Analysis
- max time kernel
149s - max time network
148s - platform
windows10_x64 - resource
win10 - submitted
24/06/2020, 15:06
Static task
static1
Behavioral task
behavioral1
Sample
c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe
- Size 932KB
- Sample200624-v7pg8gxvbx
- SHA256 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9
- MD5 1dc80685c258916d30f9bf2365d76ff5
- SHA1 bc0111105913d61308b5164833d31574d0391543
- SHA512 7bf344038fc679919f30f93070c666c5409d76f81b8a79cf6aeda9d356ad7b9b570de0e994b4dd20096e3b3869b63ad496361f08bbd24eaa3eea6580aa965ba2
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
Test Server
C2
-
127.0.0.1:1604
Mutex
-
DC_MUTEX-4XKPULH
Attributes
-
gencode
LBSgYfRa7QDe
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
- Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" STEWART LOGO.EXE - Executes dropped EXE 6 IoCs
pid Process 3016 taskmgr.exe 760 STEWART LOGO.EXE 1016 STEWART LOGO.EXE 652 svchost.com 912 notepad.exe 2336 svchost.com - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\chrome.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\facebook.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\facebook.exe" reg.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2880 set thread context of 3016 2880 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 70 PID 1016 set thread context of 912 1016 STEWART LOGO.EXE 75 - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~4.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOF5E2~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe svchost.com File opened for modification C:\PROGRA~2\WINDOW~2\WinMail.exe svchost.com File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe svchost.com File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe svchost.com File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe svchost.com File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Google\Chrome\APPLIC~1\830410~1.106\CHROME~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Google\Chrome\APPLIC~1\chrome.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GO664E~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe svchost.com File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\WINDOW~2\WinMail.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe svchost.com File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Google\Temp\GUM3D84.tmp\GOFB2B~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~3.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~2.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Google\Chrome\APPLIC~1\830410~1.106\INSTAL~1\setup.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe svchost.com File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe svchost.com File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOFB2B~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe svchost.com File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe svchost.com File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe svchost.com File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Google\Chrome\APPLIC~1\830410~1.106\NOTIFI~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe svchost.com File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Google\Chrome\APPLIC~1\830410~1.106\INSTAL~1\chrmstp.exe STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE STEWART LOGO.EXE File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE STEWART LOGO.EXE - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com STEWART LOGO.EXE - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" STEWART LOGO.EXE Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings STEWART LOGO.EXE - Modifies registry key 1 TTPs 2 IoCs
pid Process 3932 reg.exe 1340 reg.exe - Suspicious use of AdjustPrivilegeToken 26 IoCs
description pid Process Token: SeDebugPrivilege 2880 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe Token: SeDebugPrivilege 1016 STEWART LOGO.EXE Token: SeIncreaseQuotaPrivilege 912 notepad.exe Token: SeSecurityPrivilege 912 notepad.exe Token: SeTakeOwnershipPrivilege 912 notepad.exe Token: SeLoadDriverPrivilege 912 notepad.exe Token: SeSystemProfilePrivilege 912 notepad.exe Token: SeSystemtimePrivilege 912 notepad.exe Token: SeProfSingleProcessPrivilege 912 notepad.exe Token: SeIncBasePriorityPrivilege 912 notepad.exe Token: SeCreatePagefilePrivilege 912 notepad.exe Token: SeBackupPrivilege 912 notepad.exe Token: SeRestorePrivilege 912 notepad.exe Token: SeShutdownPrivilege 912 notepad.exe Token: SeDebugPrivilege 912 notepad.exe Token: SeSystemEnvironmentPrivilege 912 notepad.exe Token: SeChangeNotifyPrivilege 912 notepad.exe Token: SeRemoteShutdownPrivilege 912 notepad.exe Token: SeUndockPrivilege 912 notepad.exe Token: SeManageVolumePrivilege 912 notepad.exe Token: SeImpersonatePrivilege 912 notepad.exe Token: SeCreateGlobalPrivilege 912 notepad.exe Token: 33 912 notepad.exe Token: 34 912 notepad.exe Token: 35 912 notepad.exe Token: 36 912 notepad.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 912 notepad.exe - Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 2880 wrote to memory of 3884 2880 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 67 PID 2880 wrote to memory of 3884 2880 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 67 PID 2880 wrote to memory of 3884 2880 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 67 PID 3884 wrote to memory of 3932 3884 cmd.exe 69 PID 3884 wrote to memory of 3932 3884 cmd.exe 69 PID 3884 wrote to memory of 3932 3884 cmd.exe 69 PID 2880 wrote to memory of 3016 2880 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 70 PID 2880 wrote to memory of 3016 2880 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 70 PID 2880 wrote to memory of 3016 2880 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 70 PID 2880 wrote to memory of 3016 2880 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 70 PID 2880 wrote to memory of 3016 2880 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 70 PID 2880 wrote to memory of 3016 2880 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 70 PID 2880 wrote to memory of 3016 2880 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 70 PID 2880 wrote to memory of 3016 2880 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 70 PID 2880 wrote to memory of 3016 2880 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 70 PID 2880 wrote to memory of 3016 2880 c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe 70 PID 3016 wrote to memory of 760 3016 taskmgr.exe 71 PID 3016 wrote to memory of 760 3016 taskmgr.exe 71 PID 3016 wrote to memory of 760 3016 taskmgr.exe 71 PID 760 wrote to memory of 1016 760 STEWART LOGO.EXE 72 PID 760 wrote to memory of 1016 760 STEWART LOGO.EXE 72 PID 760 wrote to memory of 1016 760 STEWART LOGO.EXE 72 PID 1016 wrote to memory of 652 1016 STEWART LOGO.EXE 73 PID 1016 wrote to memory of 652 1016 STEWART LOGO.EXE 73 PID 1016 wrote to memory of 652 1016 STEWART LOGO.EXE 73 PID 652 wrote to memory of 860 652 svchost.com 74 PID 652 wrote to memory of 860 652 svchost.com 74 PID 652 wrote to memory of 860 652 svchost.com 74 PID 1016 wrote to memory of 912 1016 STEWART LOGO.EXE 75 PID 1016 wrote to memory of 912 1016 STEWART LOGO.EXE 75 PID 1016 wrote to memory of 912 1016 STEWART LOGO.EXE 75 PID 1016 wrote to memory of 912 1016 STEWART LOGO.EXE 75 PID 1016 wrote to memory of 912 1016 STEWART LOGO.EXE 75 PID 1016 wrote to memory of 912 1016 STEWART LOGO.EXE 75 PID 1016 wrote to memory of 912 1016 STEWART LOGO.EXE 75 PID 1016 wrote to memory of 912 1016 STEWART LOGO.EXE 75 PID 1016 wrote to memory of 912 1016 STEWART LOGO.EXE 75 PID 1016 wrote to memory of 912 1016 STEWART LOGO.EXE 75 PID 1016 wrote to memory of 912 1016 STEWART LOGO.EXE 75 PID 1016 wrote to memory of 912 1016 STEWART LOGO.EXE 75 PID 1016 wrote to memory of 912 1016 STEWART LOGO.EXE 75 PID 1016 wrote to memory of 912 1016 STEWART LOGO.EXE 75 PID 860 wrote to memory of 1340 860 cmd.exe 77 PID 860 wrote to memory of 1340 860 cmd.exe 77 PID 860 wrote to memory of 1340 860 cmd.exe 77 PID 1016 wrote to memory of 2336 1016 STEWART LOGO.EXE 78 PID 1016 wrote to memory of 2336 1016 STEWART LOGO.EXE 78 PID 1016 wrote to memory of 2336 1016 STEWART LOGO.EXE 78 PID 2336 wrote to memory of 3680 2336 svchost.com 79 PID 2336 wrote to memory of 3680 2336 svchost.com 79 PID 2336 wrote to memory of 3680 2336 svchost.com 79 PID 3680 wrote to memory of 2692 3680 cmd.exe 81 PID 3680 wrote to memory of 2692 3680 cmd.exe 81 PID 3680 wrote to memory of 2692 3680 cmd.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe"C:\Users\Admin\AppData\Local\Temp\c2c82ee2700333d677bee2937f99b1e5657f339e23c27b5b7d2a397b672fffd9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /V chrome.exe /T REG_SZ /D C:\Users\Admin\AppData\Local\Temp\chrome.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /V chrome.exe /T REG_SZ /D C:\Users\Admin\AppData\Local\Temp\chrome.exe3⤵
- Adds Run key to start application
- Modifies registry key
PID:3932
-
-
-
C:\Users\Admin\AppData\Local\Temp\taskmgr.exeC:\Users\Admin\AppData\Local\Temp\taskmgr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\STEWART LOGO.EXE"C:\Users\Admin\AppData\Local\Temp\STEWART LOGO.EXE"3⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\3582-490\STEWART LOGO.EXE"C:\Users\Admin\AppData\Local\Temp\3582-490\STEWART LOGO.EXE"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /V facebook.exe /T REG_SZ /D C:\Users\Admin\AppData\Local\Temp\facebook.exe5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /C REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /V facebook.exe /T REG_SZ /D C:\Users\Admin\AppData\Local\Temp\facebook.exe6⤵
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /V facebook.exe /T REG_SZ /D C:\Users\Admin\AppData\Local\Temp\facebook.exe7⤵
- Adds Run key to start application
- Modifies registry key
PID:1340
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\notepad.exeC:\Users\Admin\AppData\Local\Temp\notepad.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:912
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del C:\Users\Admin\AppData\Local\Temp\3582-490\STEWART LOGO.EXE5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /C choice /C Y /N /D Y /T 3 & Del C:\Users\Admin\AppData\Local\Temp\3582-490\STEWART LOGO.EXE6⤵
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 37⤵PID:2692
-
-
-
-
-
-