Overview

overview

10

Static

static

3

Comet.exe

windows7-x64

10

Comet.exe

windows10-2004-x64

10

Resubmissions

26-12-2024 10:52

241226-myqcmatlhx 10

26-12-2024 10:39

241226-mp9pxatjfz 10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-12-2024 10:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Comet.exe

  • Size

    8.6MB

  • MD5

    1f5d19397b48172aba35885f39e318fa

  • SHA1

    df77020bffc62f386b5ce0ad0cde3d8f8b704b93

  • SHA256

    dd780875686be33910002f91aaeb8f8ec70a2f3972c41c707a59ef18cd900e74

  • SHA512

    4ccec7c602582d467a63e8f6e8fc222e73bb88a589256fac0577452b6ffaaec58adf2b5e216f8a27404c4717a74f239ce73226385133764b75baa775b25de4a0

  • SSDEEP

    196608:u9+8ZspGS5puzUZqVBU6NABaScfR3xeUDyzfS/FNgeLCtNP:u9+EEp5ZqPBOhcftAUDyzqNutNP

Score
10/10
skuldpersistencestealer

Malware Config

Extracted

Family

skuld

C2

https://discord.com/api/webhooks/1320235014511792160/59qb1BvUIDJlYJZoQnnxe4CNf8Swi8--Nwm7q4BECFectFCCJWiM-H8Ng2tA4-dl6Vyb

Signatures

  • Skuld family
    skuld
  • Skuld stealer

    An info stealer written in Go lang.

    stealerskuld
  • Checks computer location settings 2 TTPs 48 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 48 IoCs
  • Adds Run key to start application 2 TTPs 37 IoCs
    persistence
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 50 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Comet.exe
    "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4052
    • C:\Users\Admin\AppData\Local\Temp\Comet.exe
      "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4212
      • C:\Users\Admin\AppData\Local\Temp\Comet.exe
        "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
        3⤵
        • Checks computer location settings
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3312
        • C:\Users\Admin\AppData\Local\Temp\Comet.exe
          "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
          4⤵
          • Checks computer location settings
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2900
          • C:\Users\Admin\AppData\Local\Temp\Comet.exe
            "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
            5⤵
            • Checks computer location settings
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3016
            • C:\Users\Admin\AppData\Local\Temp\Comet.exe
              "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
              6⤵
              • Checks computer location settings
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2792
              • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                7⤵
                • Checks computer location settings
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4328
                • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                  "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                  8⤵
                  • Checks computer location settings
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2596
                  • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                    "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                    9⤵
                    • Checks computer location settings
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:692
                    • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                      "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                      10⤵
                      • Checks computer location settings
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:3532
                      • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                        "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                        11⤵
                        • Checks computer location settings
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:3192
                        • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                          "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                          12⤵
                          • Checks computer location settings
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2176
                          • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                            "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                            13⤵
                            • Checks computer location settings
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1868
                            • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                              "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                              14⤵
                              • Checks computer location settings
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2120
                              • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                15⤵
                                • Checks computer location settings
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1068
                                • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                  16⤵
                                  • Checks computer location settings
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1128
                                  • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                    17⤵
                                    • Checks computer location settings
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2796
                                    • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                      "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                      18⤵
                                      • Checks computer location settings
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4324
                                      • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                        19⤵
                                        • Checks computer location settings
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:944
                                        • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                          20⤵
                                          • Checks computer location settings
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4028
                                          • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                            21⤵
                                            • Checks computer location settings
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2236
                                            • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                              22⤵
                                              • Checks computer location settings
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:5004
                                              • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                                23⤵
                                                • Checks computer location settings
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:3620
                                                • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                                  24⤵
                                                  • Checks computer location settings
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:3208
                                                  • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                                    25⤵
                                                    • Checks computer location settings
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:2312
                                                    • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                                      26⤵
                                                      • Checks computer location settings
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2100
                                                      • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                                        27⤵
                                                        • Checks computer location settings
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1540
                                                        • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                                          28⤵
                                                          • Checks computer location settings
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4212
                                                          • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                                            29⤵
                                                            • Checks computer location settings
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2884
                                                            • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                                              30⤵
                                                              • Checks computer location settings
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:3812
                                                              • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                                                31⤵
                                                                • Checks computer location settings
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:1632
                                                                • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                                                  32⤵
                                                                  • Checks computer location settings
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:1160
                                                                  • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                                                    33⤵
                                                                    • Checks computer location settings
                                                                    PID:1804
                                                                    • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                                                      34⤵
                                                                      • Checks computer location settings
                                                                      PID:4336
                                                                      • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                                                        35⤵
                                                                        • Checks computer location settings
                                                                        PID:3020
                                                                        • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                                                          36⤵
                                                                          • Checks computer location settings
                                                                          PID:4980
                                                                          • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                                                            37⤵
                                                                            • Checks computer location settings
                                                                            PID:1928
                                                                            • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                                                              38⤵
                                                                              • Checks computer location settings
                                                                              PID:508
                                                                              • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                                                                39⤵
                                                                                • Checks computer location settings
                                                                                PID:512
                                                                                • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                                                                  40⤵
                                                                                  • Checks computer location settings
                                                                                  PID:4472
                                                                                  • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                                                                    41⤵
                                                                                    • Checks computer location settings
                                                                                    PID:1660
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                                                                      42⤵
                                                                                      • Checks computer location settings
                                                                                      PID:4240
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                                                                        43⤵
                                                                                        • Checks computer location settings
                                                                                        PID:4948
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                                                                          44⤵
                                                                                          • Checks computer location settings
                                                                                          PID:3088
                                                                                          • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                                                                            45⤵
                                                                                            • Checks computer location settings
                                                                                            PID:2236
                                                                                            • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                                                                              46⤵
                                                                                              • Checks computer location settings
                                                                                              PID:2884
                                                                                              • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                                                                                47⤵
                                                                                                • Checks computer location settings
                                                                                                PID:4644
                                                                                                • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                                                                                  48⤵
                                                                                                  • Checks computer location settings
                                                                                                  PID:4112
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Comet.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Comet.exe"
                                                                                                    49⤵
                                                                                                      PID:3236
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                                                                                      49⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:1288
                                                                                                      • C:\Windows\system32\attrib.exe
                                                                                                        attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                                                        50⤵
                                                                                                        • Views/modifies file attributes
                                                                                                        PID:3524
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                                                                                    48⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Adds Run key to start application
                                                                                                    PID:1676
                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                      attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                                                      49⤵
                                                                                                      • Views/modifies file attributes
                                                                                                      PID:4116
                                                                                                • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                                                                                  47⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:2672
                                                                                                  • C:\Windows\system32\attrib.exe
                                                                                                    attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                                                    48⤵
                                                                                                    • Views/modifies file attributes
                                                                                                    PID:2304
                                                                                              • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                                                                                46⤵
                                                                                                • Executes dropped EXE
                                                                                                • Adds Run key to start application
                                                                                                PID:1300
                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                  attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                                                  47⤵
                                                                                                  • Views/modifies file attributes
                                                                                                  PID:3452
                                                                                            • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                                                                              45⤵
                                                                                              • Executes dropped EXE
                                                                                              • Adds Run key to start application
                                                                                              PID:4044
                                                                                              • C:\Windows\system32\attrib.exe
                                                                                                attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                                                46⤵
                                                                                                • Views/modifies file attributes
                                                                                                PID:5004
                                                                                          • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                                                                            44⤵
                                                                                            • Executes dropped EXE
                                                                                            • Adds Run key to start application
                                                                                            PID:224
                                                                                            • C:\Windows\system32\attrib.exe
                                                                                              attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                                              45⤵
                                                                                              • Views/modifies file attributes
                                                                                              PID:1856
                                                                                        • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                                                                          43⤵
                                                                                          • Executes dropped EXE
                                                                                          • Adds Run key to start application
                                                                                          PID:2632
                                                                                          • C:\Windows\system32\attrib.exe
                                                                                            attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                                            44⤵
                                                                                            • Views/modifies file attributes
                                                                                            PID:4328
                                                                                      • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                                                                        42⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:3408
                                                                                        • C:\Windows\system32\attrib.exe
                                                                                          attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                                          43⤵
                                                                                          • Views/modifies file attributes
                                                                                          PID:4208
                                                                                    • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                                                                      41⤵
                                                                                      • Executes dropped EXE
                                                                                      • Adds Run key to start application
                                                                                      PID:1388
                                                                                      • C:\Windows\system32\attrib.exe
                                                                                        attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                                        42⤵
                                                                                        • Views/modifies file attributes
                                                                                        PID:1684
                                                                                  • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                                                                    40⤵
                                                                                    • Executes dropped EXE
                                                                                    • Adds Run key to start application
                                                                                    PID:1296
                                                                                    • C:\Windows\system32\attrib.exe
                                                                                      attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                                      41⤵
                                                                                      • Views/modifies file attributes
                                                                                      PID:1632
                                                                                • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                                                                  39⤵
                                                                                  • Executes dropped EXE
                                                                                  • Adds Run key to start application
                                                                                  PID:3868
                                                                                  • C:\Windows\system32\attrib.exe
                                                                                    attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                                    40⤵
                                                                                    • Views/modifies file attributes
                                                                                    PID:1144
                                                                              • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                                                                38⤵
                                                                                • Executes dropped EXE
                                                                                • Adds Run key to start application
                                                                                PID:1260
                                                                                • C:\Windows\system32\attrib.exe
                                                                                  attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                                  39⤵
                                                                                  • Views/modifies file attributes
                                                                                  PID:2216
                                                                            • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                                                              37⤵
                                                                              • Executes dropped EXE
                                                                              • Adds Run key to start application
                                                                              PID:888
                                                                              • C:\Windows\system32\attrib.exe
                                                                                attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                                38⤵
                                                                                • Views/modifies file attributes
                                                                                PID:4032
                                                                          • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                                                            36⤵
                                                                            • Executes dropped EXE
                                                                            PID:2128
                                                                            • C:\Windows\system32\attrib.exe
                                                                              attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                              37⤵
                                                                              • Views/modifies file attributes
                                                                              PID:2032
                                                                        • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                                                          35⤵
                                                                          • Executes dropped EXE
                                                                          • Adds Run key to start application
                                                                          PID:2108
                                                                          • C:\Windows\system32\attrib.exe
                                                                            attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                            36⤵
                                                                            • Views/modifies file attributes
                                                                            PID:4372
                                                                      • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                                                        34⤵
                                                                        • Executes dropped EXE
                                                                        • Adds Run key to start application
                                                                        PID:264
                                                                        • C:\Windows\system32\attrib.exe
                                                                          attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                          35⤵
                                                                          • Views/modifies file attributes
                                                                          PID:3656
                                                                        • C:\Windows\system32\attrib.exe
                                                                          attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
                                                                          35⤵
                                                                          • Views/modifies file attributes
                                                                          PID:880
                                                                    • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                                                      33⤵
                                                                      • Executes dropped EXE
                                                                      • Adds Run key to start application
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:2560
                                                                      • C:\Windows\system32\attrib.exe
                                                                        attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                        34⤵
                                                                        • Views/modifies file attributes
                                                                        PID:4312
                                                                  • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                                                    32⤵
                                                                    • Executes dropped EXE
                                                                    • Adds Run key to start application
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:2600
                                                                    • C:\Windows\system32\attrib.exe
                                                                      attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                      33⤵
                                                                      • Views/modifies file attributes
                                                                      PID:864
                                                                • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                                                  31⤵
                                                                  • Executes dropped EXE
                                                                  • Adds Run key to start application
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:3704
                                                                  • C:\Windows\system32\attrib.exe
                                                                    attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                    32⤵
                                                                    • Views/modifies file attributes
                                                                    PID:4440
                                                              • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                                                30⤵
                                                                • Executes dropped EXE
                                                                • Adds Run key to start application
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:1068
                                                                • C:\Windows\system32\attrib.exe
                                                                  attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                  31⤵
                                                                  • Views/modifies file attributes
                                                                  PID:4564
                                                            • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                                              29⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4076
                                                              • C:\Windows\system32\attrib.exe
                                                                attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                                30⤵
                                                                • Views/modifies file attributes
                                                                PID:2180
                                                          • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                                            28⤵
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:4736
                                                            • C:\Windows\system32\attrib.exe
                                                              attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                              29⤵
                                                              • Views/modifies file attributes
                                                              PID:4516
                                                        • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                                          27⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4468
                                                          • C:\Windows\system32\attrib.exe
                                                            attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                            28⤵
                                                            • Views/modifies file attributes
                                                            PID:4696
                                                      • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                                        26⤵
                                                        • Executes dropped EXE
                                                        • Adds Run key to start application
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1092
                                                        • C:\Windows\system32\attrib.exe
                                                          attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                          27⤵
                                                          • Views/modifies file attributes
                                                          PID:1668
                                                    • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                                      25⤵
                                                      • Executes dropped EXE
                                                      • Adds Run key to start application
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:3060
                                                      • C:\Windows\system32\attrib.exe
                                                        attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                        26⤵
                                                        • Views/modifies file attributes
                                                        PID:4904
                                                  • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                                    24⤵
                                                    • Executes dropped EXE
                                                    • Adds Run key to start application
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:816
                                                    • C:\Windows\system32\attrib.exe
                                                      attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                      25⤵
                                                      • Views/modifies file attributes
                                                      PID:4440
                                                • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                                  23⤵
                                                  • Executes dropped EXE
                                                  • Adds Run key to start application
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2672
                                                  • C:\Windows\system32\attrib.exe
                                                    attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                    24⤵
                                                    • Views/modifies file attributes
                                                    PID:2300
                                              • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                                22⤵
                                                • Executes dropped EXE
                                                • Adds Run key to start application
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1824
                                                • C:\Windows\system32\attrib.exe
                                                  attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                  23⤵
                                                  • Views/modifies file attributes
                                                  PID:2988
                                            • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                              "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                              21⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2052
                                              • C:\Windows\system32\attrib.exe
                                                attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                                22⤵
                                                • Views/modifies file attributes
                                                PID:1060
                                          • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                            "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                            20⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2616
                                            • C:\Windows\system32\attrib.exe
                                              attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                              21⤵
                                              • Views/modifies file attributes
                                              PID:1360
                                        • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                          "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                          19⤵
                                          • Executes dropped EXE
                                          • Adds Run key to start application
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1844
                                          • C:\Windows\system32\attrib.exe
                                            attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                            20⤵
                                            • Views/modifies file attributes
                                            PID:4928
                                      • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                        "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                        18⤵
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2528
                                        • C:\Windows\system32\attrib.exe
                                          attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                          19⤵
                                          • Views/modifies file attributes
                                          PID:4796
                                    • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                      "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                      17⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3968
                                      • C:\Windows\system32\attrib.exe
                                        attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                        18⤵
                                        • Views/modifies file attributes
                                        PID:4396
                                  • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                    "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                    16⤵
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1140
                                    • C:\Windows\system32\attrib.exe
                                      attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                      17⤵
                                      • Views/modifies file attributes
                                      PID:3688
                                • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                  "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                  15⤵
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2180
                                  • C:\Windows\system32\attrib.exe
                                    attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                    16⤵
                                    • Views/modifies file attributes
                                    PID:4072
                              • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                                14⤵
                                • Executes dropped EXE
                                • Adds Run key to start application
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4444
                                • C:\Windows\system32\attrib.exe
                                  attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                  15⤵
                                  • Views/modifies file attributes
                                  PID:2236
                                • C:\Windows\system32\attrib.exe
                                  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
                                  15⤵
                                  • Views/modifies file attributes
                                  PID:436
                            • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                              "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                              13⤵
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4468
                              • C:\Windows\system32\attrib.exe
                                attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                                14⤵
                                • Views/modifies file attributes
                                PID:4208
                          • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                            "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                            12⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4236
                            • C:\Windows\system32\attrib.exe
                              attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                              13⤵
                              • Views/modifies file attributes
                              PID:1188
                        • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                          "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                          11⤵
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:5068
                          • C:\Windows\system32\attrib.exe
                            attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                            12⤵
                            • Views/modifies file attributes
                            PID:624
                      • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                        "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                        10⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:4560
                        • C:\Windows\system32\attrib.exe
                          attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                          11⤵
                          • Views/modifies file attributes
                          PID:2860
                    • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                      "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                      9⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:2320
                      • C:\Windows\system32\attrib.exe
                        attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                        10⤵
                        • Views/modifies file attributes
                        PID:1292
                  • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                    "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                    8⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:1780
                    • C:\Windows\system32\attrib.exe
                      attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                      9⤵
                      • Views/modifies file attributes
                      PID:2744
                • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                  "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:640
                  • C:\Windows\system32\attrib.exe
                    attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                    8⤵
                    • Views/modifies file attributes
                    PID:396
              • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
                6⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2380
                • C:\Windows\system32\attrib.exe
                  attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                  7⤵
                  • Views/modifies file attributes
                  PID:552
            • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
              "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3452
              • C:\Windows\system32\attrib.exe
                attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
                6⤵
                • Views/modifies file attributes
                PID:1984
          • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
            "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4032
            • C:\Windows\system32\attrib.exe
              attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
              5⤵
              • Views/modifies file attributes
              PID:3640
        • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
          "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2016
          • C:\Windows\system32\attrib.exe
            attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
            4⤵
            • Views/modifies file attributes
            PID:1840
      • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
        "C:\Users\Admin\AppData\Local\Temp\deltadll.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:392
        • C:\Windows\system32\attrib.exe
          attrib +h +s C:\Users\Admin\AppData\Local\Temp\deltadll.exe
          3⤵
          • Views/modifies file attributes
          PID:1408

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Comet.exe.log
      Filesize

      1KB

      MD5

      bb6a89a9355baba2918bb7c32eca1c94

      SHA1

      976c76dfbc072e405ce0d0b9314fe5b9e84cb1b2

      SHA256

      192fbb7f4d1396fd4846854c5472a60aa80932f3c754f2c2f1a2a136c8a6bb4b

      SHA512

      efdf0c6228c3a8a7550804ac921dfefc5265eb2c9bbf4b8b00cedd427c0a5adf610586b844ff444bd717abff138affcbe49632ce984cbffc5fa8019b4ba6ec0f

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\deltadll.exe
      Filesize

      14.8MB

      MD5

      19c446f51d203d1fb7eb23210709417b

      SHA1

      6e33b8d13d1539630615e581e5ab03de371c0dc6

      SHA256

      b67cae29bac60920b3edc02081da697c4c6486411c1bc77f29b68cb1f23e3ffc

      SHA512

      9d8601a0c2e090cd5fc6315c1671d669cd6a6bf20d3ef24cb1a111e344464913fe809c9b27d32608b93b988a37e59c90086ccf68545ce385ef58f96365a439df

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
      Filesize

      1.2MB

      MD5

      408107474cd8264197fe0d31feb6d160

      SHA1

      b8895ecefe1db6c5f28712087f5e0f4b4733e99a

      SHA256

      fddd88dd6dd304ad01f7e275b2cd9419ecc2922649336792d94b7b6d45e03530

      SHA512

      78626765926193b523fd8c6f0de6cb27d961345847c1a9e65d026304278074a31a8d38f56fc7cc6df0d3ece4784ecc8c7d8e9370ddd55240cbb0d06b26698ed6

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
      Filesize

      12.0MB

      MD5

      040489e917e32fd64eabdf79ac11f3f2

      SHA1

      6462893d570193b1380110d9c5206cd4b10a655d

      SHA256

      b9fd7181ca393876fae2e36b519c1ca1c2242a48569d55fbc78fd3f7245d6655

      SHA512

      c2088fc2e7440b11577f3d04d09de52cc3f0fb639abdf95f61b10e470804002ce7cef4d60a91dc937043f1f425d95ce5d4983cbf859ff94857326e44bb29225e

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
      Filesize

      6.0MB

      MD5

      48a63b8466c2d03c7fc8d8664d8878ed

      SHA1

      e50b2eaf4b1ca05ea7be7e2d203528eb413bcd24

      SHA256

      a145db810e172f1a367fe2a34d0ede86bd538bd5bbdbc551a272b0e1080c3d97

      SHA512

      9c373f8654a17782e3151ebbe5372f43c59a59a0da884b5f2a29d48b288202863b3db91cf8aaa0314a315c511ce1fdc9fa99cd796aa8e44f04d8bc6b1aca47a2

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
      Filesize

      11.3MB

      MD5

      ec108d408f3b1471b835b67c8c6a08bd

      SHA1

      3b77b1f9ab41ccd53164986c7ab23e908f297309

      SHA256

      412772279b11064ac24c1c90c31542e6a8134555e70610ae5ccc75915b44245a

      SHA512

      f22220fd688e8cb1c52d6d87d42f25ad38e3078ba7b385b0de4564fcf0464c4607e4b63d3db6576290ae4d4a0361e80ce7bc92b2e4f7c465abe19092c2be7a6a

      Download Submit

    • memory/4052-1-0x0000000000B50000-0x00000000013FA000-memory.dmp

      Filesize

      8.7MB

      Download

    • memory/4052-2-0x00007FFBC2930000-0x00007FFBC33F1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4052-0-0x00007FFBC2933000-0x00007FFBC2935000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4052-12-0x00007FFBC2930000-0x00007FFBC33F1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4212-3-0x00007FFBC2930000-0x00007FFBC33F1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4212-17-0x00007FFBC2930000-0x00007FFBC33F1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4212-14-0x00007FFBC2930000-0x00007FFBC33F1000-memory.dmp

      Filesize

      10.8MB

      Download