darkcomet | 5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6

General

Target

5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
Size

1.6MB
MD5

0620050df2e5a15c53b9035407c4cfbf
SHA1

5a7cfa25d0c9e1ce1838310c450a5d3c1a81e62f
SHA256

5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6
SHA512

1f88713ff76982305fac2ced56f838ab36721e25c6589934cd25489ae8eb149555d8004c96a36aa9e8429cdfb69aeb59a91e8a660618799115bf146084cc8816
SSDEEP

24576:WF14CROX4GLhHexsQ8XqlAzpGNQUlFTH0dxXc/2hAqT9MI8SqVb8JNPTEJaE53:WF1pR4LhusCAF2d8dikAu9MzgzE4C

Score

10^/10

darkcomet bndbt evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

bndbt

C2

imouttahere.no-ip.biz:1605

Mutex

DC_MUTEX-PPBR4G6

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
xPKZmVuPN7gy
install
true
offline_keylogger
true
password
aerohigh
persistence
false
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe

Executes dropped EXE 3 IoCs

Processes:

msdcsc.exemsdcsc.exemsdcsc.exe

pid process

2588 msdcsc.exe
4572 msdcsc.exe
4540 msdcsc.exe
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

2676 attrib.exe
2560 attrib.exe

pid	process
2588	msdcsc.exe
4572	msdcsc.exe
4540	msdcsc.exe

pid	process
2676	attrib.exe
2560	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exemsdcsc.exemsdcsc.exe

description	pid	process	target process
PID 2036 set thread context of 2628	2036	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
PID 2628 set thread context of 2172	2628	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
PID 2588 set thread context of 4572	2588	msdcsc.exe	msdcsc.exe
PID 4572 set thread context of 4540	4572	msdcsc.exe	msdcsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1800 4540 WerFault.exe msdcsc.exe

pid	pid_target	process	target process
1800	4540	WerFault.exe	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

Processes:

5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exemsdcsc.exe

description	pid	process
Token: SeDebugPrivilege	2036	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
Token: SeIncreaseQuotaPrivilege	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
Token: SeSecurityPrivilege	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
Token: SeTakeOwnershipPrivilege	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
Token: SeLoadDriverPrivilege	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
Token: SeSystemProfilePrivilege	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
Token: SeSystemtimePrivilege	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
Token: SeProfSingleProcessPrivilege	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
Token: SeIncBasePriorityPrivilege	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
Token: SeCreatePagefilePrivilege	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
Token: SeBackupPrivilege	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
Token: SeRestorePrivilege	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
Token: SeShutdownPrivilege	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
Token: SeDebugPrivilege	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
Token: SeSystemEnvironmentPrivilege	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
Token: SeChangeNotifyPrivilege	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
Token: SeRemoteShutdownPrivilege	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
Token: SeUndockPrivilege	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
Token: SeManageVolumePrivilege	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
Token: SeImpersonatePrivilege	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
Token: SeCreateGlobalPrivilege	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
Token: 33	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
Token: 34	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
Token: 35	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
Token: 36	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
Token: SeDebugPrivilege	2588	msdcsc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exemsdcsc.exe

pid process

2628 5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
4572 msdcsc.exe

pid	process
2628	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
4572	msdcsc.exe

Suspicious use of WriteProcessMemory 49 IoCs

Processes:

5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.execmd.execmd.exemsdcsc.exemsdcsc.exe

description	pid	process	target process
PID 2036 wrote to memory of 2628	2036	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
PID 2036 wrote to memory of 2628	2036	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
PID 2036 wrote to memory of 2628	2036	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
PID 2036 wrote to memory of 2628	2036	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
PID 2036 wrote to memory of 2628	2036	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
PID 2036 wrote to memory of 2628	2036	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
PID 2036 wrote to memory of 2628	2036	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
PID 2036 wrote to memory of 2628	2036	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
PID 2628 wrote to memory of 2172	2628	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
PID 2628 wrote to memory of 2172	2628	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
PID 2628 wrote to memory of 2172	2628	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
PID 2628 wrote to memory of 2172	2628	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
PID 2628 wrote to memory of 2172	2628	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
PID 2628 wrote to memory of 2172	2628	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
PID 2628 wrote to memory of 2172	2628	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
PID 2628 wrote to memory of 2172	2628	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
PID 2628 wrote to memory of 2172	2628	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
PID 2628 wrote to memory of 2172	2628	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
PID 2628 wrote to memory of 2172	2628	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
PID 2628 wrote to memory of 2172	2628	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
PID 2628 wrote to memory of 2172	2628	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
PID 2628 wrote to memory of 2172	2628	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
PID 2172 wrote to memory of 2548	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	cmd.exe
PID 2172 wrote to memory of 2548	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	cmd.exe
PID 2172 wrote to memory of 2548	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	cmd.exe
PID 2172 wrote to memory of 2536	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	cmd.exe
PID 2172 wrote to memory of 2536	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	cmd.exe
PID 2172 wrote to memory of 2536	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	cmd.exe
PID 2172 wrote to memory of 2588	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	msdcsc.exe
PID 2172 wrote to memory of 2588	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	msdcsc.exe
PID 2172 wrote to memory of 2588	2172	5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe	msdcsc.exe
PID 2548 wrote to memory of 2676	2548	cmd.exe	attrib.exe
PID 2548 wrote to memory of 2676	2548	cmd.exe	attrib.exe
PID 2548 wrote to memory of 2676	2548	cmd.exe	attrib.exe
PID 2536 wrote to memory of 2560	2536	cmd.exe	attrib.exe
PID 2536 wrote to memory of 2560	2536	cmd.exe	attrib.exe
PID 2536 wrote to memory of 2560	2536	cmd.exe	attrib.exe
PID 2588 wrote to memory of 4572	2588	msdcsc.exe	msdcsc.exe
PID 2588 wrote to memory of 4572	2588	msdcsc.exe	msdcsc.exe
PID 2588 wrote to memory of 4572	2588	msdcsc.exe	msdcsc.exe
PID 2588 wrote to memory of 4572	2588	msdcsc.exe	msdcsc.exe
PID 2588 wrote to memory of 4572	2588	msdcsc.exe	msdcsc.exe
PID 2588 wrote to memory of 4572	2588	msdcsc.exe	msdcsc.exe
PID 2588 wrote to memory of 4572	2588	msdcsc.exe	msdcsc.exe
PID 2588 wrote to memory of 4572	2588	msdcsc.exe	msdcsc.exe
PID 4572 wrote to memory of 4540	4572	msdcsc.exe	msdcsc.exe
PID 4572 wrote to memory of 4540	4572	msdcsc.exe	msdcsc.exe
PID 4572 wrote to memory of 4540	4572	msdcsc.exe	msdcsc.exe
PID 4572 wrote to memory of 4540	4572	msdcsc.exe	msdcsc.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

2676 attrib.exe
2560 attrib.exe

pid	process
2676	attrib.exe
2560	attrib.exe

C:\Users\Admin\AppData\Local\Temp\5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
"C:\Users\Admin\AppData\Local\Temp\5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036

C:\Users\Admin\AppData\Local\Temp\5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
C:\Users\Admin\AppData\Local\Temp\5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628

C:\Users\Admin\AppData\Local\Temp\5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe
"C:\Users\Admin\AppData\Local\Temp\5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe"
3⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe" +s +h
4⤵
- Suspicious use of WriteProcessMemory
PID:2548

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6.exe" +s +h
5⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2676

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
4⤵
- Suspicious use of WriteProcessMemory
PID:2536

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
5⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2560

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2588

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4572

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
6⤵
- Executes dropped EXE
PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 80
7⤵
- Program crash
PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4540 -ip 4540
1⤵
PID:3528

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2

T1158

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
1.6MB

MD5
0620050df2e5a15c53b9035407c4cfbf

SHA1
5a7cfa25d0c9e1ce1838310c450a5d3c1a81e62f

SHA256
5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6

SHA512
1f88713ff76982305fac2ced56f838ab36721e25c6589934cd25489ae8eb149555d8004c96a36aa9e8429cdfb69aeb59a91e8a660618799115bf146084cc8816

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
1.6MB

MD5
0620050df2e5a15c53b9035407c4cfbf

SHA1
5a7cfa25d0c9e1ce1838310c450a5d3c1a81e62f

SHA256
5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6

SHA512
1f88713ff76982305fac2ced56f838ab36721e25c6589934cd25489ae8eb149555d8004c96a36aa9e8429cdfb69aeb59a91e8a660618799115bf146084cc8816

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
1.6MB

MD5
0620050df2e5a15c53b9035407c4cfbf

SHA1
5a7cfa25d0c9e1ce1838310c450a5d3c1a81e62f

SHA256
5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6

SHA512
1f88713ff76982305fac2ced56f838ab36721e25c6589934cd25489ae8eb149555d8004c96a36aa9e8429cdfb69aeb59a91e8a660618799115bf146084cc8816

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
1.6MB

MD5
0620050df2e5a15c53b9035407c4cfbf

SHA1
5a7cfa25d0c9e1ce1838310c450a5d3c1a81e62f

SHA256
5b2f4726b2508e3a148af9d1dcb32de589c0255df8c588ad7cd26ecc0b4510e6

SHA512
1f88713ff76982305fac2ced56f838ab36721e25c6589934cd25489ae8eb149555d8004c96a36aa9e8429cdfb69aeb59a91e8a660618799115bf146084cc8816

Download Submit
memory/2036-132-0x0000000000BA0000-0x0000000000C9E000-memory.dmp

Filesize
1016KB

Download
memory/2036-133-0x00000000055F0000-0x000000000568C000-memory.dmp

Filesize
624KB

Download
memory/2172-164-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2172-140-0x0000000000000000-mapping.dmp

Download
memory/2172-141-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2172-142-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2172-143-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2172-145-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2536-147-0x0000000000000000-mapping.dmp

Download
memory/2548-146-0x0000000000000000-mapping.dmp

Download
memory/2560-152-0x0000000000000000-mapping.dmp

Download
memory/2588-148-0x0000000000000000-mapping.dmp

Download
memory/2628-144-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2628-137-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2628-135-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2628-134-0x0000000000000000-mapping.dmp

Download
memory/2676-150-0x0000000000000000-mapping.dmp

Download
memory/4540-160-0x0000000000000000-mapping.dmp

Download
memory/4572-153-0x0000000000000000-mapping.dmp

Download
memory/4572-157-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4572-163-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads