darkcomet | 55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919

Analysis

max time kernel
145s
max time network
154s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
Size

1.6MB
MD5

e7881724e1d97b8004f05d94b99f15aa
SHA1

6e35acbf488e569a2b23d2fac9abd1fdc76a010e
SHA256

55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919
SHA512

418156d64454b6587c21ab3e89b21c39d4f1c702f8530ea93a62694f63253e7487e2c80dd5151159b9e5e16bf204299669a057f9520cb6c39256bc9f0ccdb721
SSDEEP

24576:6tb20pkaCqT5TBWgNQ7ad0AtBp5tncdp5JdL8JDOFrksduEIdN6A:nVg5tQ7ad7J5tKjJdL8ikuNIz5

Score

10^/10

darkcomet infected persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Infected

rattingfordays.no-ip.biz:100

Mutex

DC_MUTEX-3K6C68T

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
JDBdm8s85Wwr
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe

Executes dropped EXE 3 IoCs

Processes:

msdcsc.exemsdcsc.exemsdcsc.exe

pid process

1624 msdcsc.exe
1888 msdcsc.exe
632 msdcsc.exe
Loads dropped DLL 2 IoCs

Processes:

55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exemsdcsc.exe

pid process

2024 55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
1624 msdcsc.exe

pid	process
1624	msdcsc.exe
1888	msdcsc.exe
632	msdcsc.exe

pid	process
2024	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
1624	msdcsc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	msdcsc.exe

AutoIT Executable 6 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
\Users\Admin\Documents\MSDCSC\msdcsc.exe	autoit_exe
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe	autoit_exe
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe	autoit_exe
\Users\Admin\Documents\MSDCSC\msdcsc.exe	autoit_exe
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe	autoit_exe
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe	autoit_exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exemsdcsc.exemsdcsc.exe

description	pid	process	target process
PID 2028 set thread context of 2024	2028	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
PID 1888 set thread context of 632	1888	msdcsc.exe	msdcsc.exe
PID 632 set thread context of 824	632	msdcsc.exe	iexplore.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BBB26821-6E83-11ED-BD75-FAF5FAF3A79A} = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00c045969002d901	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376339752"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ebdab66b882be4295867b0af6f4f1950000000002000000000010660000000100002000000037bf43dd8b70d70872f2807a40805e60c176b2b93322cb10389cb494573eab95000000000e8000000002000020000000c61973304ff783e33717a8a10af3ab056ab899f16bd6884cf247aeb784e492e7900000005831b8ffbeeddb4c979f4169ad2f019c62b453aeb1b0bc7cf2b953e5c612f44fac3db28eb47c9689ea66cda0cb0851e1e92a8d2fef7118834755c73957594fc428809a7680de6cc15332072fbc347bb96e523ba16e42e7f4ae6a92a94602b44b08d735f42fa3d8822029b44d8ee555a343204a2343244767ad1a25876ef9b0bb26db5098a2a070deeae2eacf29b3872d400000006fca8e4df33b9bc7eca512900ddbd02eefaef97951f4424addb19a8f4a12d675e6bf9da47e166cc2dbf247fbb2d598f34bc99a0a25fbb8579103c07d5cf4ca61	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ebdab66b882be4295867b0af6f4f1950000000002000000000010660000000100002000000054eeca29d9e90c05259647979d851b15aaa689cae7229e9cc4cefa3d8d6d04e3000000000e8000000002000020000000a89d7e8fbe36e3d12366af2e04f63a0819ec6d13684f4dae9d2e9508e8c588972000000049364ae62f5f5b535b2765884f7d7f25de712a137fbbdf37e1c473a94712f73940000000c6046088b803a237f51e8e7f7cabf0a1f28aef3790297077555162299f759544443675852440f0013b4429870e7b678233632790efbb880f0ba0bba95910f0c2	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exemsdcsc.exe

pid process

2028 55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
1888 msdcsc.exe

pid	process
2028	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
1888	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2024	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
Token: SeSecurityPrivilege	2024	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
Token: SeTakeOwnershipPrivilege	2024	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
Token: SeLoadDriverPrivilege	2024	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
Token: SeSystemProfilePrivilege	2024	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
Token: SeSystemtimePrivilege	2024	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
Token: SeProfSingleProcessPrivilege	2024	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
Token: SeIncBasePriorityPrivilege	2024	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
Token: SeCreatePagefilePrivilege	2024	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
Token: SeBackupPrivilege	2024	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
Token: SeRestorePrivilege	2024	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
Token: SeShutdownPrivilege	2024	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
Token: SeDebugPrivilege	2024	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
Token: SeSystemEnvironmentPrivilege	2024	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
Token: SeChangeNotifyPrivilege	2024	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
Token: SeRemoteShutdownPrivilege	2024	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
Token: SeUndockPrivilege	2024	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
Token: SeManageVolumePrivilege	2024	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
Token: SeImpersonatePrivilege	2024	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
Token: SeCreateGlobalPrivilege	2024	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
Token: 33	2024	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
Token: 34	2024	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
Token: 35	2024	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
Token: SeIncreaseQuotaPrivilege	632	msdcsc.exe
Token: SeSecurityPrivilege	632	msdcsc.exe
Token: SeTakeOwnershipPrivilege	632	msdcsc.exe
Token: SeLoadDriverPrivilege	632	msdcsc.exe
Token: SeSystemProfilePrivilege	632	msdcsc.exe
Token: SeSystemtimePrivilege	632	msdcsc.exe
Token: SeProfSingleProcessPrivilege	632	msdcsc.exe
Token: SeIncBasePriorityPrivilege	632	msdcsc.exe
Token: SeCreatePagefilePrivilege	632	msdcsc.exe
Token: SeBackupPrivilege	632	msdcsc.exe
Token: SeRestorePrivilege	632	msdcsc.exe
Token: SeShutdownPrivilege	632	msdcsc.exe
Token: SeDebugPrivilege	632	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	632	msdcsc.exe
Token: SeChangeNotifyPrivilege	632	msdcsc.exe
Token: SeRemoteShutdownPrivilege	632	msdcsc.exe
Token: SeUndockPrivilege	632	msdcsc.exe
Token: SeManageVolumePrivilege	632	msdcsc.exe
Token: SeImpersonatePrivilege	632	msdcsc.exe
Token: SeCreateGlobalPrivilege	632	msdcsc.exe
Token: 33	632	msdcsc.exe
Token: 34	632	msdcsc.exe
Token: 35	632	msdcsc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

1832 IEXPLORE.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXE

pid process

1832 IEXPLORE.EXE
1832 IEXPLORE.EXE
1252 IEXPLORE.EXE
1252 IEXPLORE.EXE
1252 IEXPLORE.EXE
1252 IEXPLORE.EXE

pid	process
1832	IEXPLORE.EXE

pid	process
1832	IEXPLORE.EXE
1832	IEXPLORE.EXE
1252	IEXPLORE.EXE
1252	IEXPLORE.EXE
1252	IEXPLORE.EXE
1252	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exemsdcsc.exemsdcsc.exemsdcsc.exeiexplore.exeiexplore.exeIEXPLORE.EXE

description	pid	process	target process
PID 1076 wrote to memory of 2028	1076	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
PID 1076 wrote to memory of 2028	1076	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
PID 1076 wrote to memory of 2028	1076	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
PID 1076 wrote to memory of 2028	1076	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
PID 2028 wrote to memory of 2024	2028	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
PID 2028 wrote to memory of 2024	2028	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
PID 2028 wrote to memory of 2024	2028	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
PID 2028 wrote to memory of 2024	2028	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
PID 2028 wrote to memory of 2024	2028	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
PID 2028 wrote to memory of 2024	2028	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
PID 2024 wrote to memory of 1624	2024	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe	msdcsc.exe
PID 2024 wrote to memory of 1624	2024	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe	msdcsc.exe
PID 2024 wrote to memory of 1624	2024	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe	msdcsc.exe
PID 2024 wrote to memory of 1624	2024	55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe	msdcsc.exe
PID 1624 wrote to memory of 1888	1624	msdcsc.exe	msdcsc.exe
PID 1624 wrote to memory of 1888	1624	msdcsc.exe	msdcsc.exe
PID 1624 wrote to memory of 1888	1624	msdcsc.exe	msdcsc.exe
PID 1624 wrote to memory of 1888	1624	msdcsc.exe	msdcsc.exe
PID 1888 wrote to memory of 632	1888	msdcsc.exe	msdcsc.exe
PID 1888 wrote to memory of 632	1888	msdcsc.exe	msdcsc.exe
PID 1888 wrote to memory of 632	1888	msdcsc.exe	msdcsc.exe
PID 1888 wrote to memory of 632	1888	msdcsc.exe	msdcsc.exe
PID 1888 wrote to memory of 632	1888	msdcsc.exe	msdcsc.exe
PID 1888 wrote to memory of 632	1888	msdcsc.exe	msdcsc.exe
PID 632 wrote to memory of 824	632	msdcsc.exe	iexplore.exe
PID 632 wrote to memory of 824	632	msdcsc.exe	iexplore.exe
PID 632 wrote to memory of 824	632	msdcsc.exe	iexplore.exe
PID 632 wrote to memory of 824	632	msdcsc.exe	iexplore.exe
PID 632 wrote to memory of 824	632	msdcsc.exe	iexplore.exe
PID 632 wrote to memory of 824	632	msdcsc.exe	iexplore.exe
PID 824 wrote to memory of 1724	824	iexplore.exe	iexplore.exe
PID 824 wrote to memory of 1724	824	iexplore.exe	iexplore.exe
PID 824 wrote to memory of 1724	824	iexplore.exe	iexplore.exe
PID 824 wrote to memory of 1724	824	iexplore.exe	iexplore.exe
PID 1724 wrote to memory of 1832	1724	iexplore.exe	IEXPLORE.EXE
PID 1724 wrote to memory of 1832	1724	iexplore.exe	IEXPLORE.EXE
PID 1724 wrote to memory of 1832	1724	iexplore.exe	IEXPLORE.EXE
PID 1724 wrote to memory of 1832	1724	iexplore.exe	IEXPLORE.EXE
PID 1832 wrote to memory of 1252	1832	IEXPLORE.EXE	IEXPLORE.EXE
PID 1832 wrote to memory of 1252	1832	IEXPLORE.EXE	IEXPLORE.EXE
PID 1832 wrote to memory of 1252	1832	IEXPLORE.EXE	IEXPLORE.EXE
PID 1832 wrote to memory of 1252	1832	IEXPLORE.EXE	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
"C:\Users\Admin\AppData\Local\Temp\55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1076

C:\Users\Admin\AppData\Local\Temp\55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
"C:\Users\Admin\AppData\Local\Temp\55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe" /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\732120" "C:\Users\Admin\AppData\Local\Temp\55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2028

C:\Users\Admin\AppData\Local\Temp\55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe
"C:\Users\Admin\AppData\Local\Temp\55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919.exe"
3⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1624

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe" /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\672072" "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1888

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:632

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
7⤵
- Suspicious use of WriteProcessMemory
PID:824

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\531731" "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
8⤵
- Suspicious use of WriteProcessMemory
PID:1724

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\531731" "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
9⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1832 CREDAT:275457 /prefetch:2
10⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1252

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\672072
Filesize
15KB

MD5
7040a16aaf3f6e910659af3636bbe6be

SHA1
c4d72a1cf968da2ab274c8d9dc2b13a55223be64

SHA256
2b88e2d0b5ee95843e6bba987097ad42dc0c2715ea2adf47289f676795454aee

SHA512
199d43e845d7c6d394cae98a133c7fff96b71bdef8437aeb6651d44d6731a71efa2e23991384a9e1a3f66c7a38c9fcd71d7e16e2513e8148d21dd2b2bbc3e479

Download Submit
C:\Users\Admin\AppData\Local\Temp\732120
Filesize
15KB

MD5
7040a16aaf3f6e910659af3636bbe6be

SHA1
c4d72a1cf968da2ab274c8d9dc2b13a55223be64

SHA256
2b88e2d0b5ee95843e6bba987097ad42dc0c2715ea2adf47289f676795454aee

SHA512
199d43e845d7c6d394cae98a133c7fff96b71bdef8437aeb6651d44d6731a71efa2e23991384a9e1a3f66c7a38c9fcd71d7e16e2513e8148d21dd2b2bbc3e479

Download Submit
C:\Users\Admin\AppData\Local\Temp\incl1
Filesize
12KB

MD5
fcaa757b4fc32b9c0c66fe31b0de5376

SHA1
472bc2e27449278786857bfe609c868127606c3f

SHA256
c413b175de5a10cc23eff47d24279b269b3caf5e45d0f1de1ca645c4381fbac9

SHA512
ef6186305b43fc0e42cebaac82f123b83be7077a5dd1004bb9b4f82c95da57230b35a24f787ee8e63ed397e91660cfb40c1338f69c68bc7dbce381b53fe4f61c

Download Submit
C:\Users\Admin\AppData\Local\Temp\incl1
Filesize
12KB

MD5
fcaa757b4fc32b9c0c66fe31b0de5376

SHA1
472bc2e27449278786857bfe609c868127606c3f

SHA256
c413b175de5a10cc23eff47d24279b269b3caf5e45d0f1de1ca645c4381fbac9

SHA512
ef6186305b43fc0e42cebaac82f123b83be7077a5dd1004bb9b4f82c95da57230b35a24f787ee8e63ed397e91660cfb40c1338f69c68bc7dbce381b53fe4f61c

Download Submit
C:\Users\Admin\AppData\Local\Temp\incl2
Filesize
756KB

MD5
7b0aeacc3ec46411d355c090e84a2267

SHA1
df573a32519a78edaf37ef2b4d858b031976dc2d

SHA256
4b866c78b96f4f82dea55d9864195e8915b666c5e4e070196ac31fbec6510cd1

SHA512
8b697dbad9a709193555ab1ede5402f74f788500311d9a319fd164732c5be9b3c7038dc16bb1a6b1c565b60aa86bf2af57585ea065c15cbd2733bb03c758e2a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\incl2
Filesize
756KB

MD5
7b0aeacc3ec46411d355c090e84a2267

SHA1
df573a32519a78edaf37ef2b4d858b031976dc2d

SHA256
4b866c78b96f4f82dea55d9864195e8915b666c5e4e070196ac31fbec6510cd1

SHA512
8b697dbad9a709193555ab1ede5402f74f788500311d9a319fd164732c5be9b3c7038dc16bb1a6b1c565b60aa86bf2af57585ea065c15cbd2733bb03c758e2a7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\9L9PNDWY.txt
Filesize
608B

MD5
2f965ac8d11b974944c1efc3098c6be8

SHA1
2a2a4bb56a2278b216f0d6656967a4ac971a1472

SHA256
5028f1ea9977c62eed75790a57ee2382e5bfcb824a74a13f80a46ff9cc566926

SHA512
21e5eecbab47974515e61e61633e796f6c9b7ef845ce9017c9a4978fefebbd12f966cb4db7717bf1c854938c8a164a75aef094b56e9db30b3886671675cebd48

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
1.6MB

MD5
e7881724e1d97b8004f05d94b99f15aa

SHA1
6e35acbf488e569a2b23d2fac9abd1fdc76a010e

SHA256
55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919

SHA512
418156d64454b6587c21ab3e89b21c39d4f1c702f8530ea93a62694f63253e7487e2c80dd5151159b9e5e16bf204299669a057f9520cb6c39256bc9f0ccdb721

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
1.6MB

MD5
e7881724e1d97b8004f05d94b99f15aa

SHA1
6e35acbf488e569a2b23d2fac9abd1fdc76a010e

SHA256
55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919

SHA512
418156d64454b6587c21ab3e89b21c39d4f1c702f8530ea93a62694f63253e7487e2c80dd5151159b9e5e16bf204299669a057f9520cb6c39256bc9f0ccdb721

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
1.6MB

MD5
e7881724e1d97b8004f05d94b99f15aa

SHA1
6e35acbf488e569a2b23d2fac9abd1fdc76a010e

SHA256
55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919

SHA512
418156d64454b6587c21ab3e89b21c39d4f1c702f8530ea93a62694f63253e7487e2c80dd5151159b9e5e16bf204299669a057f9520cb6c39256bc9f0ccdb721

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
1.6MB

MD5
e7881724e1d97b8004f05d94b99f15aa

SHA1
6e35acbf488e569a2b23d2fac9abd1fdc76a010e

SHA256
55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919

SHA512
418156d64454b6587c21ab3e89b21c39d4f1c702f8530ea93a62694f63253e7487e2c80dd5151159b9e5e16bf204299669a057f9520cb6c39256bc9f0ccdb721

Download Submit
\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
1.6MB

MD5
e7881724e1d97b8004f05d94b99f15aa

SHA1
6e35acbf488e569a2b23d2fac9abd1fdc76a010e

SHA256
55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919

SHA512
418156d64454b6587c21ab3e89b21c39d4f1c702f8530ea93a62694f63253e7487e2c80dd5151159b9e5e16bf204299669a057f9520cb6c39256bc9f0ccdb721

Download Submit
\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
1.6MB

MD5
e7881724e1d97b8004f05d94b99f15aa

SHA1
6e35acbf488e569a2b23d2fac9abd1fdc76a010e

SHA256
55fbc8f96b54789e032d9d79bb766592e4ccc54c8e7eacbd16142f7f9d529919

SHA512
418156d64454b6587c21ab3e89b21c39d4f1c702f8530ea93a62694f63253e7487e2c80dd5151159b9e5e16bf204299669a057f9520cb6c39256bc9f0ccdb721

Download Submit
memory/632-85-0x0000000000080000-0x000000000014A000-memory.dmp

Filesize
808KB

Download
memory/632-83-0x000000000010F888-mapping.dmp

Download
memory/632-87-0x0000000000080000-0x000000000014A000-memory.dmp

Filesize
808KB

Download
memory/632-88-0x0000000000080000-0x000000000014A000-memory.dmp

Filesize
808KB

Download
memory/632-89-0x0000000000080000-0x000000000014A000-memory.dmp

Filesize
808KB

Download
memory/632-82-0x0000000000080000-0x000000000014A000-memory.dmp

Filesize
808KB

Download
memory/1076-54-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download
memory/1624-68-0x0000000000000000-mapping.dmp

Download
memory/1888-74-0x0000000000000000-mapping.dmp

Download
memory/2024-63-0x00000000002BF888-mapping.dmp

Download
memory/2024-72-0x0000000000230000-0x00000000002FA000-memory.dmp

Filesize
808KB

Download
memory/2024-66-0x0000000000230000-0x00000000002FA000-memory.dmp

Filesize
808KB

Download
memory/2024-64-0x0000000000230000-0x00000000002FA000-memory.dmp

Filesize
808KB

Download
memory/2024-62-0x0000000000230000-0x00000000002FA000-memory.dmp

Filesize
808KB

Download
memory/2024-60-0x0000000000230000-0x00000000002FA000-memory.dmp

Filesize
808KB

Download
memory/2028-55-0x0000000000000000-mapping.dmp

Download