darkcomet | 933aba01ef4f1c57b7f6b82a59dcdada8f8689eb711e5a6c165f6b3d6ee3aa68

General

Target

easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Size

1.4MB
MD5

49f3321b14dd9dcb9108b1c6d139bc7b
SHA1

35876b7c9ff2a3c609792c9d49a9641dc181bfec
SHA256

933aba01ef4f1c57b7f6b82a59dcdada8f8689eb711e5a6c165f6b3d6ee3aa68
SHA512

f922d959e0f6e746a4c360ccd406784d5fe5115f16b5cb14256e5557440d5636709d1a2bbc88127cf604c100207558028a08a0ff8ccb0cac42452d195c044abb
SSDEEP

24576:nZ1xuVVjfFoynPaVBUR8f+kN10EBbZ1xuVVjfFoynPaVBUR8f+kN10EBsgugEnoI:ZQDgok302QDgok30hgEnoSE5I

Score

10^/10

darkcomet sazan evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Sazan

C2

ratcidavut.duckdns.org:1604

Mutex

DC_MUTEX-EGAAD3Q

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
QmqknQ6ovQPD
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

msdcsc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	msdcsc.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

msdcsc.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" msdcsc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	msdcsc.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe

Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

4416 attrib.exe
396 attrib.exe

pid	process
4416	attrib.exe
396	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe

Executes dropped EXE 2 IoCs

Processes:

DAVUTHITTER V2.987.EXEmsdcsc.exe

pid process

3716 DAVUTHITTER V2.987.EXE
2724 msdcsc.exe

pid	process
3716	DAVUTHITTER V2.987.EXE
2724	msdcsc.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msdcsc.exeeasy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe"	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe

Drops file in System32 directory 3 IoCs

Processes:

easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe

description	ioc	process
File created	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\msdcsc.exe	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
File opened for modification	C:\Windows\SysWOW64\MSDCSC\	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msdcsc.exe

pid process

2724 msdcsc.exe

pid	process
2724	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exeDAVUTHITTER V2.987.EXEmsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeSecurityPrivilege	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeTakeOwnershipPrivilege	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeLoadDriverPrivilege	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeSystemProfilePrivilege	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeSystemtimePrivilege	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeProfSingleProcessPrivilege	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeIncBasePriorityPrivilege	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeCreatePagefilePrivilege	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeBackupPrivilege	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeRestorePrivilege	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeShutdownPrivilege	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeDebugPrivilege	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeSystemEnvironmentPrivilege	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeChangeNotifyPrivilege	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeRemoteShutdownPrivilege	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeUndockPrivilege	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeManageVolumePrivilege	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeImpersonatePrivilege	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeCreateGlobalPrivilege	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: 33	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: 34	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: 35	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: 36	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
Token: SeIncreaseQuotaPrivilege	3716	DAVUTHITTER V2.987.EXE
Token: SeSecurityPrivilege	3716	DAVUTHITTER V2.987.EXE
Token: SeTakeOwnershipPrivilege	3716	DAVUTHITTER V2.987.EXE
Token: SeLoadDriverPrivilege	3716	DAVUTHITTER V2.987.EXE
Token: SeSystemProfilePrivilege	3716	DAVUTHITTER V2.987.EXE
Token: SeSystemtimePrivilege	3716	DAVUTHITTER V2.987.EXE
Token: SeProfSingleProcessPrivilege	3716	DAVUTHITTER V2.987.EXE
Token: SeIncBasePriorityPrivilege	3716	DAVUTHITTER V2.987.EXE
Token: SeCreatePagefilePrivilege	3716	DAVUTHITTER V2.987.EXE
Token: SeBackupPrivilege	3716	DAVUTHITTER V2.987.EXE
Token: SeRestorePrivilege	3716	DAVUTHITTER V2.987.EXE
Token: SeShutdownPrivilege	3716	DAVUTHITTER V2.987.EXE
Token: SeDebugPrivilege	3716	DAVUTHITTER V2.987.EXE
Token: SeSystemEnvironmentPrivilege	3716	DAVUTHITTER V2.987.EXE
Token: SeChangeNotifyPrivilege	3716	DAVUTHITTER V2.987.EXE
Token: SeRemoteShutdownPrivilege	3716	DAVUTHITTER V2.987.EXE
Token: SeUndockPrivilege	3716	DAVUTHITTER V2.987.EXE
Token: SeManageVolumePrivilege	3716	DAVUTHITTER V2.987.EXE
Token: SeImpersonatePrivilege	3716	DAVUTHITTER V2.987.EXE
Token: SeCreateGlobalPrivilege	3716	DAVUTHITTER V2.987.EXE
Token: 33	3716	DAVUTHITTER V2.987.EXE
Token: 34	3716	DAVUTHITTER V2.987.EXE
Token: 35	3716	DAVUTHITTER V2.987.EXE
Token: 36	3716	DAVUTHITTER V2.987.EXE
Token: SeIncreaseQuotaPrivilege	2724	msdcsc.exe
Token: SeSecurityPrivilege	2724	msdcsc.exe
Token: SeTakeOwnershipPrivilege	2724	msdcsc.exe
Token: SeLoadDriverPrivilege	2724	msdcsc.exe
Token: SeSystemProfilePrivilege	2724	msdcsc.exe
Token: SeSystemtimePrivilege	2724	msdcsc.exe
Token: SeProfSingleProcessPrivilege	2724	msdcsc.exe
Token: SeIncBasePriorityPrivilege	2724	msdcsc.exe
Token: SeCreatePagefilePrivilege	2724	msdcsc.exe
Token: SeBackupPrivilege	2724	msdcsc.exe
Token: SeRestorePrivilege	2724	msdcsc.exe
Token: SeShutdownPrivilege	2724	msdcsc.exe
Token: SeDebugPrivilege	2724	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	2724	msdcsc.exe
Token: SeChangeNotifyPrivilege	2724	msdcsc.exe
Token: SeRemoteShutdownPrivilege	2724	msdcsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msdcsc.exe

pid process

2724 msdcsc.exe

pid	process
2724	msdcsc.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.execmd.execmd.exemsdcsc.exe

description	pid	process	target process
PID 1492 wrote to memory of 4240	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe	cmd.exe
PID 1492 wrote to memory of 4240	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe	cmd.exe
PID 1492 wrote to memory of 4240	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe	cmd.exe
PID 1492 wrote to memory of 1532	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe	cmd.exe
PID 1492 wrote to memory of 1532	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe	cmd.exe
PID 1492 wrote to memory of 1532	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe	cmd.exe
PID 1492 wrote to memory of 3716	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe	DAVUTHITTER V2.987.EXE
PID 1492 wrote to memory of 3716	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe	DAVUTHITTER V2.987.EXE
PID 1492 wrote to memory of 3716	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe	DAVUTHITTER V2.987.EXE
PID 4240 wrote to memory of 4416	4240	cmd.exe	attrib.exe
PID 4240 wrote to memory of 4416	4240	cmd.exe	attrib.exe
PID 4240 wrote to memory of 4416	4240	cmd.exe	attrib.exe
PID 1532 wrote to memory of 396	1532	cmd.exe	attrib.exe
PID 1532 wrote to memory of 396	1532	cmd.exe	attrib.exe
PID 1532 wrote to memory of 396	1532	cmd.exe	attrib.exe
PID 1492 wrote to memory of 2724	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe	msdcsc.exe
PID 1492 wrote to memory of 2724	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe	msdcsc.exe
PID 1492 wrote to memory of 2724	1492	easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe	msdcsc.exe
PID 2724 wrote to memory of 2460	2724	msdcsc.exe	notepad.exe
PID 2724 wrote to memory of 2460	2724	msdcsc.exe	notepad.exe
PID 2724 wrote to memory of 2460	2724	msdcsc.exe	notepad.exe
PID 2724 wrote to memory of 2460	2724	msdcsc.exe	notepad.exe
PID 2724 wrote to memory of 2460	2724	msdcsc.exe	notepad.exe
PID 2724 wrote to memory of 2460	2724	msdcsc.exe	notepad.exe
PID 2724 wrote to memory of 2460	2724	msdcsc.exe	notepad.exe
PID 2724 wrote to memory of 2460	2724	msdcsc.exe	notepad.exe
PID 2724 wrote to memory of 2460	2724	msdcsc.exe	notepad.exe
PID 2724 wrote to memory of 2460	2724	msdcsc.exe	notepad.exe
PID 2724 wrote to memory of 2460	2724	msdcsc.exe	notepad.exe
PID 2724 wrote to memory of 2460	2724	msdcsc.exe	notepad.exe
PID 2724 wrote to memory of 2460	2724	msdcsc.exe	notepad.exe
PID 2724 wrote to memory of 2460	2724	msdcsc.exe	notepad.exe
PID 2724 wrote to memory of 2460	2724	msdcsc.exe	notepad.exe
PID 2724 wrote to memory of 2460	2724	msdcsc.exe	notepad.exe
PID 2724 wrote to memory of 2460	2724	msdcsc.exe	notepad.exe
PID 2724 wrote to memory of 2460	2724	msdcsc.exe	notepad.exe
PID 2724 wrote to memory of 2460	2724	msdcsc.exe	notepad.exe
PID 2724 wrote to memory of 2460	2724	msdcsc.exe	notepad.exe
PID 2724 wrote to memory of 2460	2724	msdcsc.exe	notepad.exe
PID 2724 wrote to memory of 2460	2724	msdcsc.exe	notepad.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

msdcsc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	msdcsc.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

396 attrib.exe
4416 attrib.exe

pid	process
396	attrib.exe
4416	attrib.exe

C:\Users\Admin\AppData\Local\Temp\easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe
"C:\Users\Admin\AppData\Local\Temp\easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe" +s +h
2⤵
- Suspicious use of WriteProcessMemory
PID:4240

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\easy_Malicious_2da05edc14df9557fc474515f29ca7f4a5c2fcb2de085c443ab37cace93194cf.exe" +s +h
3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4416

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
2⤵
- Suspicious use of WriteProcessMemory
PID:1532

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:396

C:\Users\Admin\AppData\Local\Temp\DAVUTHITTER V2.987.EXE
"C:\Users\Admin\AppData\Local\Temp\DAVUTHITTER V2.987.EXE"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3716

C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
"C:\Windows\system32\MSDCSC\msdcsc.exe"
2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2724

C:\Windows\SysWOW64\notepad.exe
notepad
3⤵
PID:2460

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Modify Existing Service

2

T1031

Hidden Files and Directories

2

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

7

T1112

Disabling Security Tools

2

T1089

Hidden Files and Directories

2

T1158

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DAVUTHITTER V2.987.EXE
Filesize
657KB

MD5
34960f869aa933675a70c0c7c17addfe

SHA1
b01ec370b3571d70a2d111f35d5514cc7a18d422

SHA256
9343339fadfe0f62d6fd46c6131ed9fdf01978d817192984e69a8bbecfb406d2

SHA512
5993de154bc0f5db448a243a3d0ec7929e968823b24ae256226e2d8e82f1d50d62977e5a21a2b775cd422416d8656ed0dec103b850a58633b12bec074a4f58d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\DAVUTHITTER V2.987.EXE
Filesize
657KB

MD5
34960f869aa933675a70c0c7c17addfe

SHA1
b01ec370b3571d70a2d111f35d5514cc7a18d422

SHA256
9343339fadfe0f62d6fd46c6131ed9fdf01978d817192984e69a8bbecfb406d2

SHA512
5993de154bc0f5db448a243a3d0ec7929e968823b24ae256226e2d8e82f1d50d62977e5a21a2b775cd422416d8656ed0dec103b850a58633b12bec074a4f58d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\DAVUTHITTER V2.987.EXE
Filesize
657KB

MD5
34960f869aa933675a70c0c7c17addfe

SHA1
b01ec370b3571d70a2d111f35d5514cc7a18d422

SHA256
9343339fadfe0f62d6fd46c6131ed9fdf01978d817192984e69a8bbecfb406d2

SHA512
5993de154bc0f5db448a243a3d0ec7929e968823b24ae256226e2d8e82f1d50d62977e5a21a2b775cd422416d8656ed0dec103b850a58633b12bec074a4f58d5

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
1.4MB

MD5
49f3321b14dd9dcb9108b1c6d139bc7b

SHA1
35876b7c9ff2a3c609792c9d49a9641dc181bfec

SHA256
933aba01ef4f1c57b7f6b82a59dcdada8f8689eb711e5a6c165f6b3d6ee3aa68

SHA512
f922d959e0f6e746a4c360ccd406784d5fe5115f16b5cb14256e5557440d5636709d1a2bbc88127cf604c100207558028a08a0ff8ccb0cac42452d195c044abb

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
1.4MB

MD5
49f3321b14dd9dcb9108b1c6d139bc7b

SHA1
35876b7c9ff2a3c609792c9d49a9641dc181bfec

SHA256
933aba01ef4f1c57b7f6b82a59dcdada8f8689eb711e5a6c165f6b3d6ee3aa68

SHA512
f922d959e0f6e746a4c360ccd406784d5fe5115f16b5cb14256e5557440d5636709d1a2bbc88127cf604c100207558028a08a0ff8ccb0cac42452d195c044abb

Download Submit
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
Filesize
1.4MB

MD5
49f3321b14dd9dcb9108b1c6d139bc7b

SHA1
35876b7c9ff2a3c609792c9d49a9641dc181bfec

SHA256
933aba01ef4f1c57b7f6b82a59dcdada8f8689eb711e5a6c165f6b3d6ee3aa68

SHA512
f922d959e0f6e746a4c360ccd406784d5fe5115f16b5cb14256e5557440d5636709d1a2bbc88127cf604c100207558028a08a0ff8ccb0cac42452d195c044abb

Download Submit
memory/1492-137-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/1492-208-0x0000000000400000-0x0000000000567000-memory.dmp

Filesize
1.4MB

Download
memory/2460-206-0x0000000000F30000-0x0000000000F31000-memory.dmp

Filesize
4KB

Download
memory/2724-207-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/2724-210-0x0000000000400000-0x0000000000567000-memory.dmp

Filesize
1.4MB

Download
memory/2724-214-0x0000000000400000-0x0000000000567000-memory.dmp

Filesize
1.4MB

Download
memory/3716-195-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/3716-209-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads