darkcomet | 141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03

Analysis

max time kernel
149s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/03/2025, 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe
Size

1.2MB
MD5

0df35e9bc20c616eaf0ec1cbf035f1e5
SHA1

fe5e7ec788f03838289528ccc96f42ee5aaf8e6f
SHA256

141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03
SHA512

9b14f02072d7fde33cf4e00cf3289a1adfbb42c3707ce9a30b4149e97aaa9c7a37bc9e2dde365452481c54039efc9fe2eccf6d79217f62b4205d48bd428336d7
SSDEEP

24576:gvEYVxNoHgkXeLyr6VuPJNNr/K/cRgOnmq9g62pFSSL:gv9NagroLrscOU7m6QF/

Score

10^/10

darkcomet haha defense_evasion discovery persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

HAHA

127.0.0.1:888

217.66.231.239:888

Mutex

DC_MUTEX-F54S21D

Attributes

InstallPath
MOKSC\youtube.exe
gencode
EAYaaW4sHghc
install
true
offline_keylogger
true
persistence
true
reg_key
Micmdjedate

rc4.plain

Extracted

Family

darkcomet

Attributes

gencode
install
false
offline_keylogger
false
persistence
false

rc4.plain

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MOKSC\\youtube.exe"	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe

Executes dropped EXE 2 IoCs

pid	Process
2444	youtube.exe
1676	youtube.exe

Loads dropped DLL 1 IoCs

pid	Process
2716	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Micmdjedate = "C:\\Users\\Admin\\Documents\\MOKSC\\youtube.exe"	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Micmdjedate = "C:\\Users\\Admin\\Documents\\MOKSC\\youtube.exe"	youtube.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2736 set thread context of 2716	2736	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe	30
PID 2444 set thread context of 1676	2444	youtube.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	youtube.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	youtube.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1261E291-09B9-11F0-8B74-7694D31B45CA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "449096961"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d197de9efc2dd640b8d2acda71ca74f300000000020000000000106600000001000020000000a379e87f97889217d170094d609f3fa50f25af6de61d4ed2308b8206aac0cd90000000000e8000000002000020000000cf80e8e087c4a7c0ba1875849133a3e73cfb0de8b9fd2788b6fe37bebb2ee37820000000a7de043d16048fc610b26120bf2ac8068e5e73b85b05afd8401dcffcae25e1dc40000000ba51d5a716adc37931966553fcc4492f84359fa46df5f862fcbfdc0da068e9d8135456cb5205bb6ab209ffea11f2ed328941fc0f158399feb006c84f865b12cc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0151de8c59ddb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d197de9efc2dd640b8d2acda71ca74f3000000000200000000001066000000010000200000004ecf058dd612019181ab46c57847e169ebf93c37f062677acea850bf11a8384e000000000e80000000020000200000002eb8b12ab4cf2d703e107726a850e95a21d95963aaf52180dd0333d62de4e8ef900000009e8a0422372b9082701ba0b5c62e4f4905f17e3d001d6e3da9d5c16b4f48c0747aa8f20af8ca680f6f6b26319d1d3abbc4b15844193c423966d3e540f15b043cc1bde93c123ef0d7ee03de39b9d72b3b59c4d0e4b064536696d9d5f27a3ee470a4ad1c362c9e22ff8219a0b41cad156c63af98693e5f4f2da51bc6487872e747ea01e8b874530c1175d0ff42cd54fa9f4000000081d593db3c44d72ebb57ce8d4df5bb0d2147f6d3df0d573eac4cadb0c5c091c0d0e1e70e972c4818711db5988eaca6b89a4ea1be14ae99152d3c8a359e00f1bb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2716	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe
Token: SeSecurityPrivilege	2716	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe
Token: SeTakeOwnershipPrivilege	2716	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe
Token: SeLoadDriverPrivilege	2716	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe
Token: SeSystemProfilePrivilege	2716	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe
Token: SeSystemtimePrivilege	2716	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe
Token: SeProfSingleProcessPrivilege	2716	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe
Token: SeIncBasePriorityPrivilege	2716	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe
Token: SeCreatePagefilePrivilege	2716	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe
Token: SeBackupPrivilege	2716	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe
Token: SeRestorePrivilege	2716	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe
Token: SeShutdownPrivilege	2716	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe
Token: SeDebugPrivilege	2716	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe
Token: SeSystemEnvironmentPrivilege	2716	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe
Token: SeChangeNotifyPrivilege	2716	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe
Token: SeRemoteShutdownPrivilege	2716	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe
Token: SeUndockPrivilege	2716	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe
Token: SeManageVolumePrivilege	2716	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe
Token: SeImpersonatePrivilege	2716	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe
Token: SeCreateGlobalPrivilege	2716	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe
Token: 33	2716	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe
Token: 34	2716	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe
Token: 35	2716	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe
Token: SeIncreaseQuotaPrivilege	1676	youtube.exe
Token: SeSecurityPrivilege	1676	youtube.exe
Token: SeTakeOwnershipPrivilege	1676	youtube.exe
Token: SeLoadDriverPrivilege	1676	youtube.exe
Token: SeSystemProfilePrivilege	1676	youtube.exe
Token: SeSystemtimePrivilege	1676	youtube.exe
Token: SeProfSingleProcessPrivilege	1676	youtube.exe
Token: SeIncBasePriorityPrivilege	1676	youtube.exe
Token: SeCreatePagefilePrivilege	1676	youtube.exe
Token: SeBackupPrivilege	1676	youtube.exe
Token: SeRestorePrivilege	1676	youtube.exe
Token: SeShutdownPrivilege	1676	youtube.exe
Token: SeDebugPrivilege	1676	youtube.exe
Token: SeSystemEnvironmentPrivilege	1676	youtube.exe
Token: SeChangeNotifyPrivilege	1676	youtube.exe
Token: SeRemoteShutdownPrivilege	1676	youtube.exe
Token: SeUndockPrivilege	1676	youtube.exe
Token: SeManageVolumePrivilege	1676	youtube.exe
Token: SeImpersonatePrivilege	1676	youtube.exe
Token: SeCreateGlobalPrivilege	1676	youtube.exe
Token: 33	1676	youtube.exe
Token: 34	1676	youtube.exe
Token: 35	1676	youtube.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2764	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2764	iexplore.exe
2764	iexplore.exe
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE
1676	youtube.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2716	2736	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe	30
PID 2736 wrote to memory of 2716	2736	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe	30
PID 2736 wrote to memory of 2716	2736	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe	30
PID 2736 wrote to memory of 2716	2736	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe	30
PID 2736 wrote to memory of 2716	2736	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe	30
PID 2736 wrote to memory of 2716	2736	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe	30
PID 2736 wrote to memory of 2716	2736	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe	30
PID 2736 wrote to memory of 2716	2736	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe	30
PID 2736 wrote to memory of 2716	2736	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe	30
PID 2736 wrote to memory of 2716	2736	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe	30
PID 2736 wrote to memory of 2716	2736	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe	30
PID 2736 wrote to memory of 2716	2736	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe	30
PID 2736 wrote to memory of 2716	2736	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe	30
PID 2764 wrote to memory of 2016	2764	iexplore.exe	32
PID 2764 wrote to memory of 2016	2764	iexplore.exe	32
PID 2764 wrote to memory of 2016	2764	iexplore.exe	32
PID 2764 wrote to memory of 2016	2764	iexplore.exe	32
PID 2716 wrote to memory of 2444	2716	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe	33
PID 2716 wrote to memory of 2444	2716	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe	33
PID 2716 wrote to memory of 2444	2716	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe	33
PID 2716 wrote to memory of 2444	2716	141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe	33
PID 2444 wrote to memory of 1676	2444	youtube.exe	35
PID 2444 wrote to memory of 1676	2444	youtube.exe	35
PID 2444 wrote to memory of 1676	2444	youtube.exe	35
PID 2444 wrote to memory of 1676	2444	youtube.exe	35
PID 2444 wrote to memory of 1676	2444	youtube.exe	35
PID 2444 wrote to memory of 1676	2444	youtube.exe	35
PID 2444 wrote to memory of 1676	2444	youtube.exe	35
PID 2444 wrote to memory of 1676	2444	youtube.exe	35
PID 2444 wrote to memory of 1676	2444	youtube.exe	35
PID 2444 wrote to memory of 1676	2444	youtube.exe	35
PID 2444 wrote to memory of 1676	2444	youtube.exe	35
PID 2444 wrote to memory of 1676	2444	youtube.exe	35
PID 2444 wrote to memory of 1676	2444	youtube.exe	35
PID 1676 wrote to memory of 2804	1676	youtube.exe	36
PID 1676 wrote to memory of 2804	1676	youtube.exe	36
PID 1676 wrote to memory of 2804	1676	youtube.exe	36
PID 1676 wrote to memory of 2804	1676	youtube.exe	36
PID 1676 wrote to memory of 2804	1676	youtube.exe	36
PID 1676 wrote to memory of 2804	1676	youtube.exe	36
PID 1676 wrote to memory of 2804	1676	youtube.exe	36
PID 1676 wrote to memory of 2804	1676	youtube.exe	36
PID 1676 wrote to memory of 2804	1676	youtube.exe	36
PID 1676 wrote to memory of 2804	1676	youtube.exe	36
PID 1676 wrote to memory of 2804	1676	youtube.exe	36
PID 1676 wrote to memory of 2804	1676	youtube.exe	36
PID 1676 wrote to memory of 2804	1676	youtube.exe	36
PID 1676 wrote to memory of 2804	1676	youtube.exe	36
PID 1676 wrote to memory of 2804	1676	youtube.exe	36
PID 1676 wrote to memory of 2804	1676	youtube.exe	36
PID 1676 wrote to memory of 2804	1676	youtube.exe	36
PID 1676 wrote to memory of 2804	1676	youtube.exe	36
PID 1676 wrote to memory of 2804	1676	youtube.exe	36
PID 1676 wrote to memory of 2804	1676	youtube.exe	36
PID 1676 wrote to memory of 2804	1676	youtube.exe	36
PID 1676 wrote to memory of 2804	1676	youtube.exe	36
PID 1676 wrote to memory of 2804	1676	youtube.exe	36

