darkcomet | 0e8336ed51fe4551ced7d9aa5ce2dde945df8a0cc4e7c60199c24dd1cf7ccd48

Analysis

max time kernel
24s
max time network
26s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/02/2024, 13:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Blackkomet.exe
Size

756KB
MD5

c7dcd585b7e8b046f209052bcd6dd84b
SHA1

604dcfae9eed4f65c80a4a39454db409291e08fa
SHA256

0e8336ed51fe4551ced7d9aa5ce2dde945df8a0cc4e7c60199c24dd1cf7ccd48
SHA512

c5ba102b12d2c685312d7dc8d58d98891b73243f56a8491ea7c41c2edaaad44ad90b8bc0748dbd8c84e92e9ae9bbd0b0157265ebe35fb9b63668c57d0e1ed5f2
SSDEEP

12288:XOANXryu1S69QwWBIlVi4o858nFBKgmvtOwUATgDQ3:eANOCS6qwWB0V5o8mnqvtrdgDQ3

Score

10^/10

darkcomet evasion persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	attrib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	Blackkomet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe

Sets file to hidden 1 TTPs 46 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
3684	attrib.exe
4976	attrib.exe
3556	attrib.exe
1904	attrib.exe
552	attrib.exe
4648	attrib.exe
3928	attrib.exe
2964	attrib.exe
312	attrib.exe
1992	attrib.exe
4752	attrib.exe
456	attrib.exe
3000	attrib.exe
4844	attrib.exe
2732	attrib.exe
4844	attrib.exe
2980	attrib.exe
3204	attrib.exe
2948	attrib.exe
4888	attrib.exe
1612	attrib.exe
3480	attrib.exe
4240	attrib.exe
1352	attrib.exe
472	attrib.exe
3828	attrib.exe
2772	attrib.exe
1944	attrib.exe
5004	attrib.exe
2568	attrib.exe
768	attrib.exe
3480	attrib.exe
1420	attrib.exe
1744	attrib.exe
3292	attrib.exe
5108	attrib.exe
1148	attrib.exe
1316	attrib.exe
4652	attrib.exe
4420	attrib.exe
4712	attrib.exe
3648	attrib.exe
1784	attrib.exe
3076	attrib.exe
3680	attrib.exe
2732	attrib.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Blackkomet.exe

Deletes itself 1 IoCs

pid	Process
4772	notepad.exe

Executes dropped EXE 7 IoCs

pid	Process
1612	winupdate.exe
2652	winupdate.exe
2340	winupdate.exe
1808	winupdate.exe
2772	winupdate.exe
1992	attrib.exe
4600	winupdate.exe

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	attrib.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	Blackkomet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe

Drops file in System32 directory 46 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	Blackkomet.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	Blackkomet.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	Blackkomet.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	attrib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Blackkomet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4848	Blackkomet.exe
Token: SeSecurityPrivilege	4848	Blackkomet.exe
Token: SeTakeOwnershipPrivilege	4848	Blackkomet.exe
Token: SeLoadDriverPrivilege	4848	Blackkomet.exe
Token: SeSystemProfilePrivilege	4848	Blackkomet.exe
Token: SeSystemtimePrivilege	4848	Blackkomet.exe
Token: SeProfSingleProcessPrivilege	4848	Blackkomet.exe
Token: SeIncBasePriorityPrivilege	4848	Blackkomet.exe
Token: SeCreatePagefilePrivilege	4848	Blackkomet.exe
Token: SeBackupPrivilege	4848	Blackkomet.exe
Token: SeRestorePrivilege	4848	Blackkomet.exe
Token: SeShutdownPrivilege	4848	Blackkomet.exe
Token: SeDebugPrivilege	4848	Blackkomet.exe
Token: SeSystemEnvironmentPrivilege	4848	Blackkomet.exe
Token: SeChangeNotifyPrivilege	4848	Blackkomet.exe
Token: SeRemoteShutdownPrivilege	4848	Blackkomet.exe
Token: SeUndockPrivilege	4848	Blackkomet.exe
Token: SeManageVolumePrivilege	4848	Blackkomet.exe
Token: SeImpersonatePrivilege	4848	Blackkomet.exe
Token: SeCreateGlobalPrivilege	4848	Blackkomet.exe
Token: 33	4848	Blackkomet.exe
Token: 34	4848	Blackkomet.exe
Token: 35	4848	Blackkomet.exe
Token: 36	4848	Blackkomet.exe
Token: SeIncreaseQuotaPrivilege	1612	winupdate.exe
Token: SeSecurityPrivilege	1612	winupdate.exe
Token: SeTakeOwnershipPrivilege	1612	winupdate.exe
Token: SeLoadDriverPrivilege	1612	winupdate.exe
Token: SeSystemProfilePrivilege	1612	winupdate.exe
Token: SeSystemtimePrivilege	1612	winupdate.exe
Token: SeProfSingleProcessPrivilege	1612	winupdate.exe
Token: SeIncBasePriorityPrivilege	1612	winupdate.exe
Token: SeCreatePagefilePrivilege	1612	winupdate.exe
Token: SeBackupPrivilege	1612	winupdate.exe
Token: SeRestorePrivilege	1612	winupdate.exe
Token: SeShutdownPrivilege	1612	winupdate.exe
Token: SeDebugPrivilege	1612	winupdate.exe
Token: SeSystemEnvironmentPrivilege	1612	winupdate.exe
Token: SeChangeNotifyPrivilege	1612	winupdate.exe
Token: SeRemoteShutdownPrivilege	1612	winupdate.exe
Token: SeUndockPrivilege	1612	winupdate.exe
Token: SeManageVolumePrivilege	1612	winupdate.exe
Token: SeImpersonatePrivilege	1612	winupdate.exe
Token: SeCreateGlobalPrivilege	1612	winupdate.exe
Token: 33	1612	winupdate.exe
Token: 34	1612	winupdate.exe
Token: 35	1612	winupdate.exe
Token: 36	1612	winupdate.exe
Token: SeIncreaseQuotaPrivilege	2652	winupdate.exe
Token: SeSecurityPrivilege	2652	winupdate.exe
Token: SeTakeOwnershipPrivilege	2652	winupdate.exe
Token: SeLoadDriverPrivilege	2652	winupdate.exe
Token: SeSystemProfilePrivilege	2652	winupdate.exe
Token: SeSystemtimePrivilege	2652	winupdate.exe
Token: SeProfSingleProcessPrivilege	2652	winupdate.exe
Token: SeIncBasePriorityPrivilege	2652	winupdate.exe
Token: SeCreatePagefilePrivilege	2652	winupdate.exe
Token: SeBackupPrivilege	2652	winupdate.exe
Token: SeRestorePrivilege	2652	winupdate.exe
Token: SeShutdownPrivilege	2652	winupdate.exe
Token: SeDebugPrivilege	2652	winupdate.exe
Token: SeSystemEnvironmentPrivilege	2652	winupdate.exe
Token: SeChangeNotifyPrivilege	2652	winupdate.exe
Token: SeRemoteShutdownPrivilege	2652	winupdate.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 3296	4848	Blackkomet.exe	84
PID 4848 wrote to memory of 3296	4848	Blackkomet.exe	84
PID 4848 wrote to memory of 3296	4848	Blackkomet.exe	84
PID 4848 wrote to memory of 3296	4848	Blackkomet.exe	84
PID 4848 wrote to memory of 3296	4848	Blackkomet.exe	84
PID 4848 wrote to memory of 3296	4848	Blackkomet.exe	84
PID 4848 wrote to memory of 3296	4848	Blackkomet.exe	84
PID 4848 wrote to memory of 3296	4848	Blackkomet.exe	84
PID 4848 wrote to memory of 3296	4848	Blackkomet.exe	84
PID 4848 wrote to memory of 3296	4848	Blackkomet.exe	84
PID 4848 wrote to memory of 3296	4848	Blackkomet.exe	84
PID 4848 wrote to memory of 3296	4848	Blackkomet.exe	84
PID 4848 wrote to memory of 3296	4848	Blackkomet.exe	84
PID 4848 wrote to memory of 3296	4848	Blackkomet.exe	84
PID 4848 wrote to memory of 3296	4848	Blackkomet.exe	84
PID 4848 wrote to memory of 3296	4848	Blackkomet.exe	84
PID 4848 wrote to memory of 3296	4848	Blackkomet.exe	84
PID 4848 wrote to memory of 3296	4848	Blackkomet.exe	84
PID 4848 wrote to memory of 3296	4848	Blackkomet.exe	84
PID 4848 wrote to memory of 3296	4848	Blackkomet.exe	84
PID 4848 wrote to memory of 3296	4848	Blackkomet.exe	84
PID 4848 wrote to memory of 3296	4848	Blackkomet.exe	84
PID 4848 wrote to memory of 3296	4848	Blackkomet.exe	84
PID 4848 wrote to memory of 5108	4848	Blackkomet.exe	85
PID 4848 wrote to memory of 5108	4848	Blackkomet.exe	85
PID 4848 wrote to memory of 5108	4848	Blackkomet.exe	85
PID 4848 wrote to memory of 1148	4848	Blackkomet.exe	86
PID 4848 wrote to memory of 1148	4848	Blackkomet.exe	86
PID 4848 wrote to memory of 1148	4848	Blackkomet.exe	86
PID 4848 wrote to memory of 1612	4848	Blackkomet.exe	89
PID 4848 wrote to memory of 1612	4848	Blackkomet.exe	89
PID 4848 wrote to memory of 1612	4848	Blackkomet.exe	89
PID 4848 wrote to memory of 4772	4848	Blackkomet.exe	90
PID 4848 wrote to memory of 4772	4848	Blackkomet.exe	90
PID 4848 wrote to memory of 4772	4848	Blackkomet.exe	90
PID 4848 wrote to memory of 4772	4848	Blackkomet.exe	90
PID 4848 wrote to memory of 4772	4848	Blackkomet.exe	90
PID 4848 wrote to memory of 4772	4848	Blackkomet.exe	90
PID 4848 wrote to memory of 4772	4848	Blackkomet.exe	90
PID 4848 wrote to memory of 4772	4848	Blackkomet.exe	90
PID 4848 wrote to memory of 4772	4848	Blackkomet.exe	90
PID 4848 wrote to memory of 4772	4848	Blackkomet.exe	90
PID 4848 wrote to memory of 4772	4848	Blackkomet.exe	90
PID 4848 wrote to memory of 4772	4848	Blackkomet.exe	90
PID 4848 wrote to memory of 4772	4848	Blackkomet.exe	90
PID 4848 wrote to memory of 4772	4848	Blackkomet.exe	90
PID 4848 wrote to memory of 4772	4848	Blackkomet.exe	90
PID 4848 wrote to memory of 4772	4848	Blackkomet.exe	90
PID 4848 wrote to memory of 4772	4848	Blackkomet.exe	90
PID 1612 wrote to memory of 3528	1612	winupdate.exe	91
PID 1612 wrote to memory of 3528	1612	winupdate.exe	91
PID 1612 wrote to memory of 3528	1612	winupdate.exe	91
PID 1612 wrote to memory of 3528	1612	winupdate.exe	91
PID 1612 wrote to memory of 3528	1612	winupdate.exe	91
PID 1612 wrote to memory of 3528	1612	winupdate.exe	91
PID 1612 wrote to memory of 3528	1612	winupdate.exe	91
PID 1612 wrote to memory of 3528	1612	winupdate.exe	91
PID 1612 wrote to memory of 3528	1612	winupdate.exe	91
PID 1612 wrote to memory of 3528	1612	winupdate.exe	91
PID 1612 wrote to memory of 3528	1612	winupdate.exe	91
PID 1612 wrote to memory of 3528	1612	winupdate.exe	91
PID 1612 wrote to memory of 3528	1612	winupdate.exe	91
PID 1612 wrote to memory of 3528	1612	winupdate.exe	91
PID 1612 wrote to memory of 3528	1612	winupdate.exe	91

Views/modifies file attributes 1 TTPs 46 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3204	attrib.exe
4420	attrib.exe
5108	attrib.exe
3556	attrib.exe
1784	attrib.exe
2732	attrib.exe
2732	attrib.exe
1744	attrib.exe
4844	attrib.exe
4976	attrib.exe
3480	attrib.exe
1992	attrib.exe
4888	attrib.exe
1612	attrib.exe
472	attrib.exe
1944	attrib.exe
1148	attrib.exe
312	attrib.exe
2568	attrib.exe
552	attrib.exe
3000	attrib.exe
1420	attrib.exe
3648	attrib.exe
3684	attrib.exe
3292	attrib.exe
3076	attrib.exe
1316	attrib.exe
5004	attrib.exe
4652	attrib.exe
4648	attrib.exe
2772	attrib.exe
3928	attrib.exe
2980	attrib.exe
2948	attrib.exe
3680	attrib.exe
4844	attrib.exe
456	attrib.exe
1904	attrib.exe
4240	attrib.exe
768	attrib.exe
1352	attrib.exe
3480	attrib.exe
4752	attrib.exe
3828	attrib.exe
2964	attrib.exe
4712	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Blackkomet.exe
"C:\Users\Admin\AppData\Local\Temp\Blackkomet.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\SysWOW64\notepad.exe
  notepad
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  PID:3296
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Users\Admin\AppData\Local\Temp\Blackkomet.exe" +s +h
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:5108
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:1148
- C:\Windows\SysWOW64\Windupdt\winupdate.exe
  "C:\Windows\system32\Windupdt\winupdate.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    - Adds Run key to start application
    - Drops file in System32 directory
    PID:3528
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\Windupdt" +s +h
    3⤵
    - Sets file to hidden
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:3928
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
    3⤵
    - Sets file to hidden
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:456
- - C:\Windows\SysWOW64\Windupdt\winupdate.exe
    "C:\Windows\system32\Windupdt\winupdate.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:2652
  - - C:\Windows\SysWOW64\notepad.exe
      notepad
      4⤵
      Adds Run key to start application
      Drops file in System32 directory
      PID:2868
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\Windupdt" +s +h
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      Views/modifies file attributes
      PID:4976
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
      4⤵
      Sets file to hidden
      Drops file in System32 directory
      Views/modifies file attributes
      PID:2964
  - - C:\Windows\SysWOW64\Windupdt\winupdate.exe
      "C:\Windows\system32\Windupdt\winupdate.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Modifies registry class
      PID:2340
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        5⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2632
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        5⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2980
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        5⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1316
    - - C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        5⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:1808
      - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        6⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4992
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        6⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3480
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        6⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3648
      - C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        6⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:2772
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        7⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1652
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        7⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3556
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        7⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:5004
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        7⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        8⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3260
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        8⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1784
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        8⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:312
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        8⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:4600
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        9⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4488
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        9⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3204
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        9⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3076
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        9⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        10⤵
        
        PID:4056
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        10⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4652
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        10⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1904
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        10⤵
        
        PID:544
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        11⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        11⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2948
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        11⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2568
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        11⤵
        
        PID:472
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        12⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        12⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4240
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        12⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:552
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        12⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        13⤵
        
        PID:1388
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        13⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3000
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        13⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:768
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        13⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        14⤵
        
        PID:3664
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        14⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3680
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        14⤵
        Modifies WinLogon for persistence
        Sets file to hidden
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        Views/modifies file attributes
        
        PID:1992
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        14⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        15⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        15⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2732
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        15⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1352
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        15⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        16⤵
        
        PID:1344
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        16⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4888
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        16⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4844
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        16⤵
        
        PID:4232
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        17⤵
        
        PID:316
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        17⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4648
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        17⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3480
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        17⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        17⤵
        Drops file in System32 directory
        
        PID:3076
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        18⤵
        
        PID:2932
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        18⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1420
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        18⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1612
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        18⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        19⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        19⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4752
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        19⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3684
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        19⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        20⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        20⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4420
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        20⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:472
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        20⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        21⤵
        
        PID:3756
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        21⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3828
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        21⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2772
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        21⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        22⤵
        
        PID:3808
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        22⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4712
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        22⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2732
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        22⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        23⤵
        
        PID:2628
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        23⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1744
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        23⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1944
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        23⤵
        
        PID:552
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        24⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        24⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4844
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        24⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3292
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        24⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        25⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        24⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        23⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        22⤵
        
        PID:4008
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        21⤵
        
        PID:796
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        20⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        19⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        18⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        16⤵
        
        PID:3272
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        15⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        14⤵
        
        PID:2800
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        13⤵
        
        PID:1408
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        12⤵
        
        PID:660
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        11⤵
        
        PID:2768
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        10⤵
        
        PID:4860
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        9⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        8⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        7⤵
        
        PID:2236
      - C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        6⤵
        
        PID:3976
    - - C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        5⤵
        
        PID:4268
  - - C:\Windows\SysWOW64\notepad.exe
      C:\Windows\SysWOW64\notepad.exe
      4⤵
      PID:4296
- - C:\Windows\SysWOW64\notepad.exe
    C:\Windows\SysWOW64\notepad.exe
    3⤵
    PID:1752
- C:\Windows\SysWOW64\notepad.exe
  C:\Windows\SysWOW64\notepad.exe
  2⤵
  - Deletes itself
  PID:4772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Windupdt\winupdate.exe

Filesize
513KB

MD5
e79215f700f13826a8bb538e7d4c0d85

SHA1
3e15ea8a548d5c86c44d9d5c5c1f48d340c5d1ad

SHA256
472451f8fe222f31e91a48cfb3ffa20450d190fba3e78c3a5b207f51a2a994a6

SHA512
253bf8268a8b19fadc5d90586dac0edd903db871c301a99e0226f1661aaa455fdbec8925a07e183f37c5678a74a9a75284a089027cd3c345b42cb6d8f8705b4e

Download Submit
C:\Windows\SysWOW64\Windupdt\winupdate.exe

Filesize
598KB

MD5
a4de2e3fe4dbb07a05d79ee1bdf6e3d5

SHA1
b6b55d3866509eaf64b113592f351b9806a5bea1

SHA256
a219c52f23facd444cc79f176d6adf397ceeb2dd2702a8cc0bcd693f1a5c1f2a

SHA512
f52992dc5852b1a896e2d33298b2c9d83c503fb2392c965051452718521bc45f0711b2cb1f615bc1b2a2d0bdf95f64dcc74bdb2da673b8af088dc5eabab4ef8a

Download Submit
C:\Windows\SysWOW64\Windupdt\winupdate.exe

Filesize
105KB

MD5
6ffd8ffd5d0c5fd92ade926f874ab4e8

SHA1
6735f36868da961edb9aee62605661e346d7e414

SHA256
24f7d5322bfea98558b35a96e7b96f3d1a8309ef0b67989dbf09f46c442dd015

SHA512
bb90335101992c0d74d8e0e88e419fbdaaca4d45d1c2332cd66bbe314df5a553fa06e90e3c19a74b3700f0855ed2e57ad8ed9d0e308bdc2429fd3c8e95bc8e08

Download Submit
C:\Windows\SysWOW64\Windupdt\winupdate.exe

Filesize
756KB

MD5
c7dcd585b7e8b046f209052bcd6dd84b

SHA1
604dcfae9eed4f65c80a4a39454db409291e08fa

SHA256
0e8336ed51fe4551ced7d9aa5ce2dde945df8a0cc4e7c60199c24dd1cf7ccd48

SHA512
c5ba102b12d2c685312d7dc8d58d98891b73243f56a8491ea7c41c2edaaad44ad90b8bc0748dbd8c84e92e9ae9bbd0b0157265ebe35fb9b63668c57d0e1ed5f2

Download Submit
memory/472-85-0x0000000001F60000-0x0000000001F61000-memory.dmp

Filesize
4KB

Download
memory/472-88-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/544-83-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/544-80-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/552-144-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download
memory/1416-108-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/1416-104-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

Filesize
4KB

Download
memory/1612-43-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/1612-39-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

Filesize
4KB

Download
memory/1808-54-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

Filesize
4KB

Download
memory/1808-58-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/1992-65-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/1992-68-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/2072-139-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/2340-53-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/2340-50-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/2652-48-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/2652-45-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

Filesize
4KB

Download
memory/2772-60-0x0000000002110000-0x0000000002111000-memory.dmp

Filesize
4KB

Download
memory/2772-63-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/2904-78-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/2904-74-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/3076-120-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/3076-115-0x0000000002650000-0x0000000002651000-memory.dmp

Filesize
4KB

Download
memory/3296-2-0x00000000004D0000-0x00000000004D1000-memory.dmp

Filesize
4KB

Download
memory/3524-95-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

Filesize
4KB

Download
memory/3524-98-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/3816-123-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/3816-100-0x00000000020A0000-0x00000000020A1000-memory.dmp

Filesize
4KB

Download
memory/3816-103-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/3816-118-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/4232-113-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/4232-110-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

Filesize
4KB

Download
memory/4600-70-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/4600-73-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/4644-137-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/4644-134-0x00000000021B0000-0x00000000021B1000-memory.dmp

Filesize
4KB

Download
memory/4648-127-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/4712-93-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/4712-89-0x0000000000730000-0x0000000000731000-memory.dmp

Filesize
4KB

Download
memory/4772-35-0x00000000011A0000-0x00000000011A1000-memory.dmp

Filesize
4KB

Download
memory/4848-0-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/4848-37-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/4988-132-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/4988-129-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads