darkcomet | f816377ac402ed2774e8d5e69e9fec2e7e02a95f820ca6ea00819fc47d91d691

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20250207-en
resource tags

arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
submitted
16/02/2025, 15:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f816377ac402ed2774e8d5e69e9fec2e7e02a95f820ca6ea00819fc47d91d691.exe
Size

1.6MB
MD5

0cb3cab82171b9ed0301c31deedb2976
SHA1

e75ff793aca1d65b944e7823c8fec0d464795d59
SHA256

f816377ac402ed2774e8d5e69e9fec2e7e02a95f820ca6ea00819fc47d91d691
SHA512

579bb9ed177faef02430df1aed97f2761278c8a894a5930fa9c0c8afb0017fa91e2c92eba79cb1a03c6352f425a50088e73dd13976b9cd9158174bf4676f90b0
SSDEEP

49152:opLAZG/fLlSMp4OqW8xX8/bc7svZkq08Y9sTOx:ClSMGOqjM/bcAxkq08Y9sG

Score

10^/10

darkcomet bunker 2 discovery persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Bunker 2

fingers.no-ip.biz:4421

Mutex

DCMIN_MUTEX-0DWPKLM

Attributes

gencode
wKcjsm51vLbU
install
false
offline_keylogger
true
persistence
false

rc4.plain

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\Control Panel\International\Geo\Nation	f816377ac402ed2774e8d5e69e9fec2e7e02a95f820ca6ea00819fc47d91d691.exe

Executes dropped EXE 2 IoCs

pid	Process
2444	YJKQN.exe
5012	YJKQN.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\WLQIG\\GYUFP.ZYEBU.KSRJL.vbe"	YJKQN.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5012 set thread context of 2892	5012	YJKQN.exe	96

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YJKQN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f816377ac402ed2774e8d5e69e9fec2e7e02a95f820ca6ea00819fc47d91d691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YJKQN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1928	MicrosoftEdgeUpdate.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 27 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "446483542"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3633349215"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3653817439"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31162500"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{01ADE3B1-EC78-11EF-AF00-DA80AD94A160} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31162500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000_Classes\Local Settings	f816377ac402ed2774e8d5e69e9fec2e7e02a95f820ca6ea00819fc47d91d691.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
5012	YJKQN.exe
5012	YJKQN.exe
3904	AcroRd32.exe
3904	AcroRd32.exe
3904	AcroRd32.exe
3904	AcroRd32.exe
3904	AcroRd32.exe
3904	AcroRd32.exe
3904	AcroRd32.exe
3904	AcroRd32.exe
3904	AcroRd32.exe
3904	AcroRd32.exe
3904	AcroRd32.exe
3904	AcroRd32.exe
3904	AcroRd32.exe
3904	AcroRd32.exe
3904	AcroRd32.exe
3904	AcroRd32.exe
3904	AcroRd32.exe
3904	AcroRd32.exe
3904	AcroRd32.exe
3904	AcroRd32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3904	AcroRd32.exe
2892	iexplore.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
3904	AcroRd32.exe
3904	AcroRd32.exe
3904	AcroRd32.exe
3904	AcroRd32.exe
2892	iexplore.exe
2892	iexplore.exe
4560	IEXPLORE.EXE
4560	IEXPLORE.EXE
4560	IEXPLORE.EXE
4560	IEXPLORE.EXE
3904	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 4664	932	f816377ac402ed2774e8d5e69e9fec2e7e02a95f820ca6ea00819fc47d91d691.exe	87
PID 932 wrote to memory of 4664	932	f816377ac402ed2774e8d5e69e9fec2e7e02a95f820ca6ea00819fc47d91d691.exe	87
PID 932 wrote to memory of 4664	932	f816377ac402ed2774e8d5e69e9fec2e7e02a95f820ca6ea00819fc47d91d691.exe	87
PID 932 wrote to memory of 3904	932	f816377ac402ed2774e8d5e69e9fec2e7e02a95f820ca6ea00819fc47d91d691.exe	88
PID 932 wrote to memory of 3904	932	f816377ac402ed2774e8d5e69e9fec2e7e02a95f820ca6ea00819fc47d91d691.exe	88
PID 932 wrote to memory of 3904	932	f816377ac402ed2774e8d5e69e9fec2e7e02a95f820ca6ea00819fc47d91d691.exe	88
PID 4664 wrote to memory of 2444	4664	WScript.exe	90
PID 4664 wrote to memory of 2444	4664	WScript.exe	90
PID 4664 wrote to memory of 2444	4664	WScript.exe	90
PID 2444 wrote to memory of 5012	2444	YJKQN.exe	93
PID 2444 wrote to memory of 5012	2444	YJKQN.exe	93
PID 2444 wrote to memory of 5012	2444	YJKQN.exe	93
PID 5012 wrote to memory of 2892	5012	YJKQN.exe	96
PID 5012 wrote to memory of 2892	5012	YJKQN.exe	96
PID 5012 wrote to memory of 2892	5012	YJKQN.exe	96
PID 5012 wrote to memory of 2892	5012	YJKQN.exe	96
PID 5012 wrote to memory of 2892	5012	YJKQN.exe	96
PID 5012 wrote to memory of 2892	5012	YJKQN.exe	96
PID 5012 wrote to memory of 2892	5012	YJKQN.exe	96
PID 5012 wrote to memory of 2892	5012	YJKQN.exe	96
PID 5012 wrote to memory of 2892	5012	YJKQN.exe	96
PID 5012 wrote to memory of 2892	5012	YJKQN.exe	96
PID 5012 wrote to memory of 2892	5012	YJKQN.exe	96
PID 5012 wrote to memory of 2892	5012	YJKQN.exe	96
PID 5012 wrote to memory of 1432	5012	YJKQN.exe	97
PID 5012 wrote to memory of 1432	5012	YJKQN.exe	97
PID 3904 wrote to memory of 3148	3904	AcroRd32.exe	98
PID 3904 wrote to memory of 3148	3904	AcroRd32.exe	98
PID 3904 wrote to memory of 3148	3904	AcroRd32.exe	98
PID 2892 wrote to memory of 4560	2892	iexplore.exe	99
PID 2892 wrote to memory of 4560	2892	iexplore.exe	99
PID 2892 wrote to memory of 4560	2892	iexplore.exe	99
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100
PID 3148 wrote to memory of 1632	3148	RdrCEF.exe	100

C:\Users\Admin\AppData\Local\Temp\f816377ac402ed2774e8d5e69e9fec2e7e02a95f820ca6ea00819fc47d91d691.exe
"C:\Users\Admin\AppData\Local\Temp\f816377ac402ed2774e8d5e69e9fec2e7e02a95f820ca6ea00819fc47d91d691.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:932
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\WLQIG\GYUFP.ZYEBU.KSRJL.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Users\Admin\WLQIG\YJKQN.exe
    "C:\Users\Admin\WLQIG\YJKQN.exe" C:\Users\Admin\WLQIG\RIWIL
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Users\Admin\WLQIG\YJKQN.exe
      C:\Users\Admin\WLQIG\YJKQN.exe C:\Users\Admin\WLQIG\IJAQN
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5012
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2892
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2892 CREDAT:17410 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4560
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        C:\Users\Admin\WLQIG\IJAQN
        5⤵
        
        PID:1432
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\WLQIG\invoice1.pdf"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3148
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=003B3906470AD9001D8146881ABAAAD6 --mojo-platform-channel-handle=1796 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1632
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=97B9952016D3F4824C943B58EEC94C1B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=97B9952016D3F4824C943B58EEC94C1B --renderer-client-id=2 --mojo-platform-channel-handle=1808 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:2056
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7AA82782D674BA5E63B13B09264E9B3D --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7AA82782D674BA5E63B13B09264E9B3D --renderer-client-id=4 --mojo-platform-channel-handle=2408 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:4520
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=16E9C5720A07DD3477395216B7507161 --mojo-platform-channel-handle=2756 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1836
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DBC812D01FEEF6E0BB5B102FC75E9E8F --mojo-platform-channel-handle=1940 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:3524
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1CDF84A30618B198AE961A2B0695234E --mojo-platform-channel-handle=2768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1916

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7REFEMTg3MDUtMzFBOC00RDIwLThCOTUtRDAzRDQ1N0EzMTAzfSIgdXNlcmlkPSJ7NTUzQjM4NzUtQTJERS00QjM4LThFQkUtOEFFM0RCMjE5MTVBfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7OTE5QzZFRTctMUJCQy00RTIyLTkxMTEtQkIwQ0NCRDc3Qzc3fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI4IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDY4ODkiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxOTM2NTgwOTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTg2MDIzMTE0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
9804233697539badce9ff832932938fa

SHA1
29b3e082bd5f35ef5896f44b6e52b96bdd7dbbc7

SHA256
409666748cdc8d677f251e8eceac6e3994835fdc502c97129f831004766af4dd

SHA512
6619b83b7052370a3bddd14388bcd64cba09676ec3933e483a6b2ee6e23eeb3847c7b9592a1196308d8a64171c9413613b9b7c9b063b07b9bd8e60ad20f43c88

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\31976568FBE31D20174C3FAC50D34698_2224EF112EEB7D5CE6B913D61620C791

Filesize
471B

MD5
ce66bb715fb95a5ee05b6e87c5d350e0

SHA1
2e17c30b082a8af50f7104157cdfe9e6b2a20028

SHA256
c0da09919f37fe5afbd7fc662b5c352bf86c9a1900f3c9bbd600f44688f94fd0

SHA512
e44108f7af21b4f63003240cfe16b2218249503d0853f63cd2a16079e05f517c6e3a36e2f3da5f3e2fb3e43d10e9f65b4433d36a0bf3ce65aa3ea4061f2e3e19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
edc06b7759da63400e0ed8f04dadff37

SHA1
4bf222d68986a1ec1ec8fdf97b362fbdc8376a8b

SHA256
c84d7b49b4e8096a6cbf00337664ccd6d486c4da80338e893e680dd2403a4a94

SHA512
9bf6c3c190c0d0998be8e30b56a8aaedaea78c1b06716a7f9d536073367e388007276e0a21f2860c4082c8cc02ed358c5556bdbf5c969346e2655716530ea6cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\31976568FBE31D20174C3FAC50D34698_2224EF112EEB7D5CE6B913D61620C791

Filesize
400B

MD5
10f87e92b6b7aee135aca4e94c09628f

SHA1
edfdbd213e6606bcc19cf8926b08528666f51d10

SHA256
3c01181a1e407630f9a7fe8171fbb89a100e6b1c832144197829c2e409eb4523

SHA512
e6aaeb888577ae1af2392704fb99133cc36eb808cc66caaae155c00caee639a78f49e17f73845899b1eeeca3c38659f1bb163b7c04afa595377fc812676c8b9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
645fe2a040ffeff6684d0faa0ae51426

SHA1
5152d8b1120b64d852f2c3c33a088aa01053a48f

SHA256
c54443fc47ef09e49bfc823768fffdad466c46544fe4991e51b068646e1fd60c

SHA512
4d315d90981c24dbe8046edd6fca0efd8ef27b7e07e3ad37a9d72f94c5c31af6c26f649046e19169ef43d591c98b343287f0cbe28b8d93476477d1f43e288445

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TGCGXE73\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\WLQIG\GVWYQ

Filesize
32KB

MD5
09a2e2b052cd0f9f0ffb423922ea86c9

SHA1
a22e5fffe1eab03b807afdd5fd8520dabb76cd77

SHA256
8aed4bfc389262a7e34e51042e38c2af499114423cd94f676035bf46a04010be

SHA512
1a9502f569b7737885c2c793597872fa19d2a206fdb3f161e18d6856b89dfc035839834512f21a486de6e617e5a0a2c8e9a89351a2021a72f166826f8f57bf85

Download Submit
C:\Users\Admin\WLQIG\GYUFP.ZYEBU.KSRJL.vbe

Filesize
1.4MB

MD5
02ac073d625a666bfb18d4fa6e8c0777

SHA1
c7a5b4c5dac48059c0fb79b3745b1dd6c878f713

SHA256
0bd76b4f7a72a103dbc5856256993b796a1320d6246fd52c05d161cf34482c5a

SHA512
d2288497f8f246c15b77d9f868949a97c562754b00c40f8e719791e5f68b90ae5cc83dbafd567727971f036cf9edf56f739bc42f577fa3588d386b3ef635509c

Download Submit
C:\Users\Admin\WLQIG\IJAQN

Filesize
23KB

MD5
c7d4fc9888d09a56e1e8708af6b58d8c

SHA1
aab25c529a48c9befffc2881c55d0aadb9eb8815

SHA256
7aa3fc11548141258562a1240a925fb3fde39baa4b1f943e4bbc15dd234be9ef

SHA512
d24a7107c0ebccb469ed2e8783ee83bf29fe16c97e3dce397d0ca4dbfe38984d9cdabc18581fb625f585831b4281c140d9e443fe640b94dd1a4e3195c5e7ee35

Download Submit
C:\Users\Admin\WLQIG\RIWIL

Filesize
2KB

MD5
00956e8722817dc9c2804e404d16eb34

SHA1
9c0037311a4de6f32245e5ad080681646e465788

SHA256
8004ef08cd18d494baaf83e22f0eb939ac134f6447756fa22456fd51f57f2394

SHA512
974d1cbbf5c18b3baac2482da46691a5df98a30db070461c5cf592f25660ed2ed046c2476f61e544ac068d482afb28f9c663f7be612c2b6e9340f9203f66ab12

Download Submit
C:\Users\Admin\WLQIG\WIHLM

Filesize
658KB

MD5
e61a39713dd08928070b654bcc0bf6fd

SHA1
30b6e033b8134a52df649002262041ad11ad51c2

SHA256
b928f2d4d4f61fbe3d75a78d019c70727e88726e9248ea967c94ec4233019273

SHA512
c205c7cc8ecb3b59490448bb06def728744c59e7e01bbc5d694b35937ec064d0f97561afbf197d396c8763c24c65092f1e3aa1b7c5696952f467caa20c84b0ce

Download Submit
C:\Users\Admin\WLQIG\YJKQN.exe

Filesize
732KB

MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
C:\Users\Admin\WLQIG\YMQGIX

Filesize
70KB

MD5
11a0f133e23f11379659a6cb26f044df

SHA1
d7c4db97ba359dcf2150cc95af87b9263059b59a

SHA256
e1673f2fc81653063c37bcdafceb88c56e6c2c370c8bcf3cb3aec724e83dfe08

SHA512
2baa4da9790d87bed280ecd30d4ad9063ededb580950b61822da015c6c20a4e63025473ee0766b8c3586330493c48aca183095a9afd67fd1fb234ac9b2a7fb69

Download Submit
C:\Users\Admin\WLQIG\invoice1.pdf

Filesize
16KB

MD5
7deb228bf8842350a33eb8fa84eec259

SHA1
492bf2a627ac8eddd55f4740344019d3c8d1fed3

SHA256
50235875a3669f0c39350cfcf1d8cc7f6893eafccae1262b96cf0e90aaa24062

SHA512
eb90b4884bd74ffff9babb2c6a1df07d875158a4ac04aae5440a5e1631dc45c13b70a583323dea22ca8f4bfce722f26cf94f886305114784dd69c40e30b6a0c2

Download Submit
memory/2892-34-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download