C:\Users\Admin\AppData\Local\Temp\141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe
"C:\Users\Admin\AppData\Local\Temp\141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Users\Admin\AppData\Local\Temp\141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe
  C:\Users\Admin\AppData\Local\Temp\141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03.exe
  2⤵
  - Modifies WinLogon for persistence
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Users\Admin\Documents\MOKSC\youtube.exe
    "C:\Users\Admin\Documents\MOKSC\youtube.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Users\Admin\Documents\MOKSC\youtube.exe
      C:\Users\Admin\Documents\MOKSC\youtube.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1676
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2804

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2764 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
ffe2abab1751f56ffd8fd89878c7a579

SHA1
45fcb59f5162d78e571bd88daf7158ced22308fb

SHA256
61b9364bebd16023909d16c2fa2654ff4ad420c732f08bc681600d0468d22084

SHA512
a12c0e3ce24d521a0254f16f7a9d8fd6b1f5f1ae3d8c19abc4cc6e32bcc0fee44178b193feaa8b8844a67c8af202716104a1c2915a98af79e15965ca1353a66f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c1c0d41c53ac4df79c66821e0d7b640

SHA1
968cc36d3026cd966acb4282e4ebcc2d5301520e

SHA256
4489a146288560e47c9fc6a1ec8c014f6ed3b56ad7f0f2f0fd79066da0d456b1

SHA512
c2258e557cf84e54bf111d2bf95d7644ae4724037726a849be282bfa16921512de79f4aa04cd3878a89623ebe55e06df44656dd54ec2f613acd232966f6fc772

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ef858de56a997539e02b63300d5bb4b

SHA1
276521aaf2ef61385c8e94498c8965b29bd1164e

SHA256
cab34701414a877bf6ddfdaa796d43fb6436736722457de88b8d513ad6e21ea7

SHA512
b94d5e87efccb0dbe091739e90f5878f4bf12e5d620c1481e6ee56f11334c69e80d2a89580233d59d2c39f49948a6d301b274f42d99646b4e0bbffda30dbcb1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b0996ef3cc8ea0deb298df942ff0f89

SHA1
aeb32d7bd87e68214925227621a5cd06f9f33dab

SHA256
31b03fe1028f9e6f15ac27b454037eee09b3b9af89cb189dde68b59ac3627d69

SHA512
815d0273be28157f9a8c6691d3792d092b4499b2ea686025de10b64f65b87f627e541c8195a531a83c49edc9a9a3f5ddd2f49006fe54b53dbbaccac8ff7b2d3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0499e369497415ec82a993ce04114cd3

SHA1
528a865ebf26c1a04b33f2c3295ae8229d0f549a

SHA256
278f63c1045aa3089a781e1a82f1e930b02c94dc3cb5519a1206f7bfd1381d61

SHA512
4c20c1f810b12f2e57cea80f30804c6ece2cc8b126782541221781a1449ccc467038273ca1d4ce6292d7a797d0d4c211389f37587e6715e52fb83864ab3f1f15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4ddd0e3bf6ea7e07354a92dc68f2f7f

SHA1
a4717486e447fea449ece49bc68814fe080eadbf

SHA256
f45500b8eb140aec67dc337c9220f5595919afd56cee56ae4c78fc65a29a5c08

SHA512
f67152a0d932592245e67697f8df86d4040f0b7bab814eafbd01404a84df9a8c4868eded7cd16fb36d8d3d2dff5c429a7a61f8725043090c83477eee8464adfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06bf698ee0b8b5ec7af4990e6c00047b

SHA1
d4230b6606e977e84d778861dca86559769b73e5

SHA256
46a5a612fc8efc04e1bd5c248274439e7cc5ec473457341afc51bf7a1bde24b4

SHA512
44d8ac1ab966996fbb420f0df562872abdcded775ac618ba75cb1678e35cbd26d9f1f46508bbad1752c14ef588eb1aec8e61455bccae3ac53cfe3b12f9184b56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71d6d2f7516163609df575a242c0dddf

SHA1
6555bb6a45daba878fd086683e957f77842ec14f

SHA256
4486ea66dbf1ba9baa103440631cdce25ea1e44bb8e75513844a47151c976316

SHA512
f7577e9cccf8bd6f87caefdecb27e92cd7cdc9d40aa13c50c5071bb87b0e5259e2d492023ddc24e018cf899b8953d5ddef6a5582380fb8eee895e43d4d504157

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1b7858376c565e27be13f14231d5de7

SHA1
894792ef1320d9e4e063d89619b3e9b11e231bd6

SHA256
b4ce24d7b18d50aa176ff164109b792901b502e2fe19ec0a05aee075bae37cef

SHA512
fbdd19fc7843e91010a7bfd0dbccd96716db9f05e97a5b553ccc23b2a1d4963a71710a3a442bf9b8308c1250f9613062662a28b68fe8a8fbe614e507852d4ae7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
537c73c183734d95a028cd0c33140900

SHA1
9dc4e0684410a7f21e3485c43e3982039e1f5d9c

SHA256
2763f6b0a8573ad226452d70dd84a0dd3fd6b6ed270d83ec614a2fc41ae04d4d

SHA512
067db8e59ec34785ae97c5daf48916eb0f5cc0e717319f6463bdac94c401f203efea92f37391d74e5e5b5cbe3098ed7bc2003da3837187cf832ba2b7c30cb2c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebc6bcde2e757161e08c8fdf91fd3a6b

SHA1
e23e05e7a0090a5a9bd1ca52acdf7a43451f7404

SHA256
e432cfb8867c542e3d8969c600c01675cdf1b78e4dff7b6cf59594bfc10f38ee

SHA512
fcb769af9821452c0a122f408802279b1642da3c094c1094df9b6d785c0a13abf8c11f81dd31af385db6e6b43ddf8df34891e0d72baf26c01e82be0f623d90c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0c4a1a8a8ac28ed45e8add1917ca8669

SHA1
91c91c458f27e9fe8b5a7968df4e0c37324a4deb

SHA256
df75f56e36f4cb0d27372827510a2e9cf02bfa8913126d5bee32d7b6d61da22f

SHA512
b03359ba931d158d59879addca2bab4f5dd57c17c34d433a07a9fd562856634993cb6b3167b5a6b489e549801cfb0249cbd28ebf815d5bfe476742e4d71b46ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1de5cef11869fab37d43be3cb8b9ae1

SHA1
6cec77de8b1b72d5a1e498da503209e88fd0d7f8

SHA256
912257e5d7e0853a25120922dd608c261020b0b4a9daacb9bbd0a9c873df0b66

SHA512
225ac982114e674280f4ab7ace8b8685569a6ed91ae2c8774bbbe082e580d0f4df6b3056cae5fe1e2fda6dc74cbdeb726a933e5a4a25a6f456a9069d96f4308f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a468fcbe44c7f79a937ffabe747ea3f

SHA1
720effe7efe226649e2cb3ebaeb0db5f89be9d4f

SHA256
ae9508bb895abee3a09ce25d20c5fac152decd00ad92c30e16aa506ef65affe9

SHA512
3022f65a406d6bda1c60f531cfcd6760f09d550ea762a9f27b7e3b63ac12b202a079341223f475f75399ec1a02eccecfb0d02f8ccbdaafd1eab577635def43f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7257a6df9fadd17475c0c4c69557bde7

SHA1
9344736726408a7fe542e0478eac843d84b54169

SHA256
6fab16dbbe988d519019b6befb42312c7a2569376322b4b8fb50d5ca8d63fc37

SHA512
9eebbbccda142216498633e653ced9968d4f88eb39d038611ae0d3d508451ddc2e79b235d8e66c95d69dfc5566dd78e240910640e8b256183308acda3771b569

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a225ceaf32951643134bc72771f8d6f

SHA1
6707bae00884178b2b70094a279788e6672ce259

SHA256
c8814b845364fd86cc47e2d821a079d00fbabae71fcf8ccb687977ed25aad94a

SHA512
e55d19930fa95577446a6005baddf89c62e765dfa44c07dda7b849353c01706fc0df4885efba00c9d90c7fab2cf57ed0ac7374b3fcb25988d6a79c49c48f0a6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f6025737ebb68c2d09ed68311541380

SHA1
c941ceddeb2a79a230214ae87628eac4e8f55abe

SHA256
52f71fe8edc1d4fcd8dc06d7fd03418d1898a5894d1cb60bda7c3b8d3491a7ef

SHA512
c60016fe1f3849171d6fcb7df092ccc806eca2d2359e39016e8f8f14d3e21b24c14bb0b281e8fbd45a30d876f575ff7c25e9e7935420a8f9497cdd52f9c78848

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3dc4f4fe18155b8cbb917af8711d955

SHA1
e09534268d637c654ca2584274b320bb521699f5

SHA256
d83fa2611247d57ea02fb1016d033d3bbf58f0405ceb35a94372c0678c05c90e

SHA512
e0258b9841365ad54274249217954a16b71580c9a643851939472bc35f921bbc243216667f5164f5f0efd9bd5378a5dae7235f7d5320964d90f7239c2c3c3052

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35c524e1de7537b96b11fd1d5a547fe5

SHA1
274c8c6368897ff4152cf4cd1a35efc000cc6ddc

SHA256
bfacc1269f29f54637abde9e6dc9b0ce193d2520d6b85b9a3bc338a3f0cb7e53

SHA512
7bcaeb9b9c2e25e2ebc955f3bc78ac2481d0cc14111965adc79ae02c84948109a7d18e7c503f585d7f90c8e114f7f4bf3c01bff7f13f5bfb3ae3fb76b29e252f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82fe3d2735ba97f2927b746594345720

SHA1
7c9d66b157616f39ec4317a7f7ff7ee43d7a39eb

SHA256
243e93be9438ad965196d96918cb8a66a2d467c23c86636b25d0cbfafda36b1c

SHA512
5dd8b1d4e449bdfa87c77004c2c4532f707b906f5a0936137a5c286087aaecd047b4f61b7bd12813fd0ca19f184d7b084a9d60fb214f7d59602501d2964afca5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9d08f35e012e19e9ba0c2194f093b9b

SHA1
7c5b0a9605f2d5be659814b8ef8adfcf9f32a437

SHA256
44600ac19eb03ec4db21a8e4b022c893c3029943a8db1a6c811f48589b161e11

SHA512
cf7bd749dbce7a7892b74e1b2794e8d88fc11651f4b661a251a417b90cf6d948ce7fd93d074f89e3696d20e00cfd9d474dcfd9b6d590ba57e41449bf17752c3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67bae99e7b5f8f9c792f1f080d9e521c

SHA1
4e64f277b51aa3b7feb3a235177e680f302ba595

SHA256
07e0edf3ac7fbea705a0e429732ba99fcfb8185d7cde009766ae0a16ee1aaece

SHA512
ea4f8d3721edc9452ce2bda3253c954d30adb0bf09360ba87fcd9f6855cb40c81fd8abda4b1165e0c08f6e7637d3cbc36ee4ecf15f362c3c4f64a6a81b14dbba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
647a5e8f62719f494d738c5d6b88b36e

SHA1
919973986a13692057fe21cf127da2dd2b9436c1

SHA256
0549982ff32abac8cb3ae1e55c29ba81966189e278f56fa16d9430a559b7a4be

SHA512
fed13f249587df632217959b1219f23bcd12d2618f234990a065d8485b40f44b4301d898afec2f97a667ff1a93b4b44410dd6799787fa4a000e9c9b815280e02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\anyweax\imagestore.dat

Filesize
1KB

MD5
6b88299629ab9dcdececfd42834f98d0

SHA1
1806f1c4f7e076191d8c31e6184a0370fc0c6452

SHA256
421bc1c71a8b60309ab0e660065058b1100b47c291267c3a1c1f58c75ee19721

SHA512
b707bf46ae1466c4b0349eea65ef1baad30b21599cee4f33bd00925fe7c37f11207986096008840d4ab2ad6c550e408c7fa9b99e59a5e0e8df7484dcfeb27dd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y8UFEBH5\favicon[1].ico

Filesize
1KB

MD5
f2a495d85735b9a0ac65deb19c129985

SHA1
f2e22853e5da3e1017d5e1e319eeefe4f622e8c8

SHA256
8bb1d0fa43a17436d59dd546f6f74c76dc44735def7522c22d8031166db8911d

SHA512
6ca6a89de3fa98ca1efcf0b19b8a80420e023f38ed00f4496dc0f821cea23d24fb0992cee58c6d089f093fdefca42b60bb3a0a0b16c97b9862d75b269ae8463b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3D21.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3D33.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E23.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\YOUTUBE.URL

Filesize
351B

MD5
859c7a31fea2af8c830679153d8c40f2

SHA1
dc50eaf04cda5e8fc703039eaba91646f76658b2

SHA256
783307f11716f0749e8275c8745885cfe518cdc1a5e169348eef30c15b4997c8

SHA512
b42e11b7d3ddbb996a69626d72df9e5f381f24b75ea626209a4bcce130695cc6619766ba11ab5b60c9d7b76373c37a718e481985190e6270427676c65c7fd9cc

Download Submit
\Users\Admin\Documents\MOKSC\youtube.exe

Filesize
1.2MB

MD5
0df35e9bc20c616eaf0ec1cbf035f1e5

SHA1
fe5e7ec788f03838289528ccc96f42ee5aaf8e6f

SHA256
141b05d0d385bf28f19c8cb147a8232bef096ee5a24082c022f0e2efe1387d03

SHA512
9b14f02072d7fde33cf4e00cf3289a1adfbb42c3707ce9a30b4149e97aaa9c7a37bc9e2dde365452481c54039efc9fe2eccf6d79217f62b4205d48bd428336d7

Download Submit
memory/1676-633-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/1676-630-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2444-632-0x0000000000400000-0x0000000000677000-memory.dmp

Filesize
2.5MB

Download
memory/2444-68-0x0000000000400000-0x0000000000677000-memory.dmp

Filesize
2.5MB

Download
memory/2444-602-0x0000000000400000-0x0000000000677000-memory.dmp

Filesize
2.5MB

Download
memory/2444-603-0x0000000000400000-0x0000000000677000-memory.dmp

Filesize
2.5MB

Download
memory/2716-67-0x00000000043C0000-0x0000000004637000-memory.dmp

Filesize
2.5MB

Download
memory/2716-40-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2716-27-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2716-65-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2716-58-0x00000000039C0000-0x00000000039C2000-memory.dmp

Filesize
8KB

Download
memory/2716-46-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2716-37-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2716-35-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2716-43-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2716-33-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2716-30-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2716-25-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2716-44-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2716-52-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2716-23-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2716-601-0x00000000043C0000-0x0000000004637000-memory.dmp

Filesize
2.5MB

Download
memory/2736-20-0x0000000003320000-0x0000000003321000-memory.dmp

Filesize
4KB

Download
memory/2736-14-0x00000000002B0000-0x0000000000310000-memory.dmp

Filesize
384KB

Download
memory/2736-18-0x0000000003340000-0x0000000003341000-memory.dmp

Filesize
4KB

Download
memory/2736-21-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2736-17-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2736-16-0x00000000032F0000-0x00000000032F6000-memory.dmp

Filesize
24KB

Download
memory/2736-15-0x0000000003300000-0x0000000003460000-memory.dmp

Filesize
1.4MB

Download
memory/2736-22-0x0000000000400000-0x0000000000677000-memory.dmp

Filesize
2.5MB

Download
memory/2736-51-0x00000000032F0000-0x00000000032F6000-memory.dmp

Filesize
24KB

Download
memory/2736-50-0x0000000000400000-0x0000000000677000-memory.dmp

Filesize
2.5MB

Download
memory/2736-49-0x0000000004540000-0x00000000047B7000-memory.dmp

Filesize
2.5MB

Download
memory/2736-48-0x00000000002B0000-0x0000000000310000-memory.dmp

Filesize
384KB

Download
memory/2736-0-0x0000000000400000-0x0000000000677000-memory.dmp

Filesize
2.5MB

Download
memory/2736-19-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/2736-13-0x0000000000400000-0x0000000000677000-memory.dmp

Filesize
2.5MB

Download
memory/2736-1-0x00000000002B0000-0x0000000000310000-memory.dmp

Filesize
384KB

Download
memory/2736-2-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/2736-3-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download
memory/2736-4-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/2736-5-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/2736-6-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2736-9-0x0000000003310000-0x0000000003311000-memory.dmp

Filesize
4KB

Download
memory/2736-10-0x0000000003300000-0x0000000003302000-memory.dmp

Filesize
8KB

Download
memory/2736-11-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/2736-12-0x0000000003460000-0x0000000003461000-memory.dmp

Filesize
4KB

Download
memory/2736-7-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/2736-8-0x0000000003300000-0x0000000003460000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads