrc.exe
1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exef9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exeIpOverUsbSvrc.exe

description	pid	process
Token: SeDebugPrivilege	1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
Token: SeIncreaseQuotaPrivilege	1524	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
Token: SeSecurityPrivilege	1524	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
Token: SeTakeOwnershipPrivilege	1524	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
Token: SeLoadDriverPrivilege	1524	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
Token: SeSystemProfilePrivilege	1524	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
Token: SeSystemtimePrivilege	1524	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
Token: SeProfSingleProcessPrivilege	1524	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
Token: SeIncBasePriorityPrivilege	1524	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
Token: SeCreatePagefilePrivilege	1524	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
Token: SeBackupPrivilege	1524	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
Token: SeRestorePrivilege	1524	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
Token: SeShutdownPrivilege	1524	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
Token: SeDebugPrivilege	1524	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
Token: SeSystemEnvironmentPrivilege	1524	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
Token: SeChangeNotifyPrivilege	1524	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
Token: SeRemoteShutdownPrivilege	1524	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
Token: SeUndockPrivilege	1524	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
Token: SeManageVolumePrivilege	1524	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
Token: SeImpersonatePrivilege	1524	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
Token: SeCreateGlobalPrivilege	1524	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
Token: 33	1524	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
Token: 34	1524	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
Token: 35	1524	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
Token: SeDebugPrivilege	548	IpOverUsbSvrc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe

pid process

1524 f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe

pid	process
1524	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe

C:\Users\Admin\AppData\Local\Temp\f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
"C:\Users\Admin\AppData\Local\Temp\f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088

C:\Users\Admin\AppData\Local\Temp\f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
"C:\Users\Admin\AppData\Local\Temp\f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1524

C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:548

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
Filesize
11KB

MD5
03c4f3f5cdbc342eb1c0349e001fdd0c

SHA1
7d45ed19db4eaed16d1985240c98fab7623798e5

SHA256
a395cb8bb6cdaa7f0dad2e012fb5107d0d307efea021be048bdd5b67479356bc

SHA512
d59ccd1ffffa884c8a7a96979ed19f0f8a586474c23d5b5ab23c235799044042f639e1834ee2e54a205a71caf97898ac8898d0da963fb006e443f3fb8f3c1162

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
Filesize
11KB

MD5
03c4f3f5cdbc342eb1c0349e001fdd0c

SHA1
7d45ed19db4eaed16d1985240c98fab7623798e5

SHA256
a395cb8bb6cdaa7f0dad2e012fb5107d0d307efea021be048bdd5b67479356bc

SHA512
d59ccd1ffffa884c8a7a96979ed19f0f8a586474c23d5b5ab23c235799044042f639e1834ee2e54a205a71caf97898ac8898d0da963fb006e443f3fb8f3c1162

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
Filesize
11KB

MD5
03c4f3f5cdbc342eb1c0349e001fdd0c

SHA1
7d45ed19db4eaed16d1985240c98fab7623798e5

SHA256
a395cb8bb6cdaa7f0dad2e012fb5107d0d307efea021be048bdd5b67479356bc

SHA512
d59ccd1ffffa884c8a7a96979ed19f0f8a586474c23d5b5ab23c235799044042f639e1834ee2e54a205a71caf97898ac8898d0da963fb006e443f3fb8f3c1162

Download Submit
memory/548-84-0x0000000074B80000-0x000000007512B000-memory.dmp

Filesize
5.7MB

Download
memory/548-82-0x0000000074B80000-0x000000007512B000-memory.dmp

Filesize
5.7MB

Download
memory/548-77-0x0000000000000000-mapping.dmp

Download
memory/1088-55-0x0000000074B80000-0x000000007512B000-memory.dmp

Filesize
5.7MB

Download
memory/1088-56-0x0000000074B80000-0x000000007512B000-memory.dmp

Filesize
5.7MB

Download
memory/1088-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1524-60-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1524-66-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1524-72-0x000000000048F888-mapping.dmp

Download
memory/1524-71-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1524-73-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1524-75-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1524-67-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1524-69-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1524-64-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1524-62-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1524-81-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1524-58-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1524-83-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1524-57-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

description	pid	process	target process
PID 1088 wrote to memory of 1524	1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
PID 1088 wrote to memory of 1524	1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
PID 1088 wrote to memory of 1524	1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
PID 1088 wrote to memory of 1524	1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
PID 1088 wrote to memory of 1524	1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
PID 1088 wrote to memory of 1524	1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
PID 1088 wrote to memory of 1524	1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
PID 1088 wrote to memory of 1524	1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
PID 1088 wrote to memory of 1524	1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
PID 1088 wrote to memory of 1524	1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
PID 1088 wrote to memory of 1524	1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
PID 1088 wrote to memory of 1524	1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
PID 1088 wrote to memory of 1524	1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe
PID 1088 wrote to memory of 548	1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe	IpOverUsbSvrc.exe
PID 1088 wrote to memory of 548	1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe	IpOverUsbSvrc.exe
PID 1088 wrote to memory of 548	1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe	IpOverUsbSvrc.exe
PID 1088 wrote to memory of 548	1088	f9c48f77663eae6dc9b4567758751c0fb3059165fe2fa24a7bf2949ad4b78bb9.exe	IpOverUsbSvrc.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads