darkcomet | 70cc71ce250a4ec732a59e30adf100878e93d8f7afd4a923628314b9b0e2dc11

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14-03-2023 08:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PO21019612.exe
Size

2.0MB
MD5

72729cee30402c13712d1522aef2974b
SHA1

5e24a49c70260a8cb42469dc41bb6b5f2557ec50
SHA256

70cc71ce250a4ec732a59e30adf100878e93d8f7afd4a923628314b9b0e2dc11
SHA512

16aaeabd94bec9ec836dbdf3efc4373adced6605be74641d694a5795b8c0502377de339e85d7bad058fe100a984dab97f53ac45270c325b7443f3a153c6b0178
SSDEEP

49152:FXQBFvAF1FMSNqZVIx9RcRK1HsWYnowZm:FeFIFCG9RcRK2Pntm

Score

10^/10

darkcomet nanocore march 2023 evasion keylogger persistence rat spyware stealer trojan

Malware Config

Extracted

Family

darkcomet

Botnet

MARCH 2023

mjosh6995.ddns.net:1754

Mutex

DC_MUTEX-D2P1SDG

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
vlwkQZyi3NSt
install
true
offline_keylogger
true
persistence
true
reg_key
chrome

Extracted

Family

nanocore

Version

1.2.2.0

mjosh6995.ddns.net:2023

lisajennyjohn.ddns.net:2023

Mutex

a7795112-1a95-404c-bdfa-d35dc6f40a46

Attributes

activate_away_mode
false
backup_connection_host
lisajennyjohn.ddns.net
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-12-22T21:54:57.028602236Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
2023
default_group
MARCH 2023
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
a7795112-1a95-404c-bdfa-d35dc6f40a46
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
mjosh6995.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

PO21019612.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	PO21019612.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

msdcsc.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	msdcsc.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe

Disables Task Manager via registry modification
evasion
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

1716 attrib.exe
1120 attrib.exe
Deletes itself 1 IoCs

Processes:

notepad.exe

pid process

1616 notepad.exe
Executes dropped EXE 6 IoCs

Processes:

MARCH STUB.EXEmsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exeMARCH STUB.EXE

pid process

1192 MARCH STUB.EXE
276 msdcsc.exe
268 msdcsc.exe
648 msdcsc.exe
808 msdcsc.exe
1652 MARCH STUB.EXE
Loads dropped DLL 5 IoCs

Processes:

PO21019612.exemsdcsc.exe

pid process

604 PO21019612.exe
604 PO21019612.exe
604 PO21019612.exe
808 msdcsc.exe
808 msdcsc.exe

pid	process
1716	attrib.exe
1120	attrib.exe

pid	process
1616	notepad.exe

pid	process
1192	MARCH STUB.EXE
276	msdcsc.exe
268	msdcsc.exe
648	msdcsc.exe
808	msdcsc.exe
1652	MARCH STUB.EXE

pid	process
604	PO21019612.exe
604	PO21019612.exe
604	PO21019612.exe
808	msdcsc.exe
808	msdcsc.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

PO21019612.exeMARCH STUB.EXEmsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	PO21019612.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ARP Subsystem = "C:\\Program Files (x86)\\ARP Subsystem\\arpss.exe"	MARCH STUB.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

MARCH STUB.EXE

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MARCH STUB.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MARCH STUB.EXE

Suspicious use of SetThreadContext 2 IoCs

Processes:

PO21019612.exemsdcsc.exe

description	pid	process	target process
PID 2024 set thread context of 604	2024	PO21019612.exe	PO21019612.exe
PID 276 set thread context of 808	276	msdcsc.exe	msdcsc.exe

Drops file in Program Files directory 2 IoCs

Processes:

MARCH STUB.EXE

description	ioc	process
File created	C:\Program Files (x86)\ARP Subsystem\arpss.exe	MARCH STUB.EXE
File opened for modification	C:\Program Files (x86)\ARP Subsystem\arpss.exe	MARCH STUB.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1352 schtasks.exe
2020 schtasks.exe

pid	process
1352	schtasks.exe
2020	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

Processes:

PO21019612.exepowershell.exepowershell.exeMARCH STUB.EXEmsdcsc.exepowershell.exepowershell.exe

pid	process
2024	PO21019612.exe
2024	PO21019612.exe
2024	PO21019612.exe
2024	PO21019612.exe
2024	PO21019612.exe
2024	PO21019612.exe
2024	PO21019612.exe
2024	PO21019612.exe
2024	PO21019612.exe
2024	PO21019612.exe
2024	PO21019612.exe
2024	PO21019612.exe
612	powershell.exe
648	powershell.exe
1192	MARCH STUB.EXE
1192	MARCH STUB.EXE
1192	MARCH STUB.EXE
276	msdcsc.exe
276	msdcsc.exe
276	msdcsc.exe
276	msdcsc.exe
276	msdcsc.exe
276	msdcsc.exe
276	msdcsc.exe
1712	powershell.exe
272	powershell.exe
276	msdcsc.exe
276	msdcsc.exe
276	msdcsc.exe
276	msdcsc.exe
276	msdcsc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

MARCH STUB.EXE

pid process

1192 MARCH STUB.EXE

pid	process
1192	MARCH STUB.EXE

Suspicious use of AdjustPrivilegeToken 53 IoCs

Processes:

PO21019612.exePO21019612.exepowershell.exepowershell.exeMARCH STUB.EXEmsdcsc.exepowershell.exepowershell.exemsdcsc.exe

description	pid	process
Token: SeDebugPrivilege	2024	PO21019612.exe
Token: SeIncreaseQuotaPrivilege	604	PO21019612.exe
Token: SeSecurityPrivilege	604	PO21019612.exe
Token: SeTakeOwnershipPrivilege	604	PO21019612.exe
Token: SeLoadDriverPrivilege	604	PO21019612.exe
Token: SeSystemProfilePrivilege	604	PO21019612.exe
Token: SeSystemtimePrivilege	604	PO21019612.exe
Token: SeProfSingleProcessPrivilege	604	PO21019612.exe
Token: SeIncBasePriorityPrivilege	604	PO21019612.exe
Token: SeCreatePagefilePrivilege	604	PO21019612.exe
Token: SeBackupPrivilege	604	PO21019612.exe
Token: SeRestorePrivilege	604	PO21019612.exe
Token: SeShutdownPrivilege	604	PO21019612.exe
Token: SeDebugPrivilege	604	PO21019612.exe
Token: SeSystemEnvironmentPrivilege	604	PO21019612.exe
Token: SeChangeNotifyPrivilege	604	PO21019612.exe
Token: SeDebugPrivilege	612	powershell.exe
Token: SeDebugPrivilege	648	powershell.exe
Token: SeRemoteShutdownPrivilege	604	PO21019612.exe
Token: SeUndockPrivilege	604	PO21019612.exe
Token: SeManageVolumePrivilege	604	PO21019612.exe
Token: SeImpersonatePrivilege	604	PO21019612.exe
Token: SeCreateGlobalPrivilege	604	PO21019612.exe
Token: 33	604	PO21019612.exe
Token: 34	604	PO21019612.exe
Token: 35	604	PO21019612.exe
Token: SeDebugPrivilege	1192	MARCH STUB.EXE
Token: SeDebugPrivilege	276	msdcsc.exe
Token: SeDebugPrivilege	1712	powershell.exe
Token: SeDebugPrivilege	272	powershell.exe
Token: SeIncreaseQuotaPrivilege	808	msdcsc.exe
Token: SeSecurityPrivilege	808	msdcsc.exe
Token: SeTakeOwnershipPrivilege	808	msdcsc.exe
Token: SeLoadDriverPrivilege	808	msdcsc.exe
Token: SeSystemProfilePrivilege	808	msdcsc.exe
Token: SeSystemtimePrivilege	808	msdcsc.exe
Token: SeProfSingleProcessPrivilege	808	msdcsc.exe
Token: SeIncBasePriorityPrivilege	808	msdcsc.exe
Token: SeCreatePagefilePrivilege	808	msdcsc.exe
Token: SeBackupPrivilege	808	msdcsc.exe
Token: SeRestorePrivilege	808	msdcsc.exe
Token: SeShutdownPrivilege	808	msdcsc.exe
Token: SeDebugPrivilege	808	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	808	msdcsc.exe
Token: SeChangeNotifyPrivilege	808	msdcsc.exe
Token: SeRemoteShutdownPrivilege	808	msdcsc.exe
Token: SeUndockPrivilege	808	msdcsc.exe
Token: SeManageVolumePrivilege	808	msdcsc.exe
Token: SeImpersonatePrivilege	808	msdcsc.exe
Token: SeCreateGlobalPrivilege	808	msdcsc.exe
Token: 33	808	msdcsc.exe
Token: 34	808	msdcsc.exe
Token: 35	808	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

808 msdcsc.exe

pid	process
808	msdcsc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

PO21019612.exePO21019612.execmd.execmd.exe

description	pid	process	target process
PID 2024 wrote to memory of 648	2024	PO21019612.exe	powershell.exe
PID 2024 wrote to memory of 648	2024	PO21019612.exe	powershell.exe
PID 2024 wrote to memory of 648	2024	PO21019612.exe	powershell.exe
PID 2024 wrote to memory of 648	2024	PO21019612.exe	powershell.exe
PID 2024 wrote to memory of 612	2024	PO21019612.exe	powershell.exe
PID 2024 wrote to memory of 612	2024	PO21019612.exe	powershell.exe
PID 2024 wrote to memory of 612	2024	PO21019612.exe	powershell.exe
PID 2024 wrote to memory of 612	2024	PO21019612.exe	powershell.exe
PID 2024 wrote to memory of 1352	2024	PO21019612.exe	schtasks.exe
PID 2024 wrote to memory of 1352	2024	PO21019612.exe	schtasks.exe
PID 2024 wrote to memory of 1352	2024	PO21019612.exe	schtasks.exe
PID 2024 wrote to memory of 1352	2024	PO21019612.exe	schtasks.exe
PID 2024 wrote to memory of 1400	2024	PO21019612.exe	PO21019612.exe
PID 2024 wrote to memory of 1400	2024	PO21019612.exe	PO21019612.exe
PID 2024 wrote to memory of 1400	2024	PO21019612.exe	PO21019612.exe
PID 2024 wrote to memory of 1400	2024	PO21019612.exe	PO21019612.exe
PID 2024 wrote to memory of 896	2024	PO21019612.exe	PO21019612.exe
PID 2024 wrote to memory of 896	2024	PO21019612.exe	PO21019612.exe
PID 2024 wrote to memory of 896	2024	PO21019612.exe	PO21019612.exe
PID 2024 wrote to memory of 896	2024	PO21019612.exe	PO21019612.exe
PID 2024 wrote to memory of 604	2024	PO21019612.exe	PO21019612.exe
PID 2024 wrote to memory of 604	2024	PO21019612.exe	PO21019612.exe
PID 2024 wrote to memory of 604	2024	PO21019612.exe	PO21019612.exe
PID 2024 wrote to memory of 604	2024	PO21019612.exe	PO21019612.exe
PID 2024 wrote to memory of 604	2024	PO21019612.exe	PO21019612.exe
PID 2024 wrote to memory of 604	2024	PO21019612.exe	PO21019612.exe
PID 2024 wrote to memory of 604	2024	PO21019612.exe	PO21019612.exe
PID 2024 wrote to memory of 604	2024	PO21019612.exe	PO21019612.exe
PID 2024 wrote to memory of 604	2024	PO21019612.exe	PO21019612.exe
PID 2024 wrote to memory of 604	2024	PO21019612.exe	PO21019612.exe
PID 2024 wrote to memory of 604	2024	PO21019612.exe	PO21019612.exe
PID 2024 wrote to memory of 604	2024	PO21019612.exe	PO21019612.exe
PID 2024 wrote to memory of 604	2024	PO21019612.exe	PO21019612.exe
PID 604 wrote to memory of 1808	604	PO21019612.exe	cmd.exe
PID 604 wrote to memory of 1808	604	PO21019612.exe	cmd.exe
PID 604 wrote to memory of 1808	604	PO21019612.exe	cmd.exe
PID 604 wrote to memory of 1808	604	PO21019612.exe	cmd.exe
PID 604 wrote to memory of 1592	604	PO21019612.exe	cmd.exe
PID 604 wrote to memory of 1592	604	PO21019612.exe	cmd.exe
PID 604 wrote to memory of 1592	604	PO21019612.exe	cmd.exe
PID 604 wrote to memory of 1592	604	PO21019612.exe	cmd.exe
PID 604 wrote to memory of 1192	604	PO21019612.exe	MARCH STUB.EXE
PID 604 wrote to memory of 1192	604	PO21019612.exe	MARCH STUB.EXE
PID 604 wrote to memory of 1192	604	PO21019612.exe	MARCH STUB.EXE
PID 604 wrote to memory of 1192	604	PO21019612.exe	MARCH STUB.EXE
PID 1592 wrote to memory of 1120	1592	cmd.exe	attrib.exe
PID 1592 wrote to memory of 1120	1592	cmd.exe	attrib.exe
PID 1592 wrote to memory of 1120	1592	cmd.exe	attrib.exe
PID 1592 wrote to memory of 1120	1592	cmd.exe	attrib.exe
PID 1808 wrote to memory of 1716	1808	cmd.exe	attrib.exe
PID 1808 wrote to memory of 1716	1808	cmd.exe	attrib.exe
PID 1808 wrote to memory of 1716	1808	cmd.exe	attrib.exe
PID 1808 wrote to memory of 1716	1808	cmd.exe	attrib.exe
PID 604 wrote to memory of 1616	604	PO21019612.exe	notepad.exe
PID 604 wrote to memory of 1616	604	PO21019612.exe	notepad.exe
PID 604 wrote to memory of 1616	604	PO21019612.exe	notepad.exe
PID 604 wrote to memory of 1616	604	PO21019612.exe	notepad.exe
PID 604 wrote to memory of 1616	604	PO21019612.exe	notepad.exe
PID 604 wrote to memory of 1616	604	PO21019612.exe	notepad.exe
PID 604 wrote to memory of 1616	604	PO21019612.exe	notepad.exe
PID 604 wrote to memory of 1616	604	PO21019612.exe	notepad.exe
PID 604 wrote to memory of 1616	604	PO21019612.exe	notepad.exe
PID 604 wrote to memory of 1616	604	PO21019612.exe	notepad.exe
PID 604 wrote to memory of 1616	604	PO21019612.exe	notepad.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

1716 attrib.exe
1120 attrib.exe

pid	process
1716	attrib.exe
1120	attrib.exe

C:\Users\Admin\AppData\Local\Temp\PO21019612.exe
"C:\Users\Admin\AppData\Local\Temp\PO21019612.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO21019612.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:648

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SZSALrLiZcPqvl.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:612

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SZSALrLiZcPqvl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp13A.tmp"
2⤵
- Creates scheduled task(s)
PID:1352

C:\Users\Admin\AppData\Local\Temp\PO21019612.exe
"C:\Users\Admin\AppData\Local\Temp\PO21019612.exe"
2⤵
PID:1400

C:\Users\Admin\AppData\Local\Temp\PO21019612.exe
"C:\Users\Admin\AppData\Local\Temp\PO21019612.exe"
2⤵
PID:896

C:\Users\Admin\AppData\Local\Temp\PO21019612.exe
"C:\Users\Admin\AppData\Local\Temp\PO21019612.exe"
2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:604

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\PO21019612.exe" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\PO21019612.exe" +s +h
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1716

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:1592

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1120

C:\Users\Admin\AppData\Local\Temp\MARCH STUB.EXE
"C:\Users\Admin\AppData\Local\Temp\MARCH STUB.EXE"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1192

C:\Windows\SysWOW64\notepad.exe
notepad
3⤵
- Deletes itself
PID:1616

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:276

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1712

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SZSALrLiZcPqvl.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:272

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SZSALrLiZcPqvl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF345.tmp"
4⤵
- Creates scheduled task(s)
PID:2020

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
4⤵
- Executes dropped EXE
PID:268

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
4⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:808

C:\Users\Admin\AppData\Local\Temp\MARCH STUB.EXE
"C:\Users\Admin\AppData\Local\Temp\MARCH STUB.EXE"
5⤵
- Executes dropped EXE
PID:1652

C:\Windows\SysWOW64\notepad.exe
notepad
5⤵
PID:1468

C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
4⤵
- Executes dropped EXE
PID:648

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Winlogon Helper DLL

T1004

Modify Existing Service

T1031

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MARCH STUB.EXE
Filesize
202KB

MD5
93f8ecd07909f71d55f6cdc163395503

SHA1
5e1d71119d8911d697120fdf07c5d7c52a335028

SHA256
bc88abf915245b6eca7c80c441e7527d6a61eb78091917e0b1bc844957512d4d

SHA512
bfbb0afeb2b0cfcd039fc0016d647500ff9a2e93bdaedc80147aa86cb0ea994b56dad10ad80d126332fd9c4850a011db3a20e8a2ca6ca67365970dc4e9b89af4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MARCH STUB.EXE
Filesize
202KB

MD5
93f8ecd07909f71d55f6cdc163395503

SHA1
5e1d71119d8911d697120fdf07c5d7c52a335028

SHA256
bc88abf915245b6eca7c80c441e7527d6a61eb78091917e0b1bc844957512d4d

SHA512
bfbb0afeb2b0cfcd039fc0016d647500ff9a2e93bdaedc80147aa86cb0ea994b56dad10ad80d126332fd9c4850a011db3a20e8a2ca6ca67365970dc4e9b89af4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MARCH STUB.EXE
Filesize
202KB

MD5
93f8ecd07909f71d55f6cdc163395503

SHA1
5e1d71119d8911d697120fdf07c5d7c52a335028

SHA256
bc88abf915245b6eca7c80c441e7527d6a61eb78091917e0b1bc844957512d4d

SHA512
bfbb0afeb2b0cfcd039fc0016d647500ff9a2e93bdaedc80147aa86cb0ea994b56dad10ad80d126332fd9c4850a011db3a20e8a2ca6ca67365970dc4e9b89af4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MARCH STUB.EXE
Filesize
202KB

MD5
93f8ecd07909f71d55f6cdc163395503

SHA1
5e1d71119d8911d697120fdf07c5d7c52a335028

SHA256
bc88abf915245b6eca7c80c441e7527d6a61eb78091917e0b1bc844957512d4d

SHA512
bfbb0afeb2b0cfcd039fc0016d647500ff9a2e93bdaedc80147aa86cb0ea994b56dad10ad80d126332fd9c4850a011db3a20e8a2ca6ca67365970dc4e9b89af4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp13A.tmp
Filesize
1KB

MD5
613fb497fd7ac37a51fadaa2bef33d52

SHA1
91c2b38d13d396d017f4ae911fe9a7f7cbf66b54

SHA256
0df202bc5fc5691ab21b8fb0288a673a6e9420948d15155178438125941f2282

SHA512
5503dd68d983433294949f87aef8c65a3610e5abb1e8a8c461be72b756cbb5d98063085d723ab76648babb1dba4336bf605f9e4fde67c75a04ffdcbc80eee007

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF345.tmp
Filesize
1KB

MD5
613fb497fd7ac37a51fadaa2bef33d52

SHA1
91c2b38d13d396d017f4ae911fe9a7f7cbf66b54

SHA256
0df202bc5fc5691ab21b8fb0288a673a6e9420948d15155178438125941f2282

SHA512
5503dd68d983433294949f87aef8c65a3610e5abb1e8a8c461be72b756cbb5d98063085d723ab76648babb1dba4336bf605f9e4fde67c75a04ffdcbc80eee007

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WE1UDR9UK16HYK6G7O02.temp
Filesize
7KB

MD5
c1e029a770a52248f8d08354025fd0c1

SHA1
32bdb856fbafbb7e9e91639d97bf325e71831fb9

SHA256
274ea5bf755f4990c3d5b969c2f27065002cb10855fcc0596cec64c99262f67f

SHA512
728412df296cd15dda5fc1622136e8ce284e55dd04920431ae836af69e1a6d92a9fcd1a42191dad5200bea7ab15a7805fba6006042cfce4e9d4e427fd21d005e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
c1e029a770a52248f8d08354025fd0c1

SHA1
32bdb856fbafbb7e9e91639d97bf325e71831fb9

SHA256
274ea5bf755f4990c3d5b969c2f27065002cb10855fcc0596cec64c99262f67f

SHA512
728412df296cd15dda5fc1622136e8ce284e55dd04920431ae836af69e1a6d92a9fcd1a42191dad5200bea7ab15a7805fba6006042cfce4e9d4e427fd21d005e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
c1e029a770a52248f8d08354025fd0c1

SHA1
32bdb856fbafbb7e9e91639d97bf325e71831fb9

SHA256
274ea5bf755f4990c3d5b969c2f27065002cb10855fcc0596cec64c99262f67f

SHA512
728412df296cd15dda5fc1622136e8ce284e55dd04920431ae836af69e1a6d92a9fcd1a42191dad5200bea7ab15a7805fba6006042cfce4e9d4e427fd21d005e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
c1e029a770a52248f8d08354025fd0c1

SHA1
32bdb856fbafbb7e9e91639d97bf325e71831fb9

SHA256
274ea5bf755f4990c3d5b969c2f27065002cb10855fcc0596cec64c99262f67f

SHA512
728412df296cd15dda5fc1622136e8ce284e55dd04920431ae836af69e1a6d92a9fcd1a42191dad5200bea7ab15a7805fba6006042cfce4e9d4e427fd21d005e

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
2.0MB

MD5
72729cee30402c13712d1522aef2974b

SHA1
5e24a49c70260a8cb42469dc41bb6b5f2557ec50

SHA256
70cc71ce250a4ec732a59e30adf100878e93d8f7afd4a923628314b9b0e2dc11

SHA512
16aaeabd94bec9ec836dbdf3efc4373adced6605be74641d694a5795b8c0502377de339e85d7bad058fe100a984dab97f53ac45270c325b7443f3a153c6b0178

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
2.0MB

MD5
72729cee30402c13712d1522aef2974b

SHA1
5e24a49c70260a8cb42469dc41bb6b5f2557ec50

SHA256
70cc71ce250a4ec732a59e30adf100878e93d8f7afd4a923628314b9b0e2dc11

SHA512
16aaeabd94bec9ec836dbdf3efc4373adced6605be74641d694a5795b8c0502377de339e85d7bad058fe100a984dab97f53ac45270c325b7443f3a153c6b0178

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
2.0MB

MD5
72729cee30402c13712d1522aef2974b

SHA1
5e24a49c70260a8cb42469dc41bb6b5f2557ec50

SHA256
70cc71ce250a4ec732a59e30adf100878e93d8f7afd4a923628314b9b0e2dc11

SHA512
16aaeabd94bec9ec836dbdf3efc4373adced6605be74641d694a5795b8c0502377de339e85d7bad058fe100a984dab97f53ac45270c325b7443f3a153c6b0178

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
2.0MB

MD5
72729cee30402c13712d1522aef2974b

SHA1
5e24a49c70260a8cb42469dc41bb6b5f2557ec50

SHA256
70cc71ce250a4ec732a59e30adf100878e93d8f7afd4a923628314b9b0e2dc11

SHA512
16aaeabd94bec9ec836dbdf3efc4373adced6605be74641d694a5795b8c0502377de339e85d7bad058fe100a984dab97f53ac45270c325b7443f3a153c6b0178

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
2.0MB

MD5
72729cee30402c13712d1522aef2974b

SHA1
5e24a49c70260a8cb42469dc41bb6b5f2557ec50

SHA256
70cc71ce250a4ec732a59e30adf100878e93d8f7afd4a923628314b9b0e2dc11

SHA512
16aaeabd94bec9ec836dbdf3efc4373adced6605be74641d694a5795b8c0502377de339e85d7bad058fe100a984dab97f53ac45270c325b7443f3a153c6b0178

Download Submit
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
2.0MB

MD5
72729cee30402c13712d1522aef2974b

SHA1
5e24a49c70260a8cb42469dc41bb6b5f2557ec50

SHA256
70cc71ce250a4ec732a59e30adf100878e93d8f7afd4a923628314b9b0e2dc11

SHA512
16aaeabd94bec9ec836dbdf3efc4373adced6605be74641d694a5795b8c0502377de339e85d7bad058fe100a984dab97f53ac45270c325b7443f3a153c6b0178

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\MARCH STUB.EXE
Filesize
202KB

MD5
93f8ecd07909f71d55f6cdc163395503

SHA1
5e1d71119d8911d697120fdf07c5d7c52a335028

SHA256
bc88abf915245b6eca7c80c441e7527d6a61eb78091917e0b1bc844957512d4d

SHA512
bfbb0afeb2b0cfcd039fc0016d647500ff9a2e93bdaedc80147aa86cb0ea994b56dad10ad80d126332fd9c4850a011db3a20e8a2ca6ca67365970dc4e9b89af4

Download Submit
\Users\Admin\AppData\Local\Temp\MARCH STUB.EXE
Filesize
202KB

MD5
93f8ecd07909f71d55f6cdc163395503

SHA1
5e1d71119d8911d697120fdf07c5d7c52a335028

SHA256
bc88abf915245b6eca7c80c441e7527d6a61eb78091917e0b1bc844957512d4d

SHA512
bfbb0afeb2b0cfcd039fc0016d647500ff9a2e93bdaedc80147aa86cb0ea994b56dad10ad80d126332fd9c4850a011db3a20e8a2ca6ca67365970dc4e9b89af4

Download Submit
\Users\Admin\AppData\Local\Temp\MARCH STUB.EXE
Filesize
202KB

MD5
93f8ecd07909f71d55f6cdc163395503

SHA1
5e1d71119d8911d697120fdf07c5d7c52a335028

SHA256
bc88abf915245b6eca7c80c441e7527d6a61eb78091917e0b1bc844957512d4d

SHA512
bfbb0afeb2b0cfcd039fc0016d647500ff9a2e93bdaedc80147aa86cb0ea994b56dad10ad80d126332fd9c4850a011db3a20e8a2ca6ca67365970dc4e9b89af4

Download Submit
\Users\Admin\AppData\Local\Temp\MARCH STUB.EXE
Filesize
202KB

MD5
93f8ecd07909f71d55f6cdc163395503

SHA1
5e1d71119d8911d697120fdf07c5d7c52a335028

SHA256
bc88abf915245b6eca7c80c441e7527d6a61eb78091917e0b1bc844957512d4d

SHA512
bfbb0afeb2b0cfcd039fc0016d647500ff9a2e93bdaedc80147aa86cb0ea994b56dad10ad80d126332fd9c4850a011db3a20e8a2ca6ca67365970dc4e9b89af4

Download Submit
\Users\Admin\Documents\MSDCSC\msdcsc.exe
Filesize
2.0MB

MD5
72729cee30402c13712d1522aef2974b

SHA1
5e24a49c70260a8cb42469dc41bb6b5f2557ec50

SHA256
70cc71ce250a4ec732a59e30adf100878e93d8f7afd4a923628314b9b0e2dc11

SHA512
16aaeabd94bec9ec836dbdf3efc4373adced6605be74641d694a5795b8c0502377de339e85d7bad058fe100a984dab97f53ac45270c325b7443f3a153c6b0178

Download Submit
memory/276-129-0x00000000001E0000-0x00000000003DA000-memory.dmp

Filesize
2.0MB

Download
memory/276-130-0x0000000005020000-0x0000000005060000-memory.dmp

Filesize
256KB

Download
memory/604-80-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/604-104-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/604-79-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/604-77-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/604-87-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/604-74-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/604-84-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/604-83-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/604-82-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/604-78-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/604-75-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/604-76-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/604-81-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/604-109-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/604-131-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/612-107-0x00000000025D0000-0x0000000002610000-memory.dmp

Filesize
256KB

Download
memory/612-86-0x00000000025D0000-0x0000000002610000-memory.dmp

Filesize
256KB

Download
memory/612-89-0x00000000025D0000-0x0000000002610000-memory.dmp

Filesize
256KB

Download
memory/648-105-0x00000000024A0000-0x00000000024E0000-memory.dmp

Filesize
256KB

Download
memory/648-88-0x00000000024A0000-0x00000000024E0000-memory.dmp

Filesize
256KB

Download
memory/648-85-0x00000000024A0000-0x00000000024E0000-memory.dmp

Filesize
256KB

Download
memory/808-156-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/808-162-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/808-193-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/808-191-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/808-190-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/808-160-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/808-161-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/808-166-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/808-163-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/1468-189-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/1616-122-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/1616-106-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1652-192-0x0000000000620000-0x0000000000660000-memory.dmp

Filesize
256KB

Download
memory/1712-165-0x0000000002740000-0x0000000002780000-memory.dmp

Filesize
256KB

Download
memory/1712-164-0x0000000002740000-0x0000000002780000-memory.dmp

Filesize
256KB

Download
memory/2024-72-0x0000000004830000-0x0000000004836000-memory.dmp

Filesize
24KB

Download
memory/2024-56-0x00000000009D0000-0x00000000009EA000-memory.dmp

Filesize
104KB

Download
memory/2024-55-0x00000000008A0000-0x00000000008E0000-memory.dmp

Filesize
256KB

Download
memory/2024-57-0x00000000008A0000-0x00000000008E0000-memory.dmp

Filesize
256KB

Download
memory/2024-58-0x00000000009B0000-0x00000000009BC000-memory.dmp

Filesize
48KB

Download
memory/2024-59-0x0000000005A70000-0x0000000005BCE000-memory.dmp

Filesize
1.4MB

Download
memory/2024-54-0x0000000000C20000-0x0000000000E1A000-memory.dmp

Filesize
2.0MB

Download
memory/2024-73-0x0000000005590000-0x0000000005678000-memory.dmp

Filesize
928KB

Download