darkcomet | 196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114

General

Target

196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Size

1.3MB
MD5

e9b43d240d7cfe184feee485a5582d12
SHA1

ca7e417cb7ea419c46bf5806c0aaf7150c539990
SHA256

196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114
SHA512

5cc6ac4a14ed6e6db637509a9cd340fe6d75836b4083179b1a50facdb987b9e52365199576a76b0c9a81870822f1367ea59a227c435c51c27139e53b706ca817
SSDEEP

24576:mhEVaPqLTrLMVGAJe2JEB8XA+Bnv+sYmv1z6D1lcmxnAMYhl8h:UEVUc/AJe2JsvGvTzKlcmGMmlu

Score

10^/10

darkcomet neshta churka persistence rat spyware trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

CHurka

C2

85.93.52.232:1604

Mutex

DC_MUTEX-XUETUYT

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
lw18MRhbwShC
install
true
offline_keylogger
true
persistence
false
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Detect Neshta payload 2 IoCs

Processes:

resource	yara_rule
C:\Windows\svchost.com	family_neshta
C:\Windows\svchost.com	family_neshta

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe"	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Executes dropped EXE 5 IoCs

Processes:

196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exesvchost.commsdcsc.exemsdcsc.exe

pid	process
1860	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
3712	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
2316	svchost.com
960	msdcsc.exe
4372	msdcsc.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\3582-490\196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe	upx
C:\Users\Admin\AppData\Local\Temp\3582-490\196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe	upx
behavioral2/memory/1860-135-0x0000000000400000-0x00000000004C1000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\3582-490\196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe	upx
behavioral2/memory/1860-141-0x0000000000400000-0x00000000004C1000-memory.dmp	upx
C:\PROGRA~3\MICROS~1\Windows\STARTM~1\MSDCSC\msdcsc.exe	upx
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe	upx
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe	upx
behavioral2/memory/960-153-0x0000000000400000-0x00000000004C1000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe"	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/1860-141-0x0000000000400000-0x00000000004C1000-memory.dmp	autoit_exe
behavioral2/memory/960-153-0x0000000000400000-0x00000000004C1000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exemsdcsc.exe

description	pid	process	target process
PID 1860 set thread context of 3712	1860	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
PID 960 set thread context of 4372	960	msdcsc.exe	msdcsc.exe

Drops file in Windows directory 3 IoCs

Processes:

svchost.com196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe

description	ioc	process
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\svchost.com	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
File opened for modification	C:\Windows\directx.sys	svchost.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3712	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Token: SeSecurityPrivilege	3712	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Token: SeTakeOwnershipPrivilege	3712	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Token: SeLoadDriverPrivilege	3712	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Token: SeSystemProfilePrivilege	3712	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Token: SeSystemtimePrivilege	3712	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Token: SeProfSingleProcessPrivilege	3712	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Token: SeIncBasePriorityPrivilege	3712	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Token: SeCreatePagefilePrivilege	3712	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Token: SeBackupPrivilege	3712	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Token: SeRestorePrivilege	3712	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Token: SeShutdownPrivilege	3712	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Token: SeDebugPrivilege	3712	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Token: SeSystemEnvironmentPrivilege	3712	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Token: SeChangeNotifyPrivilege	3712	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Token: SeRemoteShutdownPrivilege	3712	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Token: SeUndockPrivilege	3712	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Token: SeManageVolumePrivilege	3712	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Token: SeImpersonatePrivilege	3712	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Token: SeCreateGlobalPrivilege	3712	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Token: 33	3712	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Token: 34	3712	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Token: 35	3712	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Token: 36	3712	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Token: SeIncreaseQuotaPrivilege	4372	msdcsc.exe
Token: SeSecurityPrivilege	4372	msdcsc.exe
Token: SeTakeOwnershipPrivilege	4372	msdcsc.exe
Token: SeLoadDriverPrivilege	4372	msdcsc.exe
Token: SeSystemProfilePrivilege	4372	msdcsc.exe
Token: SeSystemtimePrivilege	4372	msdcsc.exe
Token: SeProfSingleProcessPrivilege	4372	msdcsc.exe
Token: SeIncBasePriorityPrivilege	4372	msdcsc.exe
Token: SeCreatePagefilePrivilege	4372	msdcsc.exe
Token: SeBackupPrivilege	4372	msdcsc.exe
Token: SeRestorePrivilege	4372	msdcsc.exe
Token: SeShutdownPrivilege	4372	msdcsc.exe
Token: SeDebugPrivilege	4372	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	4372	msdcsc.exe
Token: SeChangeNotifyPrivilege	4372	msdcsc.exe
Token: SeRemoteShutdownPrivilege	4372	msdcsc.exe
Token: SeUndockPrivilege	4372	msdcsc.exe
Token: SeManageVolumePrivilege	4372	msdcsc.exe
Token: SeImpersonatePrivilege	4372	msdcsc.exe
Token: SeCreateGlobalPrivilege	4372	msdcsc.exe
Token: 33	4372	msdcsc.exe
Token: 34	4372	msdcsc.exe
Token: 35	4372	msdcsc.exe
Token: 36	4372	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

