Malware Analysis Report

2025-06-16 06:44

Sample ID 240120-ntewrshed3
Target 6a55e570c9897d5bcdb2da37c4d20e0b
SHA256 3064890364e23210d8fa53391c004a4ad7a97d35bb20de13f12727b0a7398628
Tags
darkcomet evasion persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3064890364e23210d8fa53391c004a4ad7a97d35bb20de13f12727b0a7398628

Threat Level: Known bad

The file 6a55e570c9897d5bcdb2da37c4d20e0b was found to be: Known bad.

Malicious Activity Summary

darkcomet evasion persistence rat trojan

Darkcomet

Windows security bypass

Modifies WinLogon for persistence

Modifies security service

Darkcomet family

Sets file to hidden

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Windows security modification

Adds Run key to start application

Unsigned PE

Enumerates physical storage devices

Modifies registry class

Suspicious use of WriteProcessMemory

System policy modification

Suspicious use of AdjustPrivilegeToken

Runs ping.exe

Suspicious use of SetWindowsHookEx

Views/modifies file attributes

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-20 11:41

Signatures

Darkcomet family

darkcomet

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-20 11:41

Reported

2024-01-20 11:43

Platform

win10v2004-20231215-en

Max time kernel

22s

Max time network

164s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe"

Signatures

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" C:\Windupdt\winupdate.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windupdt\winupdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windupdt\winupdate.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windupdt\winupdate.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windupdt\winupdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windupdt\winupdate.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeSecurityPrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeBackupPrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeRestorePrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeShutdownPrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeDebugPrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeUndockPrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: 33 N/A C:\Windupdt\winupdate.exe N/A
Token: 34 N/A C:\Windupdt\winupdate.exe N/A
Token: 35 N/A C:\Windupdt\winupdate.exe N/A
Token: 36 N/A C:\Windupdt\winupdate.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windupdt\winupdate.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4540 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windows\SysWOW64\cmd.exe
PID 4540 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windows\SysWOW64\cmd.exe
PID 4540 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windows\SysWOW64\cmd.exe
PID 4540 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windows\SysWOW64\cmd.exe
PID 4540 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windows\SysWOW64\cmd.exe
PID 4540 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windows\SysWOW64\cmd.exe
PID 3620 wrote to memory of 5100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 3620 wrote to memory of 5100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 3620 wrote to memory of 5100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 3692 wrote to memory of 1332 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 3692 wrote to memory of 1332 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 3692 wrote to memory of 1332 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4540 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windupdt\winupdate.exe
PID 4540 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windupdt\winupdate.exe
PID 4540 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windupdt\winupdate.exe
PID 4540 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windows\SysWOW64\cmd.exe
PID 4540 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windows\SysWOW64\cmd.exe
PID 4540 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windows\SysWOW64\cmd.exe
PID 1860 wrote to memory of 2676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1860 wrote to memory of 2676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1860 wrote to memory of 2676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion C:\Windupdt\winupdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern C:\Windupdt\winupdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" C:\Windupdt\winupdate.exe N/A

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe

"C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Users\Admin\AppData\Local\Temp" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe" +s +h

C:\Windupdt\winupdate.exe

"C:\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 5

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe"

Network

Country Destination Domain Proto
US 20.231.121.79:80 tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 kabhks.no-ip.org udp
US 8.8.8.8:53 kabhks.no-ip.org udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 kabhks.no-ip.org udp
US 8.8.8.8:53 kabhks.no-ip.org udp
US 8.8.8.8:53 kabhks.no-ip.org udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 kabhks.no-ip.org udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 kabhks.no-ip.org udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 kabhks.no-ip.org udp
US 8.8.8.8:53 kabhks.no-ip.org udp
US 8.8.8.8:53 kabhks.no-ip.org udp
US 8.8.8.8:53 kabhks.no-ip.org udp
US 8.8.8.8:53 kabhks.no-ip.org udp
US 8.8.8.8:53 kabhks.no-ip.org udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 kabhks.no-ip.org udp
US 8.8.8.8:53 kabhks.no-ip.org udp
US 8.8.8.8:53 kabhks.no-ip.org udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 kabhks.no-ip.org udp
US 8.8.8.8:53 kabhks.no-ip.org udp
US 8.8.8.8:53 kabhks.no-ip.org udp
US 8.8.8.8:53 kabhks.no-ip.org udp
US 8.8.8.8:53 kabhks.no-ip.org udp
US 8.8.8.8:53 kabhks.no-ip.org udp
US 8.8.8.8:53 kabhks.no-ip.org udp
US 8.8.8.8:53 kabhks.no-ip.org udp
US 8.8.8.8:53 kabhks.no-ip.org udp
US 8.8.8.8:53 kabhks.no-ip.org udp
US 8.8.8.8:53 kabhks.no-ip.org udp
US 8.8.8.8:53 15.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 kabhks.no-ip.org udp
US 8.8.8.8:53 kabhks.no-ip.org udp
US 8.8.8.8:53 kabhks.no-ip.org udp

Files

memory/4540-0-0x00000000022A0000-0x00000000022A1000-memory.dmp

C:\Windupdt\winupdate.exe

MD5 1c8a0fd90dedb1ab5342ed2084ac161a
SHA1 847f16daa4def68f7b872188bf65b7d713c2b72d
SHA256 643d4b35db818a64260e5167d5cafebb5217320fb07b54618088a46930762031
SHA512 8bdbc74f10d35f9f13c8c42340f172a3696105dcceb797c399ea97108f442c823760375ae0d4a7291b20160306878cf356fa91dc29e968e77eb45378ed1e8761

memory/2536-35-0x0000000002710000-0x0000000002711000-memory.dmp

memory/4540-34-0x0000000000400000-0x00000000004B4000-memory.dmp

C:\Windupdt\winupdate.exe

MD5 0c4112280c62a793909828d06acf32d2
SHA1 eb9540bad25b6e8d1577fea84a15526ad2a44bf6
SHA256 8c13d9f495cff0cc9bb4a46f96479db3d69c2e895a311028f106e51a8b95d53e
SHA512 8b967a900296714bfeea8e737cbca368f7e8a849f25bf6e4f0cd6c59faab85bab47b451667946148916f0d57527c83d1b375161040404d7feb3d051ace735059

C:\Windupdt\winupdate.exe

MD5 4096999cdf78123c8099e51f5d668fb8
SHA1 910f2fa6caa58000ae2f9687ddb91a2d5ac164e6
SHA256 4e6e178dc4cc7880c466beb4d09396d8bec815fb92202f0a5744d12c54462223
SHA512 cfc0e79d3b50e340f0850fc72e30f35c3ee3c6eec7e23eacbd1ae532c3bdedbba45875a05ca7710cacbe39b52fc85dcf4fe26ea41397167179e6e7e678a62bb5

memory/2536-36-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/2536-37-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/2536-38-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/2536-39-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/2536-40-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/2536-41-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/2536-42-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/2536-43-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/2536-44-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/2536-45-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/2536-46-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/2536-47-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/2536-48-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/2536-49-0x0000000000400000-0x00000000004B4000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-20 11:41

Reported

2024-01-20 11:43

Platform

win7-20231215-en

Max time kernel

13s

Max time network

19s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe"

Signatures

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" C:\Windupdt\winupdate.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windupdt\winupdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windupdt\winupdate.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windupdt\winupdate.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windupdt\winupdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windupdt\winupdate.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A

Enumerates physical storage devices

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeSecurityPrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeBackupPrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeRestorePrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeShutdownPrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeDebugPrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeUndockPrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windupdt\winupdate.exe N/A
Token: 33 N/A C:\Windupdt\winupdate.exe N/A
Token: 34 N/A C:\Windupdt\winupdate.exe N/A
Token: 35 N/A C:\Windupdt\winupdate.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windupdt\winupdate.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1648 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windows\SysWOW64\cmd.exe
PID 1648 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windows\SysWOW64\cmd.exe
PID 1648 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windows\SysWOW64\cmd.exe
PID 1648 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windows\SysWOW64\cmd.exe
PID 1648 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windows\SysWOW64\cmd.exe
PID 1648 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windows\SysWOW64\cmd.exe
PID 1648 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windows\SysWOW64\cmd.exe
PID 1648 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windows\SysWOW64\cmd.exe
PID 1996 wrote to memory of 2784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1996 wrote to memory of 2784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1996 wrote to memory of 2784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1996 wrote to memory of 2784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2680 wrote to memory of 2788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2680 wrote to memory of 2788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2680 wrote to memory of 2788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2680 wrote to memory of 2788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1648 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windupdt\winupdate.exe
PID 1648 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windupdt\winupdate.exe
PID 1648 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windupdt\winupdate.exe
PID 1648 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windupdt\winupdate.exe
PID 1648 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windupdt\winupdate.exe
PID 1648 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windupdt\winupdate.exe
PID 1648 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windupdt\winupdate.exe
PID 1648 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windows\SysWOW64\cmd.exe
PID 1648 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windows\SysWOW64\cmd.exe
PID 1648 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windows\SysWOW64\cmd.exe
PID 1648 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe C:\Windows\SysWOW64\cmd.exe
PID 2800 wrote to memory of 2568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2800 wrote to memory of 2568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2800 wrote to memory of 2568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2800 wrote to memory of 2568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion C:\Windupdt\winupdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern C:\Windupdt\winupdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" C:\Windupdt\winupdate.exe N/A

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe

"C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe" +s +h

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Users\Admin\AppData\Local\Temp" +s +h

C:\Windupdt\winupdate.exe

"C:\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 5

Network

Country Destination Domain Proto
US 8.8.8.8:53 kabhks.no-ip.org udp

Files

memory/1648-0-0x00000000002C0000-0x00000000002C1000-memory.dmp

\Windupdt\winupdate.exe

MD5 6a55e570c9897d5bcdb2da37c4d20e0b
SHA1 2742f1c6b4881aa16f02910ec46ea77de4b194da
SHA256 3064890364e23210d8fa53391c004a4ad7a97d35bb20de13f12727b0a7398628
SHA512 52b9952288476b32918fca301465f24007dc29f1818227399d7df7e78ea8d61ae0ffb02f661f8275a735ce033a099b640283fb07599013c7b76422a13a21a0be

memory/1648-9-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/2852-13-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/2852-14-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/2852-15-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/2852-16-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/2852-17-0x0000000000400000-0x00000000004B4000-memory.dmp