Malware Analysis Report

2025-06-16 06:44

Sample ID 240120-dk91faaegk
Target latest.exe
SHA256 f993cc832ebf9603779a0d03ef696305818f27d0edf14dca665eb8571b13b98e
Tags
darkcomet guest16 evasion persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f993cc832ebf9603779a0d03ef696305818f27d0edf14dca665eb8571b13b98e

Threat Level: Known bad

The file latest.exe was found to be: Known bad.

Malicious Activity Summary

darkcomet guest16 evasion persistence rat trojan

Modifies WinLogon for persistence

Darkcomet

Darkcomet family

Sets file to hidden

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Views/modifies file attributes

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-20 03:05

Signatures

Darkcomet family

darkcomet

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-20 03:05

Reported

2024-01-20 03:07

Platform

win7-20231215-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\latest.exe"

Signatures

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" C:\Users\Admin\AppData\Local\Temp\latest.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2832 set thread context of 2108 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSystemtimePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeUndockPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeManageVolumePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2476 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\latest.exe C:\Windows\SysWOW64\cmd.exe
PID 2476 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\latest.exe C:\Windows\SysWOW64\cmd.exe
PID 2476 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\latest.exe C:\Windows\SysWOW64\cmd.exe
PID 2476 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\latest.exe C:\Windows\SysWOW64\cmd.exe
PID 2476 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\latest.exe C:\Windows\SysWOW64\cmd.exe
PID 2476 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\latest.exe C:\Windows\SysWOW64\cmd.exe
PID 2476 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\latest.exe C:\Windows\SysWOW64\cmd.exe
PID 2476 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\latest.exe C:\Windows\SysWOW64\cmd.exe
PID 1268 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1268 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1268 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1268 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2752 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2752 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2752 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2752 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2476 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\latest.exe C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
PID 2476 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\latest.exe C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
PID 2476 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\latest.exe C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
PID 2476 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\latest.exe C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
PID 2832 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2832 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2832 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2832 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2832 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2832 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2108 wrote to memory of 2608 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 2108 wrote to memory of 2608 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 2108 wrote to memory of 2608 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 2108 wrote to memory of 2608 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 2108 wrote to memory of 2608 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 2108 wrote to memory of 2608 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 2108 wrote to memory of 2608 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 2108 wrote to memory of 2608 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 2108 wrote to memory of 2608 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 2108 wrote to memory of 2608 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 2108 wrote to memory of 2608 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 2108 wrote to memory of 2608 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 2108 wrote to memory of 2608 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 2108 wrote to memory of 2608 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 2108 wrote to memory of 2608 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 2108 wrote to memory of 2608 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 2108 wrote to memory of 2608 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 2108 wrote to memory of 2608 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 2108 wrote to memory of 2608 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 2108 wrote to memory of 2608 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 2108 wrote to memory of 2608 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 2108 wrote to memory of 2608 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 2108 wrote to memory of 2608 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\latest.exe

"C:\Users\Admin\AppData\Local\Temp\latest.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\latest.exe" +s +h

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Users\Admin\AppData\Local\Temp" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Users\Admin\AppData\Local\Temp\latest.exe" +s +h

C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe

"C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

"C:\Program Files (x86)\Internet Explorer\iexplore.exe"

C:\Windows\SysWOW64\notepad.exe

notepad

Network

Country Destination Domain Proto
IN 122.176.133.66:2181 tcp
IN 122.176.133.66:2181 tcp
IN 122.176.133.66:2181 tcp
IN 122.176.133.66:2181 tcp
IN 122.176.133.66:2181 tcp
IN 122.176.133.66:2181 tcp
IN 122.176.133.66:2181 tcp
IN 122.176.133.66:2181 tcp
IN 122.176.133.66:2181 tcp
IN 122.176.133.66:2181 tcp
IN 122.176.133.66:2181 tcp
IN 122.176.133.66:2181 tcp
IN 122.176.133.66:2181 tcp

Files

memory/2476-0-0x0000000000670000-0x0000000000671000-memory.dmp

\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe

MD5 3d44f7937fb46ea4de708e90a4ca4587
SHA1 db54473365d6aa656523607286c777ce37aee53b
SHA256 f993cc832ebf9603779a0d03ef696305818f27d0edf14dca665eb8571b13b98e
SHA512 c4d686e875ad26e5debed497630d7d1e6acecf64864928375fbd09130b9761fa54e623b9d41b2d984ee4a4f5b83debb2f194a485242fdad70ecec17dbfeae2fe

memory/2832-12-0x00000000002C0000-0x00000000002C1000-memory.dmp

memory/2832-15-0x0000000000400000-0x00000000004CA000-memory.dmp

memory/2108-14-0x0000000000400000-0x00000000004CA000-memory.dmp

memory/2608-16-0x0000000000080000-0x0000000000081000-memory.dmp

memory/2608-46-0x00000000003C0000-0x00000000003C1000-memory.dmp

memory/2476-47-0x0000000000400000-0x00000000004CA000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-20 03:05

Reported

2024-01-20 03:08

Platform

win10v2004-20231215-en

Max time kernel

158s

Max time network

162s

Command Line

"C:\Users\Admin\AppData\Local\Temp\latest.exe"

Signatures

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" C:\Users\Admin\AppData\Local\Temp\latest.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\latest.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1932 set thread context of 1836 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\latest.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\latest.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSystemtimePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4408 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\latest.exe C:\Windows\SysWOW64\cmd.exe
PID 4408 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\latest.exe C:\Windows\SysWOW64\cmd.exe
PID 4408 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\latest.exe C:\Windows\SysWOW64\cmd.exe
PID 4408 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Local\Temp\latest.exe C:\Windows\SysWOW64\cmd.exe
PID 4408 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Local\Temp\latest.exe C:\Windows\SysWOW64\cmd.exe
PID 4408 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Local\Temp\latest.exe C:\Windows\SysWOW64\cmd.exe
PID 4896 wrote to memory of 1928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4896 wrote to memory of 1928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4896 wrote to memory of 1928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 3916 wrote to memory of 1152 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 3916 wrote to memory of 1152 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 3916 wrote to memory of 1152 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4408 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\latest.exe C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
PID 4408 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\latest.exe C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
PID 4408 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\latest.exe C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
PID 1932 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1932 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1932 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1932 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1932 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1836 wrote to memory of 1796 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 1836 wrote to memory of 1796 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 1836 wrote to memory of 1796 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 1836 wrote to memory of 1796 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 1836 wrote to memory of 1796 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 1836 wrote to memory of 1796 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 1836 wrote to memory of 1796 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 1836 wrote to memory of 1796 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 1836 wrote to memory of 1796 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 1836 wrote to memory of 1796 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 1836 wrote to memory of 1796 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 1836 wrote to memory of 1796 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 1836 wrote to memory of 1796 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 1836 wrote to memory of 1796 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 1836 wrote to memory of 1796 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 1836 wrote to memory of 1796 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 1836 wrote to memory of 1796 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 1836 wrote to memory of 1796 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 1836 wrote to memory of 1796 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 1836 wrote to memory of 1796 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 1836 wrote to memory of 1796 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 1836 wrote to memory of 1796 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\latest.exe

"C:\Users\Admin\AppData\Local\Temp\latest.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\latest.exe" +s +h

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Users\Admin\AppData\Local\Temp\latest.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Users\Admin\AppData\Local\Temp" +s +h

C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe

"C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

"C:\Program Files (x86)\Internet Explorer\iexplore.exe"

C:\Windows\SysWOW64\notepad.exe

notepad

Network

Country Destination Domain Proto
US 20.231.121.79:80 tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
IN 122.176.133.66:2181 tcp
US 8.8.8.8:53 66.133.176.122.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
IN 122.176.133.66:2181 tcp
IN 122.176.133.66:2181 tcp
IN 122.176.133.66:2181 tcp
IN 122.176.133.66:2181 tcp
IN 122.176.133.66:2181 tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
IN 122.176.133.66:2181 tcp
IN 122.176.133.66:2181 tcp
IN 122.176.133.66:2181 tcp
IN 122.176.133.66:2181 tcp
US 8.8.8.8:53 66.112.168.52.in-addr.arpa udp
IN 122.176.133.66:2181 tcp
IN 122.176.133.66:2181 tcp

Files

memory/4408-0-0x00000000022A0000-0x00000000022A1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe

MD5 3d44f7937fb46ea4de708e90a4ca4587
SHA1 db54473365d6aa656523607286c777ce37aee53b
SHA256 f993cc832ebf9603779a0d03ef696305818f27d0edf14dca665eb8571b13b98e
SHA512 c4d686e875ad26e5debed497630d7d1e6acecf64864928375fbd09130b9761fa54e623b9d41b2d984ee4a4f5b83debb2f194a485242fdad70ecec17dbfeae2fe

memory/4408-52-0x0000000000400000-0x00000000004CA000-memory.dmp

memory/1932-63-0x0000000002180000-0x0000000002181000-memory.dmp

memory/1836-64-0x0000000000400000-0x00000000004CA000-memory.dmp

memory/1932-65-0x0000000000400000-0x00000000004CA000-memory.dmp

memory/1796-66-0x0000000000AE0000-0x0000000000AE1000-memory.dmp