Malware Analysis Report

2024-10-19 08:01

Sample ID 240415-3gbe5sdb9x
Target DarkNight.exe
SHA256 b8022c1aa5f5f6220ffce8f3f473bb8078bbf171fa00e50823bc0c79946c1121
Tags
themida evasion trojan darkcomet dn2 rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b8022c1aa5f5f6220ffce8f3f473bb8078bbf171fa00e50823bc0c79946c1121

Threat Level: Known bad

The file DarkNight.exe was found to be: Known bad.

Malicious Activity Summary

themida evasion trojan darkcomet dn2 rat

Darkcomet

Looks for VirtualBox Guest Additions in registry

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VMWare Tools registry key

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Looks up external IP address via web service

Maps connected drives based on registry

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-15 23:28

Signatures

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-15 23:28

Reported

2024-04-15 23:30

Platform

win7-20240221-en

Max time kernel

37s

Max time network

19s

Command Line

"C:\Users\Admin\AppData\Local\Temp\DarkNight.exe"

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A wtfismyip.com N/A N/A
N/A wtfismyip.com N/A N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2784 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
PID 2784 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
PID 2784 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
PID 2784 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
PID 2784 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
PID 2784 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
PID 2784 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
PID 2784 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
PID 2784 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
PID 2784 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
PID 2784 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
PID 2784 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
PID 2784 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
PID 2784 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
PID 2784 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Windows\SysWOW64\CMD.exe
PID 2784 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Windows\SysWOW64\CMD.exe
PID 2784 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Windows\SysWOW64\CMD.exe
PID 2784 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Windows\SysWOW64\CMD.exe
PID 2576 wrote to memory of 2836 N/A C:\Windows\SysWOW64\CMD.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2576 wrote to memory of 2836 N/A C:\Windows\SysWOW64\CMD.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2576 wrote to memory of 2836 N/A C:\Windows\SysWOW64\CMD.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2576 wrote to memory of 2836 N/A C:\Windows\SysWOW64\CMD.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2784 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Windows\SysWOW64\CMD.exe
PID 2784 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Windows\SysWOW64\CMD.exe
PID 2784 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Windows\SysWOW64\CMD.exe
PID 2784 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Windows\SysWOW64\CMD.exe
PID 2372 wrote to memory of 2488 N/A C:\Windows\SysWOW64\CMD.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2372 wrote to memory of 2488 N/A C:\Windows\SysWOW64\CMD.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2372 wrote to memory of 2488 N/A C:\Windows\SysWOW64\CMD.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 2372 wrote to memory of 2488 N/A C:\Windows\SysWOW64\CMD.exe C:\Windows\SysWOW64\Wbem\WMIC.exe

Processes

C:\Users\Admin\AppData\Local\Temp\DarkNight.exe

"C:\Users\Admin\AppData\Local\Temp\DarkNight.exe"

C:\Users\Admin\AppData\Local\Temp\DarkNight.exe

C:\Users\Admin\AppData\Local\Temp\DarkNight.exe

C:\Windows\SysWOW64\CMD.exe

"CMD.exe" /C WMIC COMPUTERSYSTEM GET MODEL

C:\Windows\SysWOW64\Wbem\WMIC.exe

WMIC COMPUTERSYSTEM GET MODEL

C:\Windows\SysWOW64\CMD.exe

"CMD.exe" /C WMIC BIOS GET VERSION

C:\Windows\SysWOW64\Wbem\WMIC.exe

WMIC BIOS GET VERSION

Network

Country Destination Domain Proto
US 8.8.8.8:53 wtfismyip.com udp
FI 65.108.75.112:443 wtfismyip.com tcp
TR 80.93.220.228:4443 tcp

Files

memory/2784-0-0x0000000000C30000-0x00000000015D2000-memory.dmp

memory/2784-1-0x0000000076000000-0x0000000076110000-memory.dmp

memory/2784-2-0x0000000076AB0000-0x0000000076AF7000-memory.dmp

memory/2784-3-0x0000000076000000-0x0000000076110000-memory.dmp

memory/2784-5-0x0000000076AB0000-0x0000000076AF7000-memory.dmp

memory/2784-8-0x0000000076000000-0x0000000076110000-memory.dmp

memory/2784-9-0x0000000076AB0000-0x0000000076AF7000-memory.dmp

memory/2784-10-0x0000000076000000-0x0000000076110000-memory.dmp

memory/2784-11-0x0000000076000000-0x0000000076110000-memory.dmp

memory/2784-12-0x0000000076000000-0x0000000076110000-memory.dmp

memory/2784-13-0x0000000076000000-0x0000000076110000-memory.dmp

memory/2784-14-0x0000000076AB0000-0x0000000076AF7000-memory.dmp

memory/2784-15-0x0000000076000000-0x0000000076110000-memory.dmp

memory/2784-16-0x0000000076000000-0x0000000076110000-memory.dmp

memory/2784-17-0x0000000076000000-0x0000000076110000-memory.dmp

memory/2784-18-0x0000000076000000-0x0000000076110000-memory.dmp

memory/2784-19-0x0000000076000000-0x0000000076110000-memory.dmp

memory/2784-20-0x0000000000C30000-0x00000000015D2000-memory.dmp

memory/2784-21-0x0000000076000000-0x0000000076110000-memory.dmp

memory/2784-22-0x0000000000C30000-0x00000000015D2000-memory.dmp

memory/2784-23-0x00000000741A0000-0x000000007488E000-memory.dmp

memory/2784-24-0x00000000008F0000-0x00000000008FE000-memory.dmp

memory/2784-25-0x00000000053E0000-0x0000000005D82000-memory.dmp

memory/2784-26-0x00000000055A0000-0x00000000055E0000-memory.dmp

memory/2784-27-0x00000000055A0000-0x00000000055E0000-memory.dmp

memory/2784-29-0x0000000000C30000-0x00000000015D2000-memory.dmp

memory/2784-30-0x0000000076000000-0x0000000076110000-memory.dmp

memory/2784-31-0x0000000076AB0000-0x0000000076AF7000-memory.dmp

memory/2784-32-0x00000000741A0000-0x000000007488E000-memory.dmp

memory/2784-33-0x00000000053E0000-0x000000000543F000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-15 23:28

Reported

2024-04-15 23:30

Platform

win10v2004-20240412-en

Max time kernel

61s

Max time network

66s

Command Line

"C:\Users\Admin\AppData\Local\Temp\DarkNight.exe"

Signatures

Darkcomet

trojan rat darkcomet

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A wtfismyip.com N/A N/A
N/A wtfismyip.com N/A N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1308 set thread context of 3776 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Users\Admin\AppData\Local\Temp\DarkNight.exe

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1308 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
PID 1308 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
PID 1308 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
PID 1308 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
PID 1308 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
PID 1308 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
PID 1308 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
PID 1308 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
PID 1308 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
PID 1308 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
PID 1308 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
PID 1308 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
PID 1308 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
PID 1308 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
PID 1308 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Windows\SysWOW64\CMD.exe
PID 1308 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Windows\SysWOW64\CMD.exe
PID 1308 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Windows\SysWOW64\CMD.exe
PID 4544 wrote to memory of 2600 N/A C:\Windows\SysWOW64\CMD.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 4544 wrote to memory of 2600 N/A C:\Windows\SysWOW64\CMD.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 4544 wrote to memory of 2600 N/A C:\Windows\SysWOW64\CMD.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1308 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Windows\SysWOW64\CMD.exe
PID 1308 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Windows\SysWOW64\CMD.exe
PID 1308 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\DarkNight.exe C:\Windows\SysWOW64\CMD.exe
PID 3420 wrote to memory of 812 N/A C:\Windows\SysWOW64\CMD.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 3420 wrote to memory of 812 N/A C:\Windows\SysWOW64\CMD.exe C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 3420 wrote to memory of 812 N/A C:\Windows\SysWOW64\CMD.exe C:\Windows\SysWOW64\Wbem\WMIC.exe

Processes

C:\Users\Admin\AppData\Local\Temp\DarkNight.exe

"C:\Users\Admin\AppData\Local\Temp\DarkNight.exe"

C:\Users\Admin\AppData\Local\Temp\DarkNight.exe

C:\Users\Admin\AppData\Local\Temp\DarkNight.exe

C:\Windows\SysWOW64\CMD.exe

"CMD.exe" /C WMIC COMPUTERSYSTEM GET MODEL

C:\Windows\SysWOW64\Wbem\WMIC.exe

WMIC COMPUTERSYSTEM GET MODEL

C:\Windows\SysWOW64\CMD.exe

"CMD.exe" /C WMIC BIOS GET VERSION

C:\Windows\SysWOW64\Wbem\WMIC.exe

WMIC BIOS GET VERSION

Network

Country Destination Domain Proto
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
TR 80.93.220.228:1605 tcp
US 8.8.8.8:53 wtfismyip.com udp
FI 65.108.75.112:443 wtfismyip.com tcp
TR 80.93.220.228:4443 tcp
US 8.8.8.8:53 112.75.108.65.in-addr.arpa udp
US 8.8.8.8:53 228.220.93.80.in-addr.arpa udp
TR 80.93.220.228:1605 tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
TR 80.93.220.228:1605 tcp

Files

memory/1308-0-0x0000000000820000-0x00000000011C2000-memory.dmp

memory/1308-1-0x0000000075DB0000-0x0000000075EA0000-memory.dmp

memory/1308-2-0x0000000075DB0000-0x0000000075EA0000-memory.dmp

memory/1308-3-0x0000000075DB0000-0x0000000075EA0000-memory.dmp

memory/1308-4-0x0000000075DB0000-0x0000000075EA0000-memory.dmp

memory/1308-5-0x0000000075DB0000-0x0000000075EA0000-memory.dmp

memory/1308-6-0x0000000075DB0000-0x0000000075EA0000-memory.dmp

memory/1308-8-0x0000000075DB0000-0x0000000075EA0000-memory.dmp

memory/1308-10-0x0000000000820000-0x00000000011C2000-memory.dmp

memory/1308-11-0x0000000000820000-0x00000000011C2000-memory.dmp

memory/1308-12-0x00000000032F0000-0x00000000032FE000-memory.dmp

memory/1308-13-0x0000000005940000-0x00000000059DC000-memory.dmp

memory/3776-14-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/3776-15-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/3776-17-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/3776-16-0x0000000000820000-0x00000000011C2000-memory.dmp

memory/3776-18-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/3776-19-0x0000000003290000-0x0000000003291000-memory.dmp

memory/3776-20-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/3776-21-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/1308-22-0x00000000059E0000-0x0000000005A46000-memory.dmp

memory/1308-23-0x0000000005B00000-0x0000000005B10000-memory.dmp

memory/1308-25-0x0000000000820000-0x00000000011C2000-memory.dmp

memory/1308-26-0x0000000075DB0000-0x0000000075EA0000-memory.dmp

memory/1308-27-0x0000000075DB0000-0x0000000075EA0000-memory.dmp

memory/1308-29-0x0000000075DB0000-0x0000000075EA0000-memory.dmp

memory/1308-30-0x0000000075DB0000-0x0000000075EA0000-memory.dmp

memory/1308-31-0x0000000075DB0000-0x0000000075EA0000-memory.dmp

memory/1308-32-0x0000000075DB0000-0x0000000075EA0000-memory.dmp

memory/1308-33-0x0000000075DB0000-0x0000000075EA0000-memory.dmp

memory/3776-34-0x0000000000820000-0x00000000011C2000-memory.dmp

memory/3776-35-0x0000000000400000-0x00000000004B2000-memory.dmp

memory/1308-37-0x0000000005B00000-0x0000000005B10000-memory.dmp