Malware Analysis Report

2025-08-05 09:06

Sample ID 241230-wdej3a1qgj
Target 5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe
SHA256 5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99
Tags
upx darkcomet discovery persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99

Threat Level: Known bad

The file 5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe was found to be: Known bad.

Malicious Activity Summary

upx darkcomet discovery persistence rat trojan

Darkcomet

Darkcomet family

Checks computer location settings

Loads dropped DLL

Checks BIOS information in registry

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

UPX packed file

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Enumerates system info in registry

Checks processor information in registry

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-30 17:48

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-30 17:48

Reported

2024-12-30 17:50

Platform

win7-20241010-en

Max time kernel

112s

Max time network

114s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe"

Signatures

Darkcomet

trojan rat darkcomet

Darkcomet family

darkcomet

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Roaming\mcsft.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2484 set thread context of 2852 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\mcsft.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Roaming\mcsft.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Users\Admin\AppData\Roaming\mcsft.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1740 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe C:\Windows\SysWOW64\cmd.exe
PID 1740 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe C:\Windows\SysWOW64\cmd.exe
PID 1740 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe C:\Windows\SysWOW64\cmd.exe
PID 1740 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 1696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2128 wrote to memory of 1696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2128 wrote to memory of 1696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2128 wrote to memory of 1696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1740 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 1740 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 1740 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 1740 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 2484 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 2484 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 2484 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 2484 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 2484 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 2484 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 2484 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 2484 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 2484 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe

"C:\Users\Admin\AppData\Local\Temp\5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\HfBuw.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f

C:\Users\Admin\AppData\Roaming\mcsft.exe

"C:\Users\Admin\AppData\Roaming\mcsft.exe"

C:\Users\Admin\AppData\Roaming\mcsft.exe

C:\Users\Admin\AppData\Roaming\mcsft.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 ygo.no-ip.info udp
ES 94.73.33.36:1604 ygo.no-ip.info tcp
ES 94.73.33.36:1604 ygo.no-ip.info tcp
ES 94.73.33.36:1604 ygo.no-ip.info tcp
US 8.8.8.8:53 ygo.no-ip.info udp
ES 94.73.33.36:1604 ygo.no-ip.info tcp
ES 94.73.33.36:1604 ygo.no-ip.info tcp
ES 94.73.33.36:1604 ygo.no-ip.info tcp

Files

memory/1740-0-0x0000000000400000-0x00000000007C8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HfBuw.bat

MD5 a5feca573884d76f559b996d45e8ad9a
SHA1 0e81a993f3af4e31d60653dc2513186f0495f1c8
SHA256 c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f
SHA512 a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda

C:\Users\Admin\AppData\Roaming\mcsft.exe

MD5 f0f1fcf59193219a7594888080512109
SHA1 51b7587914aba8d772af549439d9e02d2d37c9ce
SHA256 67509ad290bd74e5851ddefdf35e62d8f6a4f6c08baa46f709d636d49b342f2a
SHA512 b3cfc73ce25f9246edae71169b9371f19f5a9996767fe8976d294746e3ba22a76aabf42518ca7fa2b3a58750cba4afd74a451825707d5a59ee5eed031662f856

memory/1740-45-0x00000000039D0000-0x0000000003D98000-memory.dmp

memory/1740-44-0x00000000039D0000-0x0000000003D98000-memory.dmp

memory/1740-43-0x00000000039D0000-0x0000000003D98000-memory.dmp

memory/1740-42-0x00000000039D0000-0x0000000003D98000-memory.dmp

memory/2484-47-0x0000000000400000-0x00000000007C8000-memory.dmp

memory/1740-49-0x0000000000400000-0x00000000007C8000-memory.dmp

memory/2852-54-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2852-56-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2852-57-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2484-59-0x0000000000400000-0x00000000007C8000-memory.dmp

memory/2852-60-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2852-62-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2852-63-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2852-61-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2852-66-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2852-65-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2852-64-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2852-67-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2852-70-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2852-72-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2852-74-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2852-76-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/2852-78-0x0000000000400000-0x00000000004B5000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-30 17:48

Reported

2024-12-30 17:50

Platform

win10v2004-20241007-en

Max time kernel

111s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe"

Signatures

Darkcomet

trojan rat darkcomet

Darkcomet family

darkcomet

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Roaming\mcsft.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4944 set thread context of 4824 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\mcsft.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Roaming\mcsft.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Users\Admin\AppData\Roaming\mcsft.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4488 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe C:\Windows\SysWOW64\cmd.exe
PID 4488 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe C:\Windows\SysWOW64\cmd.exe
PID 4488 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe C:\Windows\SysWOW64\cmd.exe
PID 4976 wrote to memory of 5008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4976 wrote to memory of 5008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4976 wrote to memory of 5008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4488 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 4488 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 4488 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 4944 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 4944 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 4944 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 4944 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 4944 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 4944 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 4944 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe
PID 4944 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Roaming\mcsft.exe C:\Users\Admin\AppData\Roaming\mcsft.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe

"C:\Users\Admin\AppData\Local\Temp\5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VBPKJ.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f

C:\Users\Admin\AppData\Roaming\mcsft.exe

"C:\Users\Admin\AppData\Roaming\mcsft.exe"

C:\Users\Admin\AppData\Roaming\mcsft.exe

C:\Users\Admin\AppData\Roaming\mcsft.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 ygo.no-ip.info udp
ES 94.73.33.36:1604 ygo.no-ip.info tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
ES 94.73.33.36:1604 ygo.no-ip.info tcp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
ES 94.73.33.36:1604 ygo.no-ip.info tcp
US 8.8.8.8:53 ygo.no-ip.info udp
ES 94.73.33.36:1604 ygo.no-ip.info tcp
ES 94.73.33.36:1604 ygo.no-ip.info tcp
US 8.8.8.8:53 86.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
ES 94.73.33.36:1604 ygo.no-ip.info tcp

Files

memory/4488-0-0x0000000000400000-0x00000000007C8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\VBPKJ.txt

MD5 a5feca573884d76f559b996d45e8ad9a
SHA1 0e81a993f3af4e31d60653dc2513186f0495f1c8
SHA256 c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f
SHA512 a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda

C:\Users\Admin\AppData\Roaming\mcsft.txt

MD5 c834c78bc3be3bb03c282c550cfcd7fc
SHA1 81d6bb92026aae6d6288038a809a5bde174f85b7
SHA256 6bbf69fd263e6cbdfbd84d054e6bb9c178cb0232a19390145bb1dfff79c8a185
SHA512 656dfac5dce560852298b0e1da5869a7e75f198d5f0aabb219f8a592cb32f0f3ca3e090a867836a6133e0caa1fd1e072e573279ee9bc7531017b6ae9b6499bc7

memory/4488-29-0x0000000000400000-0x00000000007C8000-memory.dmp

memory/4824-32-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/4824-34-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/4824-35-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/4944-37-0x0000000000400000-0x00000000007C8000-memory.dmp

memory/4824-39-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/4824-38-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/4824-43-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/4824-42-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/4824-41-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/4824-40-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/4824-44-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/4824-45-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/4824-48-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/4824-50-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/4824-52-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/4824-54-0x0000000000400000-0x00000000004B5000-memory.dmp

memory/4824-56-0x0000000000400000-0x00000000004B5000-memory.dmp