4372 msdcsc.exe

pid	process
4372	msdcsc.exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exesvchost.commsdcsc.exe

description	pid	process	target process
PID 3424 wrote to memory of 1860	3424	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
PID 3424 wrote to memory of 1860	3424	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
PID 3424 wrote to memory of 1860	3424	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
PID 1860 wrote to memory of 3712	1860	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
PID 1860 wrote to memory of 3712	1860	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
PID 1860 wrote to memory of 3712	1860	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
PID 1860 wrote to memory of 3712	1860	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
PID 1860 wrote to memory of 3712	1860	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
PID 1860 wrote to memory of 3712	1860	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
PID 1860 wrote to memory of 3712	1860	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
PID 1860 wrote to memory of 3712	1860	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
PID 1860 wrote to memory of 3712	1860	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
PID 1860 wrote to memory of 3712	1860	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
PID 1860 wrote to memory of 3712	1860	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
PID 1860 wrote to memory of 3712	1860	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
PID 1860 wrote to memory of 3712	1860	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
PID 1860 wrote to memory of 3712	1860	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
PID 3712 wrote to memory of 2316	3712	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe	svchost.com
PID 3712 wrote to memory of 2316	3712	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe	svchost.com
PID 3712 wrote to memory of 2316	3712	196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe	svchost.com
PID 2316 wrote to memory of 960	2316	svchost.com	msdcsc.exe
PID 2316 wrote to memory of 960	2316	svchost.com	msdcsc.exe
PID 2316 wrote to memory of 960	2316	svchost.com	msdcsc.exe
PID 960 wrote to memory of 4372	960	msdcsc.exe	msdcsc.exe
PID 960 wrote to memory of 4372	960	msdcsc.exe	msdcsc.exe
PID 960 wrote to memory of 4372	960	msdcsc.exe	msdcsc.exe
PID 960 wrote to memory of 4372	960	msdcsc.exe	msdcsc.exe
PID 960 wrote to memory of 4372	960	msdcsc.exe	msdcsc.exe
PID 960 wrote to memory of 4372	960	msdcsc.exe	msdcsc.exe
PID 960 wrote to memory of 4372	960	msdcsc.exe	msdcsc.exe
PID 960 wrote to memory of 4372	960	msdcsc.exe	msdcsc.exe
PID 960 wrote to memory of 4372	960	msdcsc.exe	msdcsc.exe
PID 960 wrote to memory of 4372	960	msdcsc.exe	msdcsc.exe
PID 960 wrote to memory of 4372	960	msdcsc.exe	msdcsc.exe
PID 960 wrote to memory of 4372	960	msdcsc.exe	msdcsc.exe
PID 960 wrote to memory of 4372	960	msdcsc.exe	msdcsc.exe
PID 960 wrote to memory of 4372	960	msdcsc.exe	msdcsc.exe

C:\Users\Admin\AppData\Local\Temp\196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
"C:\Users\Admin\AppData\Local\Temp\196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe"
1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3424

C:\Users\Admin\AppData\Local\Temp\3582-490\196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1860

C:\Users\Admin\AppData\Local\Temp\3582-490\196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe"
3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3712

C:\Windows\svchost.com
"C:\Windows\svchost.com" "C:\PROGRA~3\MICROS~1\Windows\STARTM~1\MSDCSC\msdcsc.exe"
4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2316

C:\PROGRA~3\MICROS~1\Windows\STARTM~1\MSDCSC\msdcsc.exe
C:\PROGRA~3\MICROS~1\Windows\STARTM~1\MSDCSC\msdcsc.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:960

C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe
"C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4372

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Change Default File Association

1

T1042

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\MICROS~1\Windows\STARTM~1\MSDCSC\msdcsc.exe
Filesize
1.3MB

MD5
02053dcd793d26c45e5480eb6798f499

SHA1
a6e8e3808075bbcb4b70e46273d44461a1537385

SHA256
1f8cbee7c3aa1479894ed8c3d6afaa44c83476a77a755f7b07c6786c64e1adfd

SHA512
8e499ec5a02ff67f47896a83e81e160926249061136978fe83ad525b54dc1fe1921074ac75b0c2a6b9ae6583e4c291f1f000850058771899a3be391b128b9251

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe
Filesize
1.3MB

MD5
02053dcd793d26c45e5480eb6798f499

SHA1
a6e8e3808075bbcb4b70e46273d44461a1537385

SHA256
1f8cbee7c3aa1479894ed8c3d6afaa44c83476a77a755f7b07c6786c64e1adfd

SHA512
8e499ec5a02ff67f47896a83e81e160926249061136978fe83ad525b54dc1fe1921074ac75b0c2a6b9ae6583e4c291f1f000850058771899a3be391b128b9251

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe
Filesize
1.3MB

MD5
02053dcd793d26c45e5480eb6798f499

SHA1
a6e8e3808075bbcb4b70e46273d44461a1537385

SHA256
1f8cbee7c3aa1479894ed8c3d6afaa44c83476a77a755f7b07c6786c64e1adfd

SHA512
8e499ec5a02ff67f47896a83e81e160926249061136978fe83ad525b54dc1fe1921074ac75b0c2a6b9ae6583e4c291f1f000850058771899a3be391b128b9251

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Filesize
1.3MB

MD5
02053dcd793d26c45e5480eb6798f499

SHA1
a6e8e3808075bbcb4b70e46273d44461a1537385

SHA256
1f8cbee7c3aa1479894ed8c3d6afaa44c83476a77a755f7b07c6786c64e1adfd

SHA512
8e499ec5a02ff67f47896a83e81e160926249061136978fe83ad525b54dc1fe1921074ac75b0c2a6b9ae6583e4c291f1f000850058771899a3be391b128b9251

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Filesize
1.3MB

MD5
02053dcd793d26c45e5480eb6798f499

SHA1
a6e8e3808075bbcb4b70e46273d44461a1537385

SHA256
1f8cbee7c3aa1479894ed8c3d6afaa44c83476a77a755f7b07c6786c64e1adfd

SHA512
8e499ec5a02ff67f47896a83e81e160926249061136978fe83ad525b54dc1fe1921074ac75b0c2a6b9ae6583e4c291f1f000850058771899a3be391b128b9251

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\196823449602346358b5f114c451a745a50238c1932d5e78a9d143294cb21114.exe
Filesize
1.3MB

MD5
02053dcd793d26c45e5480eb6798f499

SHA1
a6e8e3808075bbcb4b70e46273d44461a1537385

SHA256
1f8cbee7c3aa1479894ed8c3d6afaa44c83476a77a755f7b07c6786c64e1adfd

SHA512
8e499ec5a02ff67f47896a83e81e160926249061136978fe83ad525b54dc1fe1921074ac75b0c2a6b9ae6583e4c291f1f000850058771899a3be391b128b9251

Download Submit
C:\Windows\svchost.com
Filesize
40KB

MD5
b44a4a990f782ce47b7cb426f7b6da48

SHA1
74e425f6a2af5219cd4bec2aa966a4f8934c64ef

SHA256
24a3032ce45f162ed631b15078da1954bfc35398e9b567717bb92a21b5b8f587

SHA512
1397f847f2ff591b3fe33f7ea4ca055e8c9bb9a829e4a429068dc0ad4560a694667e7c1a2b6376216c0c174403c2e9f612780a6a1783b41654541c5e38029891

Download Submit
C:\Windows\svchost.com
Filesize
40KB

MD5
b44a4a990f782ce47b7cb426f7b6da48

SHA1
74e425f6a2af5219cd4bec2aa966a4f8934c64ef

SHA256
24a3032ce45f162ed631b15078da1954bfc35398e9b567717bb92a21b5b8f587

SHA512
1397f847f2ff591b3fe33f7ea4ca055e8c9bb9a829e4a429068dc0ad4560a694667e7c1a2b6376216c0c174403c2e9f612780a6a1783b41654541c5e38029891

Download Submit
memory/960-153-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/960-147-0x0000000000000000-mapping.dmp

Download
memory/1860-135-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/1860-141-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/1860-132-0x0000000000000000-mapping.dmp

Download
memory/2316-143-0x0000000000000000-mapping.dmp

Download
memory/3712-137-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3712-142-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3712-140-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3712-139-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3712-136-0x0000000000000000-mapping.dmp

Download
memory/3712-155-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4372-149-0x0000000000000000-mapping.dmp

Download
memory/4372-156-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads