Malware Analysis Report

2025-04-13 23:18

Sample ID 240224-erdfgsgg68
Target a0e9c48de4b99b90d67b003e9e159447
SHA256 ad10bd209a0400769c98b80be60c4eb4962731830d374e7f76ba3455d92c7e67
Tags
darkcomet persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ad10bd209a0400769c98b80be60c4eb4962731830d374e7f76ba3455d92c7e67

Threat Level: Known bad

The file a0e9c48de4b99b90d67b003e9e159447 was found to be: Known bad.

Malicious Activity Summary

darkcomet persistence rat trojan

Darkcomet

Modifies WinLogon for persistence

Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

Uses the VBS compiler for execution

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Runs ping.exe

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-24 04:10

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-24 04:10

Reported

2024-02-24 04:12

Platform

win7-20240221-en

Max time kernel

144s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe"

Signatures

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
N/A N/A C:\Windupdt\winupdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 756 set thread context of 1636 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2464 set thread context of 2556 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe

Enumerates physical storage devices

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 756 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 756 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 756 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 756 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 756 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 756 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 756 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 756 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 756 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 756 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 756 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 756 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 756 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 756 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 756 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 1636 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windupdt\winupdate.exe
PID 1636 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windupdt\winupdate.exe
PID 1636 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windupdt\winupdate.exe
PID 1636 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windupdt\winupdate.exe
PID 1636 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windupdt\winupdate.exe
PID 1636 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windupdt\winupdate.exe
PID 1636 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windupdt\winupdate.exe
PID 1636 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\SysWOW64\cmd.exe
PID 1636 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\SysWOW64\cmd.exe
PID 1636 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\SysWOW64\cmd.exe
PID 1636 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\SysWOW64\cmd.exe
PID 2464 wrote to memory of 2556 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2464 wrote to memory of 2556 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2464 wrote to memory of 2556 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2464 wrote to memory of 2556 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2464 wrote to memory of 2556 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2464 wrote to memory of 2556 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2464 wrote to memory of 2556 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2464 wrote to memory of 2556 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2464 wrote to memory of 2556 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2580 wrote to memory of 1452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2580 wrote to memory of 1452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2580 wrote to memory of 1452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2580 wrote to memory of 1452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2464 wrote to memory of 2556 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2464 wrote to memory of 2556 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2464 wrote to memory of 2556 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2464 wrote to memory of 2556 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2464 wrote to memory of 2556 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2464 wrote to memory of 2556 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2464 wrote to memory of 2556 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2464 wrote to memory of 2556 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2464 wrote to memory of 2556 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe

"C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe"

C:\Users\Admin\AppData\Local\Temp\vbc.exe

C:\Users\Admin\AppData\Local\Temp\vbc.exe

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 5

C:\Users\Admin\AppData\Local\Temp\vbc.exe

C:\Users\Admin\AppData\Local\Temp\vbc.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe"

C:\Windupdt\winupdate.exe

"C:\Windupdt\winupdate.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 s7eezy.no-ip.info udp
ID 212.117.50.228:1604 s7eezy.no-ip.info tcp

Files

memory/756-2-0x0000000002030000-0x0000000002070000-memory.dmp

memory/756-1-0x0000000074960000-0x0000000074F0B000-memory.dmp

memory/756-0-0x0000000074960000-0x0000000074F0B000-memory.dmp

memory/1636-7-0x0000000000400000-0x00000000004CC000-memory.dmp

\Users\Admin\AppData\Local\Temp\vbc.exe

MD5 5ff2482aaf89a0abae4bbc81d3472568
SHA1 39b9ccc060292cf4968e5154d8e6c7ec0c5b9596
SHA256 1489b71d830b774f0edf3e8d4422018c107e4505bbf7e71d199e42709ab45162
SHA512 87471d6f0f3503d064ceb5cf7df6d1ac0a24c537eed2b850eb2e48388253ebc11f2b05fbf77aa6328fcb9c07a3765489d2c0681e6a829f547e711195094f525f

memory/1636-9-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/1636-11-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/1636-13-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/1636-15-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/1636-17-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/1636-19-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/1636-21-0x0000000000400000-0x00000000004CC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\vbc.exe

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1636-25-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/1636-28-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/1636-27-0x0000000000010000-0x0000000000011000-memory.dmp

memory/1636-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1636-32-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/756-33-0x0000000074960000-0x0000000074F0B000-memory.dmp

memory/1636-34-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/1636-35-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/1636-36-0x0000000000290000-0x0000000000291000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\vbc.exe

MD5 fad38e27c34fe8326760d0a671c90df6
SHA1 69704cd33db8fa242e41af632e7a4da46497e40d
SHA256 9fc9dd394fb27ddab47e22dbbc76b0a644043ad9a818fb4f339134c429cae394
SHA512 818a6833e1a57cd54e325a344cf1719311009853b506475eb319be951c56cbe5b9193446b3d8e59b6fd41d2bd37ee196bbeb08dba4b2980e727d2dcbc9e0f1f6

\Windupdt\winupdate.exe

MD5 314c5e16e371ba1c762eecb3fd657d62
SHA1 fdd60c9406b7bc3dd6bea3d18ddd735f8a51457e
SHA256 cd8f901783c414ddc4717a2de27e261f707708884b23ab943d7f1a418cf66cb6
SHA512 a68e6ab2ef10acd6ce5cfcf8c6570b91060552d4e1d7516537fdafb8c6243e7c7749e91636be7590c965390bbf2d14884d6f6ce9f382a41ec7199623f18f3cd0

memory/2464-53-0x0000000072980000-0x0000000072F2B000-memory.dmp

memory/1636-48-0x0000000000400000-0x00000000004CC000-memory.dmp

\Windupdt\winupdate.exe

MD5 4d7d2d8248e5d5b317067aceeb969a80
SHA1 4d07db171f84dff1469efb5d723ed8ce722d7884
SHA256 0b4c2ede50b8a3f2edcc7a56d35d43d6f669b7e3e88327566a2477e71415c713
SHA512 59db8335883131e1ddb5122af7fbac62f7735100e46130683a0151aa5fb68c3f45c538c7aa711ee70c60dde90af38a1b10eb27c5f8f9eb01c92478a742510255

\Users\Admin\AppData\Local\Temp\vbc.exe

MD5 fe6e8f9736bade905e66447436520126
SHA1 742bb436bc2c22df57948b6919d483435821adc1
SHA256 c9cf89a758ef4b6efd2ac2d60dcae59c2f781b9689b73dc803721980785204ed
SHA512 f9fc7f179c574b9057456bffb3ee79db94d5a616a35cae1f1c45ffb2de9a91edc876bb7ea8484a3923137c1169e8928e51589c9e7cef72880c971d2ad68294e8

\Windupdt\winupdate.exe

MD5 d13a77ebead844bcbcdf7b4623b83630
SHA1 20a775519e6eb7ccab6ff7099b1c5c329454ee29
SHA256 5b23a90796158c1ac01a17ec35a395f34dabe27617fe759d77b594d9ab27d55b
SHA512 2dfeb7cd3494439922a91033c314977e7997e7755b4e0ceb526a5e9571a37893eb6796c8f3bb3c0a3920c9bdd215e27cb03e293c09246234e4c87ce37b41defe

C:\Windupdt\winupdate.exe

MD5 a0e9c48de4b99b90d67b003e9e159447
SHA1 b2d59745cdf8b1aa44e46f8ae0857aca4dfb4368
SHA256 ad10bd209a0400769c98b80be60c4eb4962731830d374e7f76ba3455d92c7e67
SHA512 3c6a5cb1b53dbc504f8f49aedd44daa5d9b167072b4dce8ad0a970255d9648e8e0d1b59721fec93c7fec34544aa4b770834309c0dc287f4dd6e94dc945da0b8f

memory/2464-60-0x0000000072980000-0x0000000072F2B000-memory.dmp

memory/2556-71-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\vbc.exe

MD5 0976f2ca37196e8541e5244f0d0cf5a1
SHA1 ad103a93d9428c082624a44cde505d8c94d87a26
SHA256 8be138c97a705884740cd2e8077b9f6ec5b9dab6b37643d04a122f0856100a8f
SHA512 53f6d0e2391952fb60a9ea061893fa85a8f6ca8b07fc5546f2643e83edc5e0ebf3d6266b0ee770f35ed1371d90bdafa0845b09c631c018a5202b29502aa20a18

memory/2556-78-0x0000000000400000-0x00000000004CC000-memory.dmp

\Users\Admin\AppData\Local\Temp\vbc.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

memory/2556-83-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/2464-85-0x0000000072980000-0x0000000072F2B000-memory.dmp

memory/2556-86-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/2556-84-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/2556-87-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/2556-88-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/2556-89-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/2556-90-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/2556-91-0x0000000000400000-0x00000000004CC000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-24 04:10

Reported

2024-02-24 04:12

Platform

win10v2004-20240221-en

Max time kernel

147s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe"

Signatures

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe,C:\\Windupdt\\winupdate.exe" C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2356 set thread context of 3376 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 3960 set thread context of 1640 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2352 set thread context of 3796 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2356 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2356 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2356 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2356 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2356 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2356 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2356 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2356 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2356 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2356 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2356 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2356 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2356 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2356 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2356 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2356 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 3376 wrote to memory of 3960 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windupdt\winupdate.exe
PID 3376 wrote to memory of 3960 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windupdt\winupdate.exe
PID 3376 wrote to memory of 3960 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windupdt\winupdate.exe
PID 3376 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\SysWOW64\cmd.exe
PID 3376 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\SysWOW64\cmd.exe
PID 3376 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\SysWOW64\cmd.exe
PID 2296 wrote to memory of 1360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2296 wrote to memory of 1360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2296 wrote to memory of 1360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3960 wrote to memory of 1640 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 3960 wrote to memory of 1640 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 3960 wrote to memory of 1640 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 3960 wrote to memory of 1640 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 3960 wrote to memory of 1640 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 3960 wrote to memory of 1640 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 3960 wrote to memory of 1640 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 3960 wrote to memory of 1640 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 3960 wrote to memory of 1640 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 3960 wrote to memory of 1640 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 3960 wrote to memory of 1640 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 3960 wrote to memory of 1640 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 3960 wrote to memory of 1640 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 3960 wrote to memory of 1640 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 3960 wrote to memory of 1640 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 3960 wrote to memory of 1640 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 1640 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windupdt\winupdate.exe
PID 1640 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windupdt\winupdate.exe
PID 1640 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windupdt\winupdate.exe
PID 1640 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\SysWOW64\cmd.exe
PID 1640 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\SysWOW64\cmd.exe
PID 1640 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\SysWOW64\cmd.exe
PID 2080 wrote to memory of 4176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2080 wrote to memory of 4176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2080 wrote to memory of 4176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2352 wrote to memory of 3796 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2352 wrote to memory of 3796 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2352 wrote to memory of 3796 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2352 wrote to memory of 3796 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2352 wrote to memory of 3796 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2352 wrote to memory of 3796 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2352 wrote to memory of 3796 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2352 wrote to memory of 3796 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2352 wrote to memory of 3796 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2352 wrote to memory of 3796 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2352 wrote to memory of 3796 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2352 wrote to memory of 3796 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2352 wrote to memory of 3796 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2352 wrote to memory of 3796 N/A C:\Windupdt\winupdate.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe

"C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe"

C:\Users\Admin\AppData\Local\Temp\vbc.exe

C:\Users\Admin\AppData\Local\Temp\vbc.exe

C:\Windupdt\winupdate.exe

"C:\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Users\Admin\AppData\Local\Temp\a0e9c48de4b99b90d67b003e9e159447.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 5

C:\Users\Admin\AppData\Local\Temp\vbc.exe

C:\Users\Admin\AppData\Local\Temp\vbc.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Users\Admin\AppData\Local\Temp\vbc.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 5

C:\Users\Admin\AppData\Local\Temp\vbc.exe

C:\Users\Admin\AppData\Local\Temp\vbc.exe

C:\Windupdt\winupdate.exe

"C:\Windupdt\winupdate.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 138.201.86.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 s7eezy.no-ip.info udp
ID 212.117.50.228:1604 s7eezy.no-ip.info tcp
ID 212.117.50.228:1604 s7eezy.no-ip.info tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
ID 212.117.50.228:1604 s7eezy.no-ip.info tcp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 s7eezy.no-ip.info udp
ID 212.117.50.228:1604 s7eezy.no-ip.info tcp
ID 212.117.50.228:1604 s7eezy.no-ip.info tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
ID 212.117.50.228:1604 s7eezy.no-ip.info tcp
US 8.8.8.8:53 s7eezy.no-ip.info udp
ID 212.117.50.228:1604 s7eezy.no-ip.info tcp
US 8.8.8.8:53 14.173.189.20.in-addr.arpa udp

Files

memory/2356-0-0x0000000074970000-0x0000000074F21000-memory.dmp

memory/2356-1-0x0000000074970000-0x0000000074F21000-memory.dmp

memory/2356-2-0x0000000000FD0000-0x0000000000FE0000-memory.dmp

memory/3376-5-0x0000000000400000-0x00000000004CC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\vbc.exe

MD5 28f12f2d4cfbaa12636ac5997cbec643
SHA1 fbf0dd5de954424336d08c78b1d1011875d18f6c
SHA256 aef7f944b0293370e2f7d5ac93dc577662c22551fef1dc89a00d507c72b2b09a
SHA512 af8ac7fe677c88d2944a85da5ab3d4df180c4ca073a93f37e6c4254d87e878a7dc3ee29e7eb0baab4c65f1abdc9a328fbe1f6a1b76d5cbd26f87b4b6b7cf1c1b

memory/3376-7-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/3376-9-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/3376-11-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/3376-12-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/2356-10-0x0000000074970000-0x0000000074F21000-memory.dmp

memory/3376-16-0x0000000002290000-0x0000000002291000-memory.dmp

C:\Windupdt\winupdate.exe

MD5 a0e9c48de4b99b90d67b003e9e159447
SHA1 b2d59745cdf8b1aa44e46f8ae0857aca4dfb4368
SHA256 ad10bd209a0400769c98b80be60c4eb4962731830d374e7f76ba3455d92c7e67
SHA512 3c6a5cb1b53dbc504f8f49aedd44daa5d9b167072b4dce8ad0a970255d9648e8e0d1b59721fec93c7fec34544aa4b770834309c0dc287f4dd6e94dc945da0b8f

C:\Windupdt\winupdate.exe

MD5 ff9200c2e0df48db171d84825431551f
SHA1 e72b57e16ee0a3b9c75ab22994a19b15c7c3e258
SHA256 537aaf8e44ff9b6e2561fcd93d9735c1c5e0237b7f7d1e583f18ef1e017cbbd2
SHA512 fa9837913afdedaff3c552d3cbb58312d7205843cfa2124f70dc53b7826812a1dba8a30495df4526909309ebe10c999b42fd00932fe4131842da820bfad25acc

C:\Windupdt\winupdate.exe

MD5 0ffdefffb5e96f81c624239fb4f44d28
SHA1 65d62be92f134890a6bc2d58225575a0d8ebfa33
SHA256 ebab64d917773cfbd259b4d14434ef6f9a7e47e1c9d9432cf279d65e6bc98904
SHA512 2b6ca7d0adc518c699368f6ab1289c51baf69ff312ccbb67f6f2c9b3a02fe17c0da7a2f44c3c6fc88bf8ba9c3cfa2a6c56aae47ed600480ddee997ef15fb3d39

memory/3376-75-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/3960-76-0x00000000730C0000-0x0000000073671000-memory.dmp

memory/3960-78-0x00000000730C0000-0x0000000073671000-memory.dmp

memory/3960-79-0x0000000000B10000-0x0000000000B20000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\vbc.exe

MD5 d881de17aa8f2e2c08cbb7b265f928f9
SHA1 08936aebc87decf0af6e8eada191062b5e65ac2a
SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA512 5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

memory/3960-88-0x00000000730C0000-0x0000000073671000-memory.dmp

memory/1640-87-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/1640-89-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/1640-90-0x00000000022F0000-0x00000000022F1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\winupdate.exe.log

MD5 b75d63217c5d10a12e60be6d73af5e9a
SHA1 d25477a0a74ec499326e7db6c1f962f8fe77b818
SHA256 fa5feaf188800d777889d204daa15cff40715badfd65ddf0a818b9d130378e11
SHA512 07f390be438c0542b40984ce43b33aac495fe2eb7e564d415ed296783704fc6d3946eea24ec6c86a88e7a742c100c30e56a9c5e4d8eee2a5efe936126a615273

memory/2352-97-0x0000000001050000-0x0000000001060000-memory.dmp

memory/2352-98-0x00000000723A0000-0x0000000072951000-memory.dmp

memory/2352-96-0x00000000723A0000-0x0000000072951000-memory.dmp

memory/1640-93-0x0000000000400000-0x00000000004CC000-memory.dmp

C:\Windupdt\winupdate.exe

MD5 7792831cf3fa40859f7a72dbac89a3e0
SHA1 a6ac2e8db823c1bf8627ae6fbc4fe16303f2b41c
SHA256 f5b2636669c26cecf7742496bf69f5556c70fefad5e42fce76fd6bc4871dff11
SHA512 c861afa3085fe40e5cf9b9fa2f5a56759e3046cb9e82cc81eea2108b529f43b0daa21fffef82793e4131d953cfad7341023017b9bde23ae2df5cdc08b50e23ec

C:\Users\Admin\AppData\Local\Temp\vbc.exe

MD5 2a3e9aa7245e68e0eb8175e74beb84d2
SHA1 1af426b344a49d436decb70a822f2e708f8e8561
SHA256 262c2aa2dd3c02cf696703b26360534fac184175097445ccd82eeac6b47c09a1
SHA512 aaa0cf162779a076edad26145a4ec955b88c549aec6ae9af4b8b035dedefce4e625fbef4fc9383f7c3c34359cf8da8be34afc08957b1cb7fc251d998244f279b

C:\Users\Admin\AppData\Local\Temp\vbc.exe

MD5 d2b89a7355eec9db8b81c667cdbe59c7
SHA1 515f86ec82edef5ec4c8f0b848ac5eaf3179936c
SHA256 3dbca12e9080f871d6063679ed399911226f9e57b1d7a2bc99d0b4cc29944f17
SHA512 c2dab0d2125d0dd01c976028ae9ef0d65f16bf72da5dbf2037da93029b45702a89e6c79889dc567bfd853cadfb291e4ace8e6e34bdf55daef0652607fb44f787

memory/2352-106-0x00000000723A0000-0x0000000072951000-memory.dmp

memory/3796-105-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/3796-110-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/3796-109-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/3796-108-0x00000000021B0000-0x00000000021B1000-memory.dmp

memory/3796-107-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/3796-104-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/3796-111-0x0000000000400000-0x00000000004CC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\vbc.exe

MD5 4bdb8d5d102bd82812b6fbec60522675
SHA1 cf4fd3f6b20d0f9fa41e87e88c6bfcb31a9df072
SHA256 a96d0268064e480fdc8b4cabc2c6928897853113d4b92b8d216d8af6d0fc0051
SHA512 3045d2ef16b67dc091c7096b9e36b3410f8ee9a8be64e93a81221bb7052f5f32b1b0a72e404a6d0f05f0a28548972e7150b3ffc1ce3dc484ad541861e725c2c0

memory/3796-113-0x0000000000400000-0x00000000004CC000-memory.dmp

memory/3796-114-0x0000000000400000-0x00000000004CC000-memory.dmp