Malware Analysis Report

2024-08-06 19:32

Sample ID 240519-e3g8taad3y
Target 093bc49ab25cc6a20d95155db80f1fa8.exe
SHA256 0824eac1ce23de2321bce82efce874ab3c213d15f1a120d8ec08c85c7fbc250b
Tags
asyncrat darkcomet 2024+may3333-newcrt persistence rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0824eac1ce23de2321bce82efce874ab3c213d15f1a120d8ec08c85c7fbc250b

Threat Level: Known bad

The file 093bc49ab25cc6a20d95155db80f1fa8.exe was found to be: Known bad.

Malicious Activity Summary

asyncrat darkcomet 2024+may3333-newcrt persistence rat trojan upx

AsyncRat

Darkcomet

Modifies WinLogon for persistence

Async RAT payload

Drops file in Drivers directory

Checks computer location settings

Executes dropped EXE

UPX packed file

Loads dropped DLL

Adds Run key to start application

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Uses Task Scheduler COM API

Delays execution with timeout.exe

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-19 04:27

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-19 04:27

Reported

2024-05-19 04:30

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\093bc49ab25cc6a20d95155db80f1fa8.exe"

Signatures

AsyncRat

rat asyncrat

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\rar.exe" C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\Documents\rar.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\audiodrvs.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winrar = "C:\\Users\\Admin\\Documents\\rar.exe" C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winrar = "C:\\Users\\Admin\\Documents\\rar.exe" C:\Users\Admin\Documents\rar.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\System32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Roaming\audiodrvs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: 33 N/A C:\Users\Admin\Documents\rar.exe N/A
Token: 34 N/A C:\Users\Admin\Documents\rar.exe N/A
Token: 35 N/A C:\Users\Admin\Documents\rar.exe N/A
Token: 36 N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\audiodrvs.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\rar.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2552 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\093bc49ab25cc6a20d95155db80f1fa8.exe C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp
PID 2552 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\093bc49ab25cc6a20d95155db80f1fa8.exe C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp
PID 2552 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\093bc49ab25cc6a20d95155db80f1fa8.exe C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp
PID 2540 wrote to memory of 3900 N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE
PID 2540 wrote to memory of 3900 N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE
PID 2540 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE
PID 2540 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE
PID 2540 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE
PID 3900 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp
PID 3900 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp
PID 2540 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp C:\Windows\SysWOW64\notepad.exe
PID 2540 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp C:\Windows\SysWOW64\notepad.exe
PID 2540 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp C:\Windows\SysWOW64\notepad.exe
PID 2540 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp C:\Windows\SysWOW64\notepad.exe
PID 2540 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp C:\Windows\SysWOW64\notepad.exe
PID 2540 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp C:\Windows\SysWOW64\notepad.exe
PID 2540 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp C:\Windows\SysWOW64\notepad.exe
PID 2540 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp C:\Windows\SysWOW64\notepad.exe
PID 2540 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp C:\Windows\SysWOW64\notepad.exe
PID 2540 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp C:\Windows\SysWOW64\notepad.exe
PID 2540 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp C:\Windows\SysWOW64\notepad.exe
PID 2540 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp C:\Windows\SysWOW64\notepad.exe
PID 2540 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp C:\Windows\SysWOW64\notepad.exe
PID 2540 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp C:\Windows\SysWOW64\notepad.exe
PID 2540 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp C:\Windows\SysWOW64\notepad.exe
PID 2540 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp C:\Windows\SysWOW64\notepad.exe
PID 2540 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp C:\Windows\SysWOW64\notepad.exe
PID 4984 wrote to memory of 4032 N/A C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE
PID 4984 wrote to memory of 4032 N/A C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE
PID 4984 wrote to memory of 4032 N/A C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE
PID 2540 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp C:\Users\Admin\Documents\rar.exe
PID 2540 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp C:\Users\Admin\Documents\rar.exe
PID 2540 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp C:\Users\Admin\Documents\rar.exe
PID 4032 wrote to memory of 972 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE C:\Windows\SysWOW64\schtasks.exe
PID 4032 wrote to memory of 972 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE C:\Windows\SysWOW64\schtasks.exe
PID 4032 wrote to memory of 972 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE C:\Windows\SysWOW64\schtasks.exe
PID 3616 wrote to memory of 4308 N/A C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp C:\Windows\System32\schtasks.exe
PID 3616 wrote to memory of 4308 N/A C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp C:\Windows\System32\schtasks.exe
PID 3616 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp C:\Windows\system32\cmd.exe
PID 3616 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp C:\Windows\system32\cmd.exe
PID 3876 wrote to memory of 3920 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 3876 wrote to memory of 3920 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 3876 wrote to memory of 3224 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\audiodrvs.exe
PID 3876 wrote to memory of 3224 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\audiodrvs.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\093bc49ab25cc6a20d95155db80f1fa8.exe

"C:\Users\Admin\AppData\Local\Temp\093bc49ab25cc6a20d95155db80f1fa8.exe"

C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp

"C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp"

C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE

"C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE"

C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE

"C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE"

C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp

"C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp"

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE

"C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE"

C:\Users\Admin\Documents\rar.exe

"C:\Users\Admin\Documents\rar.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "logons" /XML "C:\Users\Admin\AppData\Local\Temp\tmp632E.tmp" /F

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'audiodrvs"' /tr "'C:\Users\Admin\AppData\Roaming\audiodrvs.exe"'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8D1D.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\audiodrvs.exe

"C:\Users\Admin\AppData\Roaming\audiodrvs.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
NL 172.111.216.4:35800 dgorijan20785.hopto.org tcp
US 8.8.8.8:53 4.216.111.172.in-addr.arpa udp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
NL 172.111.216.4:4488 dgorijan20785.hopto.org tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
NL 172.111.216.4:4488 dgorijan20785.hopto.org tcp
NL 172.111.216.4:4488 dgorijan20785.hopto.org tcp
NL 172.111.216.4:8808 dgorijan20785.hopto.org tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 23.173.189.20.in-addr.arpa udp

Files

memory/2552-0-0x0000000000400000-0x00000000007956B4-memory.dmp

memory/2552-1-0x00000000006BB000-0x00000000006BC000-memory.dmp

memory/2552-2-0x0000000000400000-0x00000000007956B4-memory.dmp

memory/2552-3-0x0000000000400000-0x00000000007956B4-memory.dmp

memory/2552-4-0x0000000000400000-0x00000000007956B4-memory.dmp

memory/2552-5-0x0000000000400000-0x00000000007956B4-memory.dmp

memory/2552-6-0x0000000000400000-0x00000000007956B4-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sms4A76.tmp

MD5 89feeb6ec82c704b1771bfa2536bd401
SHA1 2ae958b6e74986696e412e313b5f0aee3756ba19
SHA256 9765068707da158f492b48d5628b3b6cc93dc34dd402d57c0b4ced60701e0b9a
SHA512 9ef8c9c1c9795cf4451dd577c2292171c7dccb9aa24447dff72de9e886e604638b32f637ba8e19cfc86c377fed7a97c56336a62f7edd6130d4a8b928f5bf0484

memory/2540-11-0x0000000000400000-0x000000000055B000-memory.dmp

memory/2540-12-0x0000000000400000-0x000000000055B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE

MD5 f6062ddb9cc2fad6e403b8b9dbe02df7
SHA1 efebcabb3902cdcc7b789786d96db2a93156b81a
SHA256 61309415bb524bba3d6065cf5df5ce2031ddde239c7f7864d0d2eaf31597a96c
SHA512 3d2473fd09d5d0a4a0f463ed84522165254880a6f94491b5c9a21fbbd39df4579980184fd838f75b3ad6457065c818c536447ae18c97eac29146cd8be5883040

C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE

MD5 b8eaef2339ba6bfac3648df30d041a95
SHA1 0833419f0da847383c0031611c69a87baa8f2d6d
SHA256 6ce2b4a0e176126f0899223eace35c31b544e46a2067b0ecf0adf8d06f87309d
SHA512 c265a39039c9dd8237fb10c26066ff7247babc727a556919f7673311dee1d38c3a52a2cf83e54f148401b984495b4e5636b8254388376e96f0a4e9a40cba6613

memory/3900-35-0x0000000000400000-0x00000000004E05B0-memory.dmp

memory/4984-36-0x0000000072C0E000-0x0000000072C0F000-memory.dmp

memory/4984-37-0x0000000000D80000-0x0000000000DEE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sms4CA9.tmp

MD5 194de251c043183099b2d6f7f5d1e09f
SHA1 dc477dfc0e090e8d7bd31fb808f59060dd2cf360
SHA256 12bee16f9692cb9a6d3713543cf998a4f953d0341f4e9c661748faef525d91e6
SHA512 6a1433b9bc070f18f60c3f115a1173e8979d211f6e97daf3fc7fe13f05ab15123874919418fc014fdd8af62c82426cb091b867b36a49fe7fc8fe929709b3a433

memory/3616-43-0x0000000000E20000-0x0000000000E32000-memory.dmp

memory/4984-44-0x00000000056E0000-0x00000000056E6000-memory.dmp

memory/4984-46-0x0000000072C00000-0x00000000733B0000-memory.dmp

memory/1960-47-0x00000000009B0000-0x00000000009B1000-memory.dmp

memory/4984-107-0x0000000072C00000-0x00000000733B0000-memory.dmp

memory/2396-118-0x0000000000400000-0x000000000055B000-memory.dmp

memory/2540-120-0x0000000000400000-0x000000000055B000-memory.dmp

memory/2552-122-0x0000000000400000-0x00000000007956B4-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp632E.tmp

MD5 db5e3f14b64ed69affa1389010cd445e
SHA1 752719617c787dbb741cfd4e8a608dd2f578d4c9
SHA256 eaeea05441cdf6ec90fd034de26b0108920f2d625f308497ebe7c05be8b69cc4
SHA512 8ee07a3e1684fb72852ad954b985db0d5a3931be5037a1fa8cb62677401d52042d80a80f27e1692edfef1d9f15b1d0cb8b8633b0414727cd775b04c4bb5e7fa9

memory/3900-126-0x0000000000400000-0x00000000004E05B0-memory.dmp

memory/2396-127-0x0000000000400000-0x000000000055B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp8D1D.tmp.bat

MD5 67640f512bf55cf106cf8e9511abf377
SHA1 b505cd813fc41274d136c8c484299b6210d5e80f
SHA256 1cbcc039fac7430a8a71d34cc947b55e705b9ad9d8bbd92eb08853cbd89f54f2
SHA512 1ddfa88732eceb0bea149620484c26a49f798b43cc99d16f42e8c1c94a112a8265afd46d784a5a8fc958fcd27cc1bb8b6e6296d6c6a1f6852f75619e0b61af1c

memory/4032-134-0x0000000006700000-0x0000000006766000-memory.dmp

C:\Users\Admin\AppData\Roaming\audiodrvs.exe

MD5 f30619813f9297e6b0dc77f317de54d0
SHA1 8301398ab0baffef99288a47579c3a1d12a93bd3
SHA256 c73234e9f0bd027ff96f73f77fd4e72a6aa06d02536e0de2fd8650f6f07989ad
SHA512 02f8ac74965802f96945f331735a872aa5402e5a0ad77ac4e3adf9685e39b9722f0d8556634362c046ba097f48f4a2e884019a0d419fc8428665b8769abec857

memory/2396-138-0x0000000000400000-0x000000000055B000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-19 04:27

Reported

2024-05-19 04:30

Platform

win7-20240221-en

Max time kernel

149s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\093bc49ab25cc6a20d95155db80f1fa8.exe"

Signatures

AsyncRat

rat asyncrat

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\rar.exe" C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\smsA3DD.tmp N/A
N/A N/A C:\Users\Admin\Documents\rar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Roaming\audiodrvs.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\winrar = "C:\\Users\\Admin\\Documents\\rar.exe" C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\winrar = "C:\\Users\\Admin\\Documents\\rar.exe" C:\Users\Admin\Documents\rar.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\System32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\smsA3DD.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\smsA3DD.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\smsA3DD.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Roaming\audiodrvs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\Documents\rar.exe N/A
Token: 33 N/A C:\Users\Admin\Documents\rar.exe N/A
Token: 34 N/A C:\Users\Admin\Documents\rar.exe N/A
Token: 35 N/A C:\Users\Admin\Documents\rar.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smsA3DD.tmp N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\audiodrvs.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\rar.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2504 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\093bc49ab25cc6a20d95155db80f1fa8.exe C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp
PID 2504 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\093bc49ab25cc6a20d95155db80f1fa8.exe C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp
PID 2504 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\093bc49ab25cc6a20d95155db80f1fa8.exe C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp
PID 2504 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\093bc49ab25cc6a20d95155db80f1fa8.exe C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp
PID 2892 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE
PID 2892 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE
PID 2892 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE
PID 2892 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE
PID 2892 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE
PID 2892 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE
PID 2892 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE
PID 2892 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE
PID 2552 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE C:\Users\Admin\AppData\Local\Temp\smsA3DD.tmp
PID 2552 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE C:\Users\Admin\AppData\Local\Temp\smsA3DD.tmp
PID 2552 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE C:\Users\Admin\AppData\Local\Temp\smsA3DD.tmp
PID 2892 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Windows\SysWOW64\notepad.exe
PID 2892 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Windows\SysWOW64\notepad.exe
PID 2892 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Windows\SysWOW64\notepad.exe
PID 2892 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Windows\SysWOW64\notepad.exe
PID 2892 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Windows\SysWOW64\notepad.exe
PID 2892 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Windows\SysWOW64\notepad.exe
PID 2892 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Windows\SysWOW64\notepad.exe
PID 2892 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Windows\SysWOW64\notepad.exe
PID 2892 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Windows\SysWOW64\notepad.exe
PID 2892 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Windows\SysWOW64\notepad.exe
PID 2892 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Windows\SysWOW64\notepad.exe
PID 2892 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Windows\SysWOW64\notepad.exe
PID 2892 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Windows\SysWOW64\notepad.exe
PID 2892 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Windows\SysWOW64\notepad.exe
PID 2892 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Windows\SysWOW64\notepad.exe
PID 2892 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Windows\SysWOW64\notepad.exe
PID 2892 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Windows\SysWOW64\notepad.exe
PID 2892 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Windows\SysWOW64\notepad.exe
PID 2892 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Users\Admin\Documents\rar.exe
PID 2892 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Users\Admin\Documents\rar.exe
PID 2892 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Users\Admin\Documents\rar.exe
PID 2892 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp C:\Users\Admin\Documents\rar.exe
PID 2792 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE
PID 2792 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE
PID 2792 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE
PID 2792 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE
PID 2836 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE C:\Windows\SysWOW64\schtasks.exe
PID 2836 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE C:\Windows\SysWOW64\schtasks.exe
PID 2836 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE C:\Windows\SysWOW64\schtasks.exe
PID 2836 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE C:\Windows\SysWOW64\schtasks.exe
PID 2964 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\smsA3DD.tmp C:\Windows\System32\schtasks.exe
PID 2964 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\smsA3DD.tmp C:\Windows\System32\schtasks.exe
PID 2964 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\smsA3DD.tmp C:\Windows\System32\schtasks.exe
PID 2964 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\smsA3DD.tmp C:\Windows\system32\cmd.exe
PID 2964 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\smsA3DD.tmp C:\Windows\system32\cmd.exe
PID 2964 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\smsA3DD.tmp C:\Windows\system32\cmd.exe
PID 2608 wrote to memory of 2924 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2608 wrote to memory of 2924 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2608 wrote to memory of 2924 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2608 wrote to memory of 2252 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\audiodrvs.exe
PID 2608 wrote to memory of 2252 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\audiodrvs.exe
PID 2608 wrote to memory of 2252 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\audiodrvs.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\093bc49ab25cc6a20d95155db80f1fa8.exe

"C:\Users\Admin\AppData\Local\Temp\093bc49ab25cc6a20d95155db80f1fa8.exe"

C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp

"C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp"

C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE

"C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE"

C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE

"C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE"

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Users\Admin\AppData\Local\Temp\smsA3DD.tmp

"C:\Users\Admin\AppData\Local\Temp\smsA3DD.tmp"

C:\Users\Admin\Documents\rar.exe

"C:\Users\Admin\Documents\rar.exe"

C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE

"C:\Users\Admin\AppData\Local\Temp\XenoManager\PRINTSERV.EXE"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "logons" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBECD.tmp" /F

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'audiodrvs"' /tr "'C:\Users\Admin\AppData\Roaming\audiodrvs.exe"'

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpF1CE.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\audiodrvs.exe

"C:\Users\Admin\AppData\Roaming\audiodrvs.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 dgorijan20785.hopto.org udp
NL 172.111.216.4:35800 dgorijan20785.hopto.org tcp
US 8.8.8.8:53 dgorijan20785.hopto.org udp
NL 172.111.216.4:4488 dgorijan20785.hopto.org tcp
NL 172.111.216.4:4488 dgorijan20785.hopto.org tcp
NL 172.111.216.4:4488 dgorijan20785.hopto.org tcp
NL 172.111.216.4:8808 dgorijan20785.hopto.org tcp

Files

memory/2504-2-0x0000000000400000-0x00000000007956B4-memory.dmp

memory/2504-1-0x00000000006BD000-0x00000000006BE000-memory.dmp

memory/2504-4-0x0000000000400000-0x00000000007956B4-memory.dmp

memory/2504-3-0x0000000000400000-0x00000000007956B4-memory.dmp

memory/2504-0-0x0000000000400000-0x00000000007956B4-memory.dmp

memory/2504-5-0x0000000000400000-0x00000000007956B4-memory.dmp

memory/2504-6-0x0000000000400000-0x00000000007956B4-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sms9DB6.tmp

MD5 89feeb6ec82c704b1771bfa2536bd401
SHA1 2ae958b6e74986696e412e313b5f0aee3756ba19
SHA256 9765068707da158f492b48d5628b3b6cc93dc34dd402d57c0b4ced60701e0b9a
SHA512 9ef8c9c1c9795cf4451dd577c2292171c7dccb9aa24447dff72de9e886e604638b32f637ba8e19cfc86c377fed7a97c56336a62f7edd6130d4a8b928f5bf0484

memory/2892-13-0x0000000000400000-0x000000000055B000-memory.dmp

memory/2892-14-0x0000000000400000-0x000000000055B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CHROMEL.EXE

MD5 f6062ddb9cc2fad6e403b8b9dbe02df7
SHA1 efebcabb3902cdcc7b789786d96db2a93156b81a
SHA256 61309415bb524bba3d6065cf5df5ce2031ddde239c7f7864d0d2eaf31597a96c
SHA512 3d2473fd09d5d0a4a0f463ed84522165254880a6f94491b5c9a21fbbd39df4579980184fd838f75b3ad6457065c818c536447ae18c97eac29146cd8be5883040

C:\Users\Admin\AppData\Local\Temp\PRINTSERV.EXE

MD5 b8eaef2339ba6bfac3648df30d041a95
SHA1 0833419f0da847383c0031611c69a87baa8f2d6d
SHA256 6ce2b4a0e176126f0899223eace35c31b544e46a2067b0ecf0adf8d06f87309d
SHA512 c265a39039c9dd8237fb10c26066ff7247babc727a556919f7673311dee1d38c3a52a2cf83e54f148401b984495b4e5636b8254388376e96f0a4e9a40cba6613

memory/2552-38-0x0000000000400000-0x00000000004E05B0-memory.dmp

memory/2892-37-0x0000000003500000-0x00000000035E1000-memory.dmp

memory/2892-35-0x0000000003500000-0x00000000035E1000-memory.dmp

memory/2432-70-0x0000000000150000-0x0000000000151000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\smsA3DD.tmp

MD5 194de251c043183099b2d6f7f5d1e09f
SHA1 dc477dfc0e090e8d7bd31fb808f59060dd2cf360
SHA256 12bee16f9692cb9a6d3713543cf998a4f953d0341f4e9c661748faef525d91e6
SHA512 6a1433b9bc070f18f60c3f115a1173e8979d211f6e97daf3fc7fe13f05ab15123874919418fc014fdd8af62c82426cb091b867b36a49fe7fc8fe929709b3a433

memory/2432-41-0x0000000000080000-0x0000000000081000-memory.dmp

memory/2792-73-0x0000000000C70000-0x0000000000CDE000-memory.dmp

memory/2964-72-0x0000000000B70000-0x0000000000B82000-memory.dmp

memory/2892-83-0x0000000005200000-0x000000000535B000-memory.dmp

memory/2892-82-0x0000000005200000-0x000000000535B000-memory.dmp

memory/2404-85-0x0000000000400000-0x000000000055B000-memory.dmp

memory/2792-86-0x0000000000470000-0x0000000000476000-memory.dmp

memory/2836-94-0x0000000001140000-0x00000000011AE000-memory.dmp

memory/2892-96-0x0000000000400000-0x000000000055B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpBECD.tmp

MD5 db5e3f14b64ed69affa1389010cd445e
SHA1 752719617c787dbb741cfd4e8a608dd2f578d4c9
SHA256 eaeea05441cdf6ec90fd034de26b0108920f2d625f308497ebe7c05be8b69cc4
SHA512 8ee07a3e1684fb72852ad954b985db0d5a3931be5037a1fa8cb62677401d52042d80a80f27e1692edfef1d9f15b1d0cb8b8633b0414727cd775b04c4bb5e7fa9

memory/2552-101-0x0000000000400000-0x00000000004E05B0-memory.dmp

memory/2404-102-0x0000000000400000-0x000000000055B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpF1CE.tmp.bat

MD5 f0ba6e0e38087415cf4ae81474fdb8cb
SHA1 439e0b0f7d3ae293e851acf870ca4b86ac65d30e
SHA256 ddb9dfd387d76bba5f949f6a5bb3872c374272daa5290446861f62070e01a4e2
SHA512 13f059f89c6456c61391034d435887e63aa63022a539d3e03b712a4d9a3292ece566ab4c0fa13f4d5a1d27c401566e875d66641fda46f2db5ab3a681d5ba3678

memory/2404-113-0x0000000000400000-0x000000000055B000-memory.dmp

C:\Users\Admin\AppData\Roaming\audiodrvs.exe

MD5 acdb5067fdd132a6cf0ec2fbb9d763dc
SHA1 10f4d475c35b3b896d2b078f074ca604b4bd56bc
SHA256 01b1c5f6aba65008545ab3f9dc5aa90225299211823a2ec86a1377e7f1612eee
SHA512 701678d672920fd5983e426ec4a98656240f26174faa7750db67a53e8fe51c8fa2ae3d39ecd6e3de662c3aca27c8634a8384e0c1e02322db9aefed6221177f19

memory/2252-117-0x0000000000300000-0x0000000000312000-memory.dmp

memory/2404-118-0x0000000000400000-0x000000000055B000-memory.dmp