Analysis
-
max time kernel
150s -
max time network
65s -
platform
windows7_x64 -
resource
win7 -
submitted
24-06-2020 15:06
Static task
static1
Behavioral task
behavioral1
Sample
8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe
Resource
win7
Behavioral task
behavioral2
Sample
8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe
Resource
win10v200430
General
-
Target
8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe
-
Size
1.4MB
-
MD5
a537053d61af5278eea232eeb3ccc02f
-
SHA1
d5159b8e11babcf46a844521d2a651b79c4ba8f1
-
SHA256
8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc
-
SHA512
a073993c43ebf94638e64e248a06ff02fbae9d2bcea5343a2a9ce3f91280c322dd171abeabd5d72f8972259a60f4c8fbfbe0a061e82c375227696c4db7ff98da
Malware Config
Extracted
darkcomet
Trade
gringomonster.no-ip.org:81
gringomonster.no-ip.org:82
gringomonster.no-ip.org:2000
gringomonster.no-ip.org:3000
gringomonster.no-ip.org:4000
gringomonster.no-ip.org:5000
DC_MUTEX-5RK5HC8
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
R47hPfLks2Sb
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe -
Executes dropped EXE 2 IoCs
Processes:
msdcsc.exemsdcsc.exepid process 1512 msdcsc.exe 344 msdcsc.exe -
Loads dropped DLL 1 IoCs
Processes:
8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exepid process 316 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Drops file in System32 directory 3 IoCs
Processes:
8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exedescription ioc process File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exemsdcsc.exedescription pid process target process PID 1124 set thread context of 316 1124 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe PID 1512 set thread context of 344 1512 msdcsc.exe msdcsc.exe -
autoit_exe 4 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule \Windows\SysWOW64\MSDCSC\msdcsc.exe autoit_exe C:\Windows\SysWOW64\MSDCSC\msdcsc.exe autoit_exe C:\Windows\SysWOW64\MSDCSC\msdcsc.exe autoit_exe C:\Windows\SysWOW64\MSDCSC\msdcsc.exe autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 316 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe Token: SeSecurityPrivilege 316 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe Token: SeTakeOwnershipPrivilege 316 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe Token: SeLoadDriverPrivilege 316 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe Token: SeSystemProfilePrivilege 316 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe Token: SeSystemtimePrivilege 316 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe Token: SeProfSingleProcessPrivilege 316 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe Token: SeIncBasePriorityPrivilege 316 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe Token: SeCreatePagefilePrivilege 316 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe Token: SeBackupPrivilege 316 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe Token: SeRestorePrivilege 316 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe Token: SeShutdownPrivilege 316 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe Token: SeDebugPrivilege 316 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe Token: SeSystemEnvironmentPrivilege 316 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe Token: SeChangeNotifyPrivilege 316 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe Token: SeRemoteShutdownPrivilege 316 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe Token: SeUndockPrivilege 316 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe Token: SeManageVolumePrivilege 316 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe Token: SeImpersonatePrivilege 316 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe Token: SeCreateGlobalPrivilege 316 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe Token: 33 316 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe Token: 34 316 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe Token: 35 316 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe Token: SeIncreaseQuotaPrivilege 344 msdcsc.exe Token: SeSecurityPrivilege 344 msdcsc.exe Token: SeTakeOwnershipPrivilege 344 msdcsc.exe Token: SeLoadDriverPrivilege 344 msdcsc.exe Token: SeSystemProfilePrivilege 344 msdcsc.exe Token: SeSystemtimePrivilege 344 msdcsc.exe Token: SeProfSingleProcessPrivilege 344 msdcsc.exe Token: SeIncBasePriorityPrivilege 344 msdcsc.exe Token: SeCreatePagefilePrivilege 344 msdcsc.exe Token: SeBackupPrivilege 344 msdcsc.exe Token: SeRestorePrivilege 344 msdcsc.exe Token: SeShutdownPrivilege 344 msdcsc.exe Token: SeDebugPrivilege 344 msdcsc.exe Token: SeSystemEnvironmentPrivilege 344 msdcsc.exe Token: SeChangeNotifyPrivilege 344 msdcsc.exe Token: SeRemoteShutdownPrivilege 344 msdcsc.exe Token: SeUndockPrivilege 344 msdcsc.exe Token: SeManageVolumePrivilege 344 msdcsc.exe Token: SeImpersonatePrivilege 344 msdcsc.exe Token: SeCreateGlobalPrivilege 344 msdcsc.exe Token: 33 344 msdcsc.exe Token: 34 344 msdcsc.exe Token: 35 344 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 344 msdcsc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exemsdcsc.exedescription pid process target process PID 1124 wrote to memory of 316 1124 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe PID 1124 wrote to memory of 316 1124 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe PID 1124 wrote to memory of 316 1124 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe PID 1124 wrote to memory of 316 1124 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe PID 1124 wrote to memory of 316 1124 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe PID 1124 wrote to memory of 316 1124 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe PID 1124 wrote to memory of 316 1124 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe PID 1124 wrote to memory of 316 1124 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe PID 1124 wrote to memory of 316 1124 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe PID 1124 wrote to memory of 316 1124 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe PID 1124 wrote to memory of 316 1124 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe PID 1124 wrote to memory of 316 1124 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe PID 316 wrote to memory of 1512 316 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe msdcsc.exe PID 316 wrote to memory of 1512 316 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe msdcsc.exe PID 316 wrote to memory of 1512 316 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe msdcsc.exe PID 316 wrote to memory of 1512 316 8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe msdcsc.exe PID 1512 wrote to memory of 344 1512 msdcsc.exe msdcsc.exe PID 1512 wrote to memory of 344 1512 msdcsc.exe msdcsc.exe PID 1512 wrote to memory of 344 1512 msdcsc.exe msdcsc.exe PID 1512 wrote to memory of 344 1512 msdcsc.exe msdcsc.exe PID 1512 wrote to memory of 344 1512 msdcsc.exe msdcsc.exe PID 1512 wrote to memory of 344 1512 msdcsc.exe msdcsc.exe PID 1512 wrote to memory of 344 1512 msdcsc.exe msdcsc.exe PID 1512 wrote to memory of 344 1512 msdcsc.exe msdcsc.exe PID 1512 wrote to memory of 344 1512 msdcsc.exe msdcsc.exe PID 1512 wrote to memory of 344 1512 msdcsc.exe msdcsc.exe PID 1512 wrote to memory of 344 1512 msdcsc.exe msdcsc.exe PID 1512 wrote to memory of 344 1512 msdcsc.exe msdcsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe"C:\Users\Admin\AppData\Local\Temp\8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe"C:\Users\Admin\AppData\Local\Temp\8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc.exe"2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:344
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeMD5
a537053d61af5278eea232eeb3ccc02f
SHA1d5159b8e11babcf46a844521d2a651b79c4ba8f1
SHA2568a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc
SHA512a073993c43ebf94638e64e248a06ff02fbae9d2bcea5343a2a9ce3f91280c322dd171abeabd5d72f8972259a60f4c8fbfbe0a061e82c375227696c4db7ff98da
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeMD5
a537053d61af5278eea232eeb3ccc02f
SHA1d5159b8e11babcf46a844521d2a651b79c4ba8f1
SHA2568a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc
SHA512a073993c43ebf94638e64e248a06ff02fbae9d2bcea5343a2a9ce3f91280c322dd171abeabd5d72f8972259a60f4c8fbfbe0a061e82c375227696c4db7ff98da
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeMD5
a537053d61af5278eea232eeb3ccc02f
SHA1d5159b8e11babcf46a844521d2a651b79c4ba8f1
SHA2568a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc
SHA512a073993c43ebf94638e64e248a06ff02fbae9d2bcea5343a2a9ce3f91280c322dd171abeabd5d72f8972259a60f4c8fbfbe0