Malware Analysis Report

2025-04-13 23:11

Sample ID 240723-b4jaqa1bpr
Target b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b
SHA256 b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b
Tags
darkcomet persistence rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b

Threat Level: Known bad

The file b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b was found to be: Known bad.

Malicious Activity Summary

darkcomet persistence rat trojan upx

Darkcomet

UPX packed file

Checks BIOS information in registry

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

Enumerates system info in registry

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-23 01:41

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-23 01:41

Reported

2024-07-23 01:44

Platform

win7-20240708-en

Max time kernel

149s

Max time network

17s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe"

Signatures

Darkcomet

trojan rat darkcomet

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Roaming\mcsft.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2892 set thread context of 2004 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Roaming\mcsft.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Users\Admin\AppData\Roaming\mcsft.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2024 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe C:\Windows\SysWOW64\cmd.exe
PID 2024 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe C:\Windows\SysWOW64\cmd.exe
PID 2024 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe C:\Windows\SysWOW64\cmd.exe
PID 2024 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe C:\Windows\SysWOW64\cmd.exe
PID 1912 wrote to memory of 2904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1912 wrote to memory of 2904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1912 wrote to memory of 2904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1912 wrote to memory of 2904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2024 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 2024 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 2024 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 2024 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 2892 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 2892 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 2892 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 2892 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 2892 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 2892 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 2892 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 2892 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 2892 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe

"C:\Users\Admin\AppData\Local\Temp\b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\EpSbN.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f

C:\Users\Admin\AppData\Roaming\mcsft.exe

"C:\Users\Admin\AppData\Roaming\mcsft.exe"

C:\Users\Admin\AppData\Roaming\mcsft.exe

C:\Users\Admin\AppData\Roaming\mcsft.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 letsgoboom.no-ip.info udp

Files

memory/2024-0-0x0000000000400000-0x00000000007C5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\EpSbN.bat

MD5 a5feca573884d76f559b996d45e8ad9a
SHA1 0e81a993f3af4e31d60653dc2513186f0495f1c8
SHA256 c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f
SHA512 a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda

C:\Users\Admin\AppData\Roaming\mcsft.exe

MD5 3a013036e8780cdfe62bedee0f45f492
SHA1 b929242e7c02fee00f5349382ef5eb1afce1478c
SHA256 23b76a26183a695188f5a992aa9a83c06265660949a64d5334c7ad8cb1e014fb
SHA512 2a3523c035040cac9a727aa3a9bf7ae3ff4709f6e0b42f748ed2b817cb651394ca432a6ab77b19653c5c9f530e2797335430ef26a23f940a1481d067e8c3a274

memory/2004-51-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2004-50-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2004-48-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2004-52-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2004-54-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2004-53-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2004-55-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2004-58-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2004-57-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2004-56-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2004-59-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2004-60-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2004-61-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2004-62-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2004-63-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2004-64-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2004-65-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2004-66-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2004-67-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2004-68-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2004-69-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2004-70-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2004-71-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2004-72-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2004-73-0x0000000000400000-0x00000000004B5000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-23 01:41

Reported

2024-07-23 01:44

Platform

win10v2004-20240709-en

Max time kernel

150s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe"

Signatures

Darkcomet

trojan rat darkcomet

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Roaming\mcsft.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4536 set thread context of 3916 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Roaming\mcsft.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Users\Admin\AppData\Roaming\mcsft.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4916 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe C:\Windows\SysWOW64\cmd.exe
PID 4916 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe C:\Windows\SysWOW64\cmd.exe
PID 4916 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe C:\Windows\SysWOW64\cmd.exe
PID 2348 wrote to memory of 1284 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2348 wrote to memory of 1284 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2348 wrote to memory of 1284 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4916 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 4916 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 4916 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 4536 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 4536 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 4536 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 4536 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 4536 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 4536 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 4536 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 4536 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe

"C:\Users\Admin\AppData\Local\Temp\b2033ef6c4b6f6b580c24092bd483c80caae2d6efb658318a596db082d81427b.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pored.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f

C:\Users\Admin\AppData\Roaming\mcsft.exe

"C:\Users\Admin\AppData\Roaming\mcsft.exe"

C:\Users\Admin\AppData\Roaming\mcsft.exe

C:\Users\Admin\AppData\Roaming\mcsft.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 letsgoboom.no-ip.info udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 letsgoboom.no-ip.info udp
US 8.8.8.8:53 letsgoboom.no-ip.info udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 letsgoboom.no-ip.info udp
US 8.8.8.8:53 letsgoboom.no-ip.info udp
US 8.8.8.8:53 letsgoboom.no-ip.info udp
US 8.8.8.8:53 letsgoboom.no-ip.info udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 letsgoboom.no-ip.info udp
US 8.8.8.8:53 letsgoboom.no-ip.info udp
US 8.8.8.8:53 letsgoboom.no-ip.info udp
US 8.8.8.8:53 letsgoboom.no-ip.info udp
US 8.8.8.8:53 letsgoboom.no-ip.info udp
US 8.8.8.8:53 letsgoboom.no-ip.info udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 letsgoboom.no-ip.info udp
US 8.8.8.8:53 letsgoboom.no-ip.info udp
US 8.8.8.8:53 letsgoboom.no-ip.info udp
US 8.8.8.8:53 letsgoboom.no-ip.info udp
US 8.8.8.8:53 letsgoboom.no-ip.info udp
US 8.8.8.8:53 letsgoboom.no-ip.info udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 letsgoboom.no-ip.info udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 letsgoboom.no-ip.info udp
US 8.8.8.8:53 letsgoboom.no-ip.info udp
US 8.8.8.8:53 letsgoboom.no-ip.info udp
US 8.8.8.8:53 letsgoboom.no-ip.info udp
US 8.8.8.8:53 letsgoboom.no-ip.info udp
US 8.8.8.8:53 letsgoboom.no-ip.info udp
US 8.8.8.8:53 letsgoboom.no-ip.info udp
US 8.8.8.8:53 letsgoboom.no-ip.info udp
US 8.8.8.8:53 letsgoboom.no-ip.info udp
US 8.8.8.8:53 letsgoboom.no-ip.info udp

Files

memory/4916-0-0x0000000000400000-0x00000000007C5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\pored.txt

MD5 a5feca573884d76f559b996d45e8ad9a
SHA1 0e81a993f3af4e31d60653dc2513186f0495f1c8
SHA256 c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f
SHA512 a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda

C:\Users\Admin\AppData\Roaming\mcsft.txt

MD5 cd8cba2a8090011010c7be6de55a1f69
SHA1 c85b0a2a253949cfef78e1bd62c6eb1538335990
SHA256 daa10f2edddedf6f98950831dde48f87f6dbdcee17266936eebb104dad735c0c
SHA512 875806fed0e4203941e3b0edf380b3edfadeb2452367d8d6747975110607769df3e6553e70c7a1c3291763b72585a811c9c6bf4e57880fd0142611db1692499f

memory/3916-33-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/3916-31-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/3916-34-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/3916-35-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/3916-36-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/3916-40-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/3916-39-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/3916-38-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/3916-37-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/3916-41-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/3916-42-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/3916-43-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/3916-44-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/3916-45-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/3916-46-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/3916-47-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/3916-48-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/3916-49-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/3916-50-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/3916-51-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/3916-52-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/3916-53-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/3916-54-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/3916-55-0x0000000000400000-0x00000000004B5000-memory.dmp