darkcomet | 48163945b7f61883bbef7ce671588278ece93e58a9e5cb9a4385704a53176ad7

Analysis

max time kernel
77s
max time network
119s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
07/02/2025, 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_b2e0d4469ee2d14dfdca5ff323b919db.exe
Size

4.0MB
MD5

b2e0d4469ee2d14dfdca5ff323b919db
SHA1

ce8c0896c8a3840a2c99ec0877614b7eb14b6665
SHA256

48163945b7f61883bbef7ce671588278ece93e58a9e5cb9a4385704a53176ad7
SHA512

7ee8218f46bc851596ce0538c889ff61d22df243862804d64290171c56e80b67b157c6a8aa7fa24174d40df78223a4968c87f86e95297ce5fe261b3100525103
SSDEEP

98304:rBGCkwq9Y29Me/jRA1+IAt2nNRxnrWiVezIPeOyxom:9GJv1R/dA1NAtKTaiV52Oyim

Score

10^/10

darkcomet defense_evasion discovery persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Defrager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Defrager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Defrager.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Defrager.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Indexer .exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Indexer .exe	cmd.exe

Executes dropped EXE 21 IoCs

pid	Process
2536	REIKO 1.EXE
2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE
2812	Defrager.exe
2704	Defrager.exe
2860	Defrager.exe
2808	Defrager.exe
1432	Indexer .exe
1924	Defrager.exe
276	Defrager.exe
2008	Defrager.exe
1108	Defrager.exe
2624	Indexer .exe
3064	Defrager.exe
2460	Defrager.exe
2356	Defrager.exe
2800	Defrager.exe
2804	Indexer .exe
2164	Defrager.exe
844	Defrager.exe
2400	Defrager.exe
924	Defrager.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine	Defrager.exe
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine	Defrager.exe
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine	Defrager.exe
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine	Defrager.exe

Loads dropped DLL 12 IoCs

pid	Process
1260	JaffaCakes118_b2e0d4469ee2d14dfdca5ff323b919db.exe
1260	JaffaCakes118_b2e0d4469ee2d14dfdca5ff323b919db.exe
1260	JaffaCakes118_b2e0d4469ee2d14dfdca5ff323b919db.exe
1260	JaffaCakes118_b2e0d4469ee2d14dfdca5ff323b919db.exe
2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE
2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE
2216	cmd.exe
2216	cmd.exe
2216	cmd.exe
2216	cmd.exe
2216	cmd.exe
2216	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\Maintener = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Indexer .exe"	SA6TSONTOFLASHUNCOMTHEMCR.EXE

Checks whether UAC is enabled 1 TTPs 4 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Defrager.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Defrager.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Defrager.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Defrager.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2812	Defrager.exe
1924	Defrager.exe
3064	Defrager.exe
2164	Defrager.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2640 set thread context of 2812	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	36
PID 1432 set thread context of 1924	1432	Indexer .exe	47
PID 2624 set thread context of 3064	2624	Indexer .exe	53
PID 2804 set thread context of 2164	2804	Indexer .exe	59

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Indexer .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Defrager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Indexer .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REIKO 1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SA6TSONTOFLASHUNCOMTHEMCR.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Defrager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Indexer .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_b2e0d4469ee2d14dfdca5ff323b919db.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Defrager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Defrager.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 7 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1756	PING.EXE
2412	PING.EXE
2328	PING.EXE
2236	PING.EXE
2600	PING.EXE
2592	PING.EXE
2156	PING.EXE

Runs ping.exe 1 TTPs 7 IoCs

Remote System Discovery

T1018

pid	Process
2328	PING.EXE
2236	PING.EXE
2600	PING.EXE
2592	PING.EXE
2156	PING.EXE
1756	PING.EXE
2412	PING.EXE

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE
2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE
2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE
2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE
2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE
2812	Defrager.exe
2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE
1432	Indexer .exe
1432	Indexer .exe
1432	Indexer .exe
1432	Indexer .exe
1432	Indexer .exe
1924	Defrager.exe
1432	Indexer .exe
2624	Indexer .exe
2624	Indexer .exe
2624	Indexer .exe
2624	Indexer .exe
2624	Indexer .exe
3064	Defrager.exe
2624	Indexer .exe
2804	Indexer .exe
2804	Indexer .exe
2804	Indexer .exe
2804	Indexer .exe
2804	Indexer .exe
2164	Defrager.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE
Token: SeIncreaseQuotaPrivilege	2812	Defrager.exe
Token: SeSecurityPrivilege	2812	Defrager.exe
Token: SeTakeOwnershipPrivilege	2812	Defrager.exe
Token: SeLoadDriverPrivilege	2812	Defrager.exe
Token: SeSystemProfilePrivilege	2812	Defrager.exe
Token: SeSystemtimePrivilege	2812	Defrager.exe
Token: SeProfSingleProcessPrivilege	2812	Defrager.exe
Token: SeIncBasePriorityPrivilege	2812	Defrager.exe
Token: SeCreatePagefilePrivilege	2812	Defrager.exe
Token: SeBackupPrivilege	2812	Defrager.exe
Token: SeRestorePrivilege	2812	Defrager.exe
Token: SeShutdownPrivilege	2812	Defrager.exe
Token: SeDebugPrivilege	2812	Defrager.exe
Token: SeSystemEnvironmentPrivilege	2812	Defrager.exe
Token: SeChangeNotifyPrivilege	2812	Defrager.exe
Token: SeRemoteShutdownPrivilege	2812	Defrager.exe
Token: SeUndockPrivilege	2812	Defrager.exe
Token: SeManageVolumePrivilege	2812	Defrager.exe
Token: SeImpersonatePrivilege	2812	Defrager.exe
Token: SeCreateGlobalPrivilege	2812	Defrager.exe
Token: 33	2812	Defrager.exe
Token: 34	2812	Defrager.exe
Token: 35	2812	Defrager.exe
Token: SeDebugPrivilege	1432	Indexer .exe
Token: SeIncreaseQuotaPrivilege	1924	Defrager.exe
Token: SeSecurityPrivilege	1924	Defrager.exe
Token: SeTakeOwnershipPrivilege	1924	Defrager.exe
Token: SeLoadDriverPrivilege	1924	Defrager.exe
Token: SeSystemProfilePrivilege	1924	Defrager.exe
Token: SeSystemtimePrivilege	1924	Defrager.exe
Token: SeProfSingleProcessPrivilege	1924	Defrager.exe
Token: SeIncBasePriorityPrivilege	1924	Defrager.exe
Token: SeCreatePagefilePrivilege	1924	Defrager.exe
Token: SeBackupPrivilege	1924	Defrager.exe
Token: SeRestorePrivilege	1924	Defrager.exe
Token: SeShutdownPrivilege	1924	Defrager.exe
Token: SeDebugPrivilege	1924	Defrager.exe
Token: SeSystemEnvironmentPrivilege	1924	Defrager.exe
Token: SeChangeNotifyPrivilege	1924	Defrager.exe
Token: SeRemoteShutdownPrivilege	1924	Defrager.exe
Token: SeUndockPrivilege	1924	Defrager.exe
Token: SeManageVolumePrivilege	1924	Defrager.exe
Token: SeImpersonatePrivilege	1924	Defrager.exe
Token: SeCreateGlobalPrivilege	1924	Defrager.exe
Token: 33	1924	Defrager.exe
Token: 34	1924	Defrager.exe
Token: 35	1924	Defrager.exe
Token: SeDebugPrivilege	2624	Indexer .exe
Token: SeIncreaseQuotaPrivilege	3064	Defrager.exe
Token: SeSecurityPrivilege	3064	Defrager.exe
Token: SeTakeOwnershipPrivilege	3064	Defrager.exe
Token: SeLoadDriverPrivilege	3064	Defrager.exe
Token: SeSystemProfilePrivilege	3064	Defrager.exe
Token: SeSystemtimePrivilege	3064	Defrager.exe
Token: SeProfSingleProcessPrivilege	3064	Defrager.exe
Token: SeIncBasePriorityPrivilege	3064	Defrager.exe
Token: SeCreatePagefilePrivilege	3064	Defrager.exe
Token: SeBackupPrivilege	3064	Defrager.exe
Token: SeRestorePrivilege	3064	Defrager.exe
Token: SeShutdownPrivilege	3064	Defrager.exe
Token: SeDebugPrivilege	3064	Defrager.exe
Token: SeSystemEnvironmentPrivilege	3064	Defrager.exe
Token: SeChangeNotifyPrivilege	3064	Defrager.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1260	JaffaCakes118_b2e0d4469ee2d14dfdca5ff323b919db.exe
2812	Defrager.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 2536	1260	JaffaCakes118_b2e0d4469ee2d14dfdca5ff323b919db.exe	30
PID 1260 wrote to memory of 2536	1260	JaffaCakes118_b2e0d4469ee2d14dfdca5ff323b919db.exe	30
PID 1260 wrote to memory of 2536	1260	JaffaCakes118_b2e0d4469ee2d14dfdca5ff323b919db.exe	30
PID 1260 wrote to memory of 2536	1260	JaffaCakes118_b2e0d4469ee2d14dfdca5ff323b919db.exe	30
PID 1260 wrote to memory of 2640	1260	JaffaCakes118_b2e0d4469ee2d14dfdca5ff323b919db.exe	31
PID 1260 wrote to memory of 2640	1260	JaffaCakes118_b2e0d4469ee2d14dfdca5ff323b919db.exe	31
PID 1260 wrote to memory of 2640	1260	JaffaCakes118_b2e0d4469ee2d14dfdca5ff323b919db.exe	31
PID 1260 wrote to memory of 2640	1260	JaffaCakes118_b2e0d4469ee2d14dfdca5ff323b919db.exe	31
PID 2640 wrote to memory of 2968	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	32
PID 2640 wrote to memory of 2968	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	32
PID 2640 wrote to memory of 2968	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	32
PID 2640 wrote to memory of 2968	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	32
PID 2968 wrote to memory of 2848	2968	cmd.exe	34
PID 2968 wrote to memory of 2848	2968	cmd.exe	34
PID 2968 wrote to memory of 2848	2968	cmd.exe	34
PID 2968 wrote to memory of 2848	2968	cmd.exe	34
PID 2640 wrote to memory of 2704	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	35
PID 2640 wrote to memory of 2704	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	35
PID 2640 wrote to memory of 2704	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	35
PID 2640 wrote to memory of 2704	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	35
PID 2640 wrote to memory of 2812	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	36
PID 2640 wrote to memory of 2812	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	36
PID 2640 wrote to memory of 2812	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	36
PID 2640 wrote to memory of 2812	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	36
PID 2640 wrote to memory of 2812	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	36
PID 2640 wrote to memory of 2812	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	36
PID 2640 wrote to memory of 2812	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	36
PID 2640 wrote to memory of 2812	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	36
PID 2640 wrote to memory of 2812	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	36
PID 2640 wrote to memory of 2812	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	36
PID 2640 wrote to memory of 2812	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	36
PID 2640 wrote to memory of 2812	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	36
PID 2640 wrote to memory of 2860	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	37
PID 2640 wrote to memory of 2860	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	37
PID 2640 wrote to memory of 2860	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	37
PID 2640 wrote to memory of 2860	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	37
PID 2640 wrote to memory of 2808	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	38
PID 2640 wrote to memory of 2808	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	38
PID 2640 wrote to memory of 2808	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	38
PID 2640 wrote to memory of 2808	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	38
PID 2848 wrote to memory of 876	2848	wscript.exe	39
PID 2848 wrote to memory of 876	2848	wscript.exe	39
PID 2848 wrote to memory of 876	2848	wscript.exe	39
PID 2848 wrote to memory of 876	2848	wscript.exe	39
PID 2640 wrote to memory of 2216	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	42
PID 2640 wrote to memory of 2216	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	42
PID 2640 wrote to memory of 2216	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	42
PID 2640 wrote to memory of 2216	2640	SA6TSONTOFLASHUNCOMTHEMCR.EXE	42
PID 2216 wrote to memory of 2600	2216	cmd.exe	44
PID 2216 wrote to memory of 2600	2216	cmd.exe	44
PID 2216 wrote to memory of 2600	2216	cmd.exe	44
PID 2216 wrote to memory of 2600	2216	cmd.exe	44
PID 2216 wrote to memory of 1432	2216	cmd.exe	45
PID 2216 wrote to memory of 1432	2216	cmd.exe	45
PID 2216 wrote to memory of 1432	2216	cmd.exe	45
PID 2216 wrote to memory of 1432	2216	cmd.exe	45
PID 1432 wrote to memory of 1108	1432	Indexer .exe	46
PID 1432 wrote to memory of 1108	1432	Indexer .exe	46
PID 1432 wrote to memory of 1108	1432	Indexer .exe	46
PID 1432 wrote to memory of 1108	1432	Indexer .exe	46
PID 1432 wrote to memory of 1924	1432	Indexer .exe	47
PID 1432 wrote to memory of 1924	1432	Indexer .exe	47
PID 1432 wrote to memory of 1924	1432	Indexer .exe	47
PID 1432 wrote to memory of 1924	1432	Indexer .exe	47

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b2e0d4469ee2d14dfdca5ff323b919db.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b2e0d4469ee2d14dfdca5ff323b919db.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Local\Temp\REIKO 1.EXE
  "C:\Users\Admin\AppData\Local\Temp\REIKO 1.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2536
- C:\Users\Admin\AppData\Local\Temp\SA6TSONTOFLASHUNCOMTHEMCR.EXE
  "C:\Users\Admin\AppData\Local\Temp\SA6TSONTOFLASHUNCOMTHEMCR.EXE"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\java.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Windows\SysWOW64\wscript.exe
      wscript.exe "C:\Users\Admin\AppData\Local\Temp\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\java2.bat
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2848
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\java2.bat" "
        5⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:876
- - C:\Windows\Temp\Defrager.exe
    C:\Windows\Temp\Defrager.exe
    3⤵
    - Executes dropped EXE
    PID:2704
- - C:\Windows\Temp\Defrager.exe
    C:\Windows\Temp\Defrager.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2812
- - C:\Windows\Temp\Defrager.exe
    C:\Windows\Temp\Defrager.exe
    3⤵
    - Executes dropped EXE
    PID:2860
- - C:\Windows\Temp\Defrager.exe
    C:\Windows\Temp\Defrager.exe
    3⤵
    - Executes dropped EXE
    PID:2808
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\per.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2216
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 60000
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\Indexer .exe
      "C:\Users\Admin\AppData\Local\Temp\Indexer .exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1432
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        Executes dropped EXE
        
        PID:1108
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Executes dropped EXE
        Identifies Wine through registry keys
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1924
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        Executes dropped EXE
        
        PID:2008
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        Executes dropped EXE
        
        PID:276
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 60000
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\Indexer .exe
      "C:\Users\Admin\AppData\Local\Temp\Indexer .exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2624
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        Executes dropped EXE
        
        PID:2356
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Executes dropped EXE
        Identifies Wine through registry keys
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3064
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        Executes dropped EXE
        
        PID:2460
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        Executes dropped EXE
        
        PID:2800
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 60000
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2156
  - - C:\Users\Admin\AppData\Local\Temp\Indexer .exe
      "C:\Users\Admin\AppData\Local\Temp\Indexer .exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2804
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        Executes dropped EXE
        
        PID:2400
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Executes dropped EXE
        Identifies Wine through registry keys
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2164
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        Executes dropped EXE
        
        PID:924
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        Executes dropped EXE
        
        PID:844
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 60000
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1756
  - - C:\Users\Admin\AppData\Local\Temp\Indexer .exe
      "C:\Users\Admin\AppData\Local\Temp\Indexer .exe"
      4⤵
      PID:972
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:1572
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:1256
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:2964
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:2844
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 60000
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\Indexer .exe
      "C:\Users\Admin\AppData\Local\Temp\Indexer .exe"
      4⤵
      PID:2460
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:2184
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:2484
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:1052
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:2056
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 60000
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\Indexer .exe
      "C:\Users\Admin\AppData\Local\Temp\Indexer .exe"
      4⤵
      PID:1640
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:2808
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:1848
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:2136
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:2372
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 60000
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\Indexer .exe
      "C:\Users\Admin\AppData\Local\Temp\Indexer .exe"
      4⤵
      PID:920
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:3052
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:3040
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:2660
    - - C:\Windows\Temp\Defrager.exe
        
        C:\Windows\Temp\Defrager.exe
        5⤵
        
        PID:824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SA6TSONTOFLASHUNCOMTHEMCR.EXE

Filesize
1.9MB

MD5
42536470c192ab0f6e3bde40bfe93c57

SHA1
3ad0bbe73034d48291a4057b824fdc225ace7e4c

SHA256
ba3fdd59aedaea00881145506285e9047e6900322eb0b8a8908c9e150401ee31

SHA512
cc3d2dc1ee2beb60068168e376fd8ead4bfe4930c13d784f012664b6c8b169d9ac6e17aebefd4b44aeab78088831b57e9e85de5d6bd62ad685d6c59ae794a147

Download Submit
C:\Users\Admin\AppData\Local\Temp\invs.vbs

Filesize
78B

MD5
c578d9653b22800c3eb6b6a51219bbb8

SHA1
a97aa251901bbe179a48dbc7a0c1872e163b1f2d

SHA256
20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2

SHA512
3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\java.bat

Filesize
47B

MD5
81bf5400486e5da45ba0c6c1399d843f

SHA1
d70a7c4d3f3057a3ef5b8b1c764b40b3d3b4d59d

SHA256
d1a915a5e0286b1648a6e094f52813e2b5766dce3acf6342b297f7ca113545f1

SHA512
ebeee9eb5249ee1b278bf6c1fbcd91e4c073a241203f218dfa2edfa708a37679c6e6a78751de55b4640a024b32ce4389bd5d931401309163950cd15b4a91c140

Download Submit
C:\Users\Admin\AppData\Local\Temp\java2.bat

Filesize
149B

MD5
abb26834e1b272333fc2dd0ad0fe5aae

SHA1
c26cc0c5a4e386616f1a1736da70653f6b85e5d9

SHA256
f50fd1abedfb0012b4efa21a43bfc98160ff82549f125a29a34b17f37f22063b

SHA512
3f99312654ac8b8fbc80eb6cecc2d46d0372a4fea64591d671b7c2a3922bcd67d095c4ccd7ae90b8e377c425ac74628aed66b0afc769a9251f7c90efc9d74a15

Download Submit
C:\Users\Admin\AppData\Local\Temp\per.bat

Filesize
111B

MD5
c82ae1b9daef094ac36500bb4648b1d8

SHA1
51b1bfef2998f0ef9ce8ed78877838fac9bfd868

SHA256
0acb99bdf92d3d82f3e34e44c3e7262afc84da3e8bf276fb0d99dc7ac43bd910

SHA512
b66245061790efb3f9c3bacab819537ebe0e4b60a0df3e194b50c543c3176deb5ca847a631a9255fa261e18c78c008421cc89401b1f10708508c2ad1adfee31c

Download Submit
\Users\Admin\AppData\Local\Temp\REIKO 1.EXE

Filesize
1.4MB

MD5
498c38476e0d1394049c362df200f851

SHA1
ead685e3522f82893ec62e98fc927c827471d4e6

SHA256
34ebac4601ebf70369514302ce0deb70866767265a330699eab0995ee5f53aa7

SHA512
c8d2a7a76a18731d315b0873838bdd6739be9f6dc45c3db294cd2716df61e7dbdb8789be592dff5912c373da1635c1014d2b745ccfd2ff040fe5cc1210326bf9

Download Submit
\Windows\Temp\Defrager.exe

Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
memory/1256-394-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/1256-459-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/1260-19-0x0000000000110000-0x0000000000824000-memory.dmp

Filesize
7.1MB

Download
memory/1260-0-0x0000000000110000-0x0000000000824000-memory.dmp

Filesize
7.1MB

Download
memory/1848-628-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/1924-147-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/1924-149-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/1924-145-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/1924-141-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/1924-204-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/1924-146-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2164-374-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2164-309-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2484-544-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2484-479-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2640-23-0x0000000073F50000-0x00000000744FB000-memory.dmp

Filesize
5.7MB

Download
memory/2640-22-0x0000000073F50000-0x00000000744FB000-memory.dmp

Filesize
5.7MB

Download
memory/2640-119-0x0000000073F50000-0x00000000744FB000-memory.dmp

Filesize
5.7MB

Download
memory/2640-21-0x0000000073F51000-0x0000000073F52000-memory.dmp

Filesize
4KB

Download
memory/2640-107-0x0000000073F50000-0x00000000744FB000-memory.dmp

Filesize
5.7MB

Download
memory/2812-78-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-101-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-90-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-88-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-87-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-85-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-84-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-82-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-81-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-80-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-79-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-92-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-77-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-76-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-75-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-73-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-89-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-83-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-74-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-96-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-97-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-99-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-98-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-102-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-103-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-91-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-100-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-104-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-106-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-105-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-93-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-109-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-108-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-94-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-95-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-120-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-86-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-72-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-48-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-49-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-50-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-51-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-62-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-61-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-52-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-53-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-54-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2812-55-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2812-56-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/3064-289-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/3064-226-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download