API tools faq
paste
paladin316

Exes_8c3c65a6bb8b9a83d2dcde37a426095f_exe_2019-07-29_21_30.txt

paladin316
Jul 29th, 2019
2,108
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 26.68 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Darkcomet"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe"
  7. * File Size: 1964087
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "744c0125a0f50af6de01134ebcad7930e8d7e0a7867f8a1997b1baa2857c1abf"
  10. * MD5: "8c3c65a6bb8b9a83d2dcde37a426095f"
  11. * SHA1: "ec9cd0027ddda27633f8b4cc63bb4d214535c375"
  12. * SHA512: "b6a518006d037ae7ec203106fe16e4b92311af6d82ae0d1e37cc9372a94c3198d36d732863945062384833fceb11884ba2f0568627af9ab7ec3c428edce2a732"
  13. * CRC32: "0F8B0826"
  14. * SSDEEP: "49152:G5PlQYk2fPknQv3hOUt/WCsoViOKsfFrrIpnI:G5Per2nknQf4W+xXArspnI"
  15.  
  16. * Process Execution:
  17. "Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe",
  18. "wscript.exe",
  19. "bsv.exe",
  20. "bsv.exe",
  21. "RegSvcs.exe"
  22.  
  23.  
  24. * Executed Commands:
  25. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\mot.vbs\"",
  26. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\mot.vbs ",
  27. "\"C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\bsv.exe\" qqf=woj",
  28. "bsv.exe qqf=woj",
  29. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\bsv.exe C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\PHNTF"
  30.  
  31.  
  32. * Signatures Detected:
  33.  
  34. "Description": "Possible date expiration check, exits too soon after checking local time",
  35. "Details":
  36.  
  37. "process": "bsv.exe, PID 1108"
  38.  
  39.  
  40.  
  41.  
  42. "Description": "Creates RWX memory",
  43. "Details":
  44.  
  45.  
  46. "Description": "Detected script timer window indicative of sleep style evasion",
  47. "Details":
  48.  
  49. "Window": "WSH-Timer"
  50.  
  51.  
  52.  
  53.  
  54. "Description": "A process attempted to delay the analysis task.",
  55. "Details":
  56.  
  57. "Process": "RegSvcs.exe tried to sleep 288 seconds, actually delayed analysis time by 0 seconds"
  58.  
  59.  
  60.  
  61.  
  62. "Description": "Reads data out of its own binary image",
  63. "Details":
  64.  
  65. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00000000, length: 0x00000007"
  66.  
  67.  
  68. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00000000, length: 0x00002000"
  69.  
  70.  
  71. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00000007, length: 0x001df830"
  72.  
  73.  
  74. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00001ff0, length: 0x00002000"
  75.  
  76.  
  77. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00003fe0, length: 0x00002000"
  78.  
  79.  
  80. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00005fd0, length: 0x00002000"
  81.  
  82.  
  83. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00007fc0, length: 0x00002000"
  84.  
  85.  
  86. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00009fb0, length: 0x00002000"
  87.  
  88.  
  89. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x0000bfa0, length: 0x00002000"
  90.  
  91.  
  92. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x0000df90, length: 0x00002000"
  93.  
  94.  
  95. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x0000ff80, length: 0x00002000"
  96.  
  97.  
  98. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00011f70, length: 0x00002000"
  99.  
  100.  
  101. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00013f60, length: 0x00002000"
  102.  
  103.  
  104. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00015f50, length: 0x00002000"
  105.  
  106.  
  107. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00017f40, length: 0x00002000"
  108.  
  109.  
  110. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00019f30, length: 0x00002000"
  111.  
  112.  
  113. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x0001bf20, length: 0x00002000"
  114.  
  115.  
  116. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x0001df10, length: 0x00002000"
  117.  
  118.  
  119. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x0001ff00, length: 0x00002000"
  120.  
  121.  
  122. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00021ef0, length: 0x00002000"
  123.  
  124.  
  125. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00023ee0, length: 0x00002000"
  126.  
  127.  
  128. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00025ed0, length: 0x00002000"
  129.  
  130.  
  131. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00027ec0, length: 0x00002000"
  132.  
  133.  
  134. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00029eb0, length: 0x00002000"
  135.  
  136.  
  137. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x0002bea0, length: 0x00002000"
  138.  
  139.  
  140. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x0002de90, length: 0x00002000"
  141.  
  142.  
  143. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x0002fe80, length: 0x00002000"
  144.  
  145.  
  146. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00031e70, length: 0x00002000"
  147.  
  148.  
  149. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00033e60, length: 0x00002000"
  150.  
  151.  
  152. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00035e50, length: 0x00002000"
  153.  
  154.  
  155. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00037e40, length: 0x00002000"
  156.  
  157.  
  158. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00039e30, length: 0x00002000"
  159.  
  160.  
  161. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x0003be20, length: 0x00002000"
  162.  
  163.  
  164. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x0003de10, length: 0x00002000"
  165.  
  166.  
  167. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x0003fe00, length: 0x00002000"
  168.  
  169.  
  170. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00041df0, length: 0x00002000"
  171.  
  172.  
  173. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00043de0, length: 0x00002000"
  174.  
  175.  
  176. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00045dd0, length: 0x00002000"
  177.  
  178.  
  179. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00047dc0, length: 0x00002000"
  180.  
  181.  
  182. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00049db0, length: 0x00002000"
  183.  
  184.  
  185. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x0004bda0, length: 0x00002000"
  186.  
  187.  
  188. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x0004dd90, length: 0x00002000"
  189.  
  190.  
  191. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x0004fd80, length: 0x00002000"
  192.  
  193.  
  194. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00050a00, length: 0x00000031"
  195.  
  196.  
  197. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x00050a19, length: 0x0018beee"
  198.  
  199.  
  200. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x001dcac1, length: 0x00000028"
  201.  
  202.  
  203. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x001dcca4, length: 0x00000028"
  204.  
  205.  
  206. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x001dce71, length: 0x00000028"
  207.  
  208.  
  209. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x001dd03f, length: 0x00000028"
  210.  
  211.  
  212. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x001dd237, length: 0x00000028"
  213.  
  214.  
  215. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x001dd42e, length: 0x00000028"
  216.  
  217.  
  218. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x001dd610, length: 0x00000028"
  219.  
  220.  
  221. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x001dd80e, length: 0x00000029"
  222.  
  223.  
  224. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x001dda1c, length: 0x00000028"
  225.  
  226.  
  227. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x001ddc22, length: 0x00000028"
  228.  
  229.  
  230. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x001dde14, length: 0x00000027"
  231.  
  232.  
  233. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x001de01d, length: 0x00000027"
  234.  
  235.  
  236. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x001de1f0, length: 0x00000028"
  237.  
  238.  
  239. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x001de3e5, length: 0x00000028"
  240.  
  241.  
  242. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x001de5f2, length: 0x00000029"
  243.  
  244.  
  245. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x001de7e2, length: 0x00000028"
  246.  
  247.  
  248. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x001de9e9, length: 0x00000028"
  249.  
  250.  
  251. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x001dec04, length: 0x00000028"
  252.  
  253.  
  254. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x001dedf7, length: 0x00000028"
  255.  
  256.  
  257. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x001defc6, length: 0x00000028"
  258.  
  259.  
  260. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x001df1e0, length: 0x00000028"
  261.  
  262.  
  263. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x001df3c2, length: 0x00000027"
  264.  
  265.  
  266. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x001df594, length: 0x00000028"
  267.  
  268.  
  269. "self_read": "process: Exes_8c3c65a6bb8b9a83d2dcde37a426095f.exe, pid: 628, offset: 0x001df77e, length: 0x0000001b"
  270.  
  271.  
  272. "self_read": "process: wscript.exe, pid: 1048, offset: 0x00000000, length: 0x00000040"
  273.  
  274.  
  275. "self_read": "process: wscript.exe, pid: 1048, offset: 0x000000f0, length: 0x00000018"
  276.  
  277.  
  278. "self_read": "process: wscript.exe, pid: 1048, offset: 0x000001e8, length: 0x00000078"
  279.  
  280.  
  281. "self_read": "process: wscript.exe, pid: 1048, offset: 0x00018000, length: 0x00000020"
  282.  
  283.  
  284. "self_read": "process: wscript.exe, pid: 1048, offset: 0x00018058, length: 0x00000018"
  285.  
  286.  
  287. "self_read": "process: wscript.exe, pid: 1048, offset: 0x000181a8, length: 0x00000018"
  288.  
  289.  
  290. "self_read": "process: wscript.exe, pid: 1048, offset: 0x00018470, length: 0x00000010"
  291.  
  292.  
  293. "self_read": "process: wscript.exe, pid: 1048, offset: 0x00018640, length: 0x00000012"
  294.  
  295.  
  296.  
  297.  
  298. "Description": "Drops a binary and executes it",
  299. "Details":
  300.  
  301. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\bsv.exe"
  302.  
  303.  
  304.  
  305.  
  306. "Description": "Executed a process and injected code into it, probably while unpacking",
  307. "Details":
  308.  
  309. "Injection": "bsv.exe(2528) -> RegSvcs.exe(492)"
  310.  
  311.  
  312.  
  313.  
  314. "Description": "Sniffs keystrokes",
  315. "Details":
  316.  
  317. "SetWindowsHookExA": "Process: RegSvcs.exe(492)"
  318.  
  319.  
  320.  
  321.  
  322. "Description": "Installs itself for autorun at Windows startup",
  323. "Details":
  324.  
  325. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsUpdate"
  326.  
  327.  
  328. "data": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\bsv.exe C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\QQF_WO~1"
  329.  
  330.  
  331.  
  332.  
  333. "Description": "Creates a hidden or system file",
  334. "Details":
  335.  
  336. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\bsv.exe"
  337.  
  338.  
  339. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\aaj.mp4"
  340.  
  341.  
  342. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\bnc.icm"
  343.  
  344.  
  345. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\civ.icm"
  346.  
  347.  
  348. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\cje.xl"
  349.  
  350.  
  351. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\cla.jpg"
  352.  
  353.  
  354. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\dep.dat"
  355.  
  356.  
  357. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\die.xl"
  358.  
  359.  
  360. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\dpb.jpg"
  361.  
  362.  
  363. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\dww.bmp"
  364.  
  365.  
  366. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\exq.dat"
  367.  
  368.  
  369. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\faq.mp3"
  370.  
  371.  
  372. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\fde.pdf"
  373.  
  374.  
  375. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\fjq.docx"
  376.  
  377.  
  378. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\gjk.ico"
  379.  
  380.  
  381. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\gni.icm"
  382.  
  383.  
  384. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\gur.jpg"
  385.  
  386.  
  387. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\hkj.docx"
  388.  
  389.  
  390. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\hnd.mp3"
  391.  
  392.  
  393. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\hxq.ppt"
  394.  
  395.  
  396. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\icu.xl"
  397.  
  398.  
  399. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\jdo.docx"
  400.  
  401.  
  402. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\jut.docx"
  403.  
  404.  
  405. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\kot.mp3"
  406.  
  407.  
  408. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\ldt.icm"
  409.  
  410.  
  411. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\lmw.mp4"
  412.  
  413.  
  414. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\mot.vbs"
  415.  
  416.  
  417. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\pjt.icm"
  418.  
  419.  
  420. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\psx.xl"
  421.  
  422.  
  423. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\pto.ico"
  424.  
  425.  
  426. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\qdu.bmp"
  427.  
  428.  
  429. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\qji.ico"
  430.  
  431.  
  432. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\qqf=woj"
  433.  
  434.  
  435. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\rde.mp4"
  436.  
  437.  
  438. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\rhi.ppt"
  439.  
  440.  
  441. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\rlb.icm"
  442.  
  443.  
  444. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\ron.ico"
  445.  
  446.  
  447. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\skp.ppt"
  448.  
  449.  
  450. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\usx.docx"
  451.  
  452.  
  453. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\vqi.bmp"
  454.  
  455.  
  456. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\whu.txt"
  457.  
  458.  
  459. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\xhn.ico"
  460.  
  461.  
  462. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\xhn.pdf"
  463.  
  464.  
  465. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\xil.dat"
  466.  
  467.  
  468. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\xks.icm"
  469.  
  470.  
  471. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\63836911"
  472.  
  473.  
  474.  
  475.  
  476. "Description": "File has been identified by 21 Antiviruses on VirusTotal as malicious",
  477. "Details":
  478.  
  479. "FireEye": "Generic.mg.8c3c65a6bb8b9a83"
  480.  
  481.  
  482. "McAfee": "Artemis!8C3C65A6BB8B"
  483.  
  484.  
  485. "Cylance": "Unsafe"
  486.  
  487.  
  488. "Alibaba": "Trojan:Win32/Starter.ali2000005"
  489.  
  490.  
  491. "K7GW": "Riskware ( 0040eff71 )"
  492.  
  493.  
  494. "K7AntiVirus": "Riskware ( 0040eff71 )"
  495.  
  496.  
  497. "Symantec": "Trojan Horse"
  498.  
  499.  
  500. "APEX": "Malicious"
  501.  
  502.  
  503. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  504.  
  505.  
  506. "AegisLab": "Trojan.BAT.Crypter.tqa8"
  507.  
  508.  
  509. "Endgame": "malicious (moderate confidence)"
  510.  
  511.  
  512. "Invincea": "heuristic"
  513.  
  514.  
  515. "McAfee-GW-Edition": "BehavesLike.Win32.Backdoor.tc"
  516.  
  517.  
  518. "Paloalto": "generic.ml"
  519.  
  520.  
  521. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  522.  
  523.  
  524. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  525.  
  526.  
  527. "AhnLab-V3": "Trojan/Win32.RL_Agent.R273974"
  528.  
  529.  
  530. "Zoner": "Probably RARAutorun"
  531.  
  532.  
  533. "AVG": "FileRepMetagen Malware"
  534.  
  535.  
  536. "Cybereason": "malicious.27ddda"
  537.  
  538.  
  539. "CrowdStrike": "win/malicious_confidence_70% (W)"
  540.  
  541.  
  542.  
  543.  
  544. "Description": "Interacts with known DarkComet registry keys",
  545. "Details":
  546.  
  547. "Key": "HKEY_CURRENT_USER\\Software\\DC3_FEXEC"
  548.  
  549.  
  550. "Key": "HKEY_CURRENT_USER\\Software\\DC3_FEXEC\\3d3783a0-703a-11de-8c7a-806e6f6e6963-3250959951"
  551.  
  552.  
  553. "Key": "HKEY_CURRENT_USER\\Software\\DC2_USERS"
  554.  
  555.  
  556.  
  557.  
  558.  
  559. * Started Service:
  560.  
  561. * Mutexes:
  562. "DefaultTabtip-MainUI",
  563. "CicLoadWinStaWinSta0",
  564. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  565. "Local\\ZoneAttributeCacheCounterMutex",
  566. "Local\\ZonesCacheCounterMutex",
  567. "Local\\ZonesLockedCacheCounterMutex",
  568. "DCMIN_MUTEX-GZQPZ2G"
  569.  
  570.  
  571. * Modified Files:
  572. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\__tmp_rar_sfx_access_check_2261625",
  573. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\lmw.mp4",
  574. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\qqf=woj",
  575. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\mot.vbs",
  576. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\bsv.exe",
  577. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\xks.icm",
  578. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\dep.dat",
  579. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\hkj.docx",
  580. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\qdu.bmp",
  581. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\ldt.icm",
  582. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\icu.xl",
  583. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\gur.jpg",
  584. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\hnd.mp3",
  585. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\exq.dat",
  586. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\gjk.ico",
  587. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\jut.docx",
  588. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\xil.dat",
  589. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\qji.ico",
  590. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\pto.ico",
  591. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\usx.docx",
  592. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\ron.ico",
  593. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\whu.txt",
  594. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\rde.mp4",
  595. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\pjt.icm",
  596. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\hxq.ppt",
  597. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\civ.icm",
  598. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\cla.jpg",
  599. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\aaj.mp4",
  600. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\fde.pdf",
  601. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\skp.ppt",
  602. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\jdo.docx",
  603. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\rhi.ppt",
  604. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\dpb.jpg",
  605. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\die.xl",
  606. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\cje.xl",
  607. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\rlb.icm",
  608. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\faq.mp3",
  609. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\fjq.docx",
  610. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\kot.mp3",
  611. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\gni.icm",
  612. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\xhn.pdf",
  613. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\dww.bmp",
  614. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\bnc.icm",
  615. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\xhn.ico",
  616. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\psx.xl",
  617. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\vqi.bmp",
  618. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\PHNTF"
  619.  
  620.  
  621. * Deleted Files:
  622. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\__tmp_rar_sfx_access_check_2261625",
  623. "C:\\Users\\user\\AppData\\Local\\Temp\\63836911\\PHNTF"
  624.  
  625.  
  626. * Modified Registry Keys:
  627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  629. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  630. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsUpdate",
  631. "HKEY_CURRENT_USER\\Software\\DC3_FEXEC"
  632.  
  633.  
  634. * Deleted Registry Keys:
  635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  636. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  638. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"
  639.  
  640.  
  641. * DNS Communications:
  642.  
  643. "type": "A",
  644. "request": "benzkartel.duckdns.org",
  645. "answers":
  646.  
  647. "data": "192.169.69.25",
  648. "type": "A"
  649.  
  650.  
  651.  
  652.  
  653.  
  654. * Domains:
  655.  
  656. "ip": "192.169.69.25",
  657. "domain": "benzkartel.duckdns.org"
  658.  
  659.  
  660.  
  661. * Network Communication - ICMP:
  662.  
  663. * Network Communication - HTTP:
  664.  
  665. * Network Communication - SMTP:
  666.  
  667. * Network Communication - Hosts:
  668.  
  669. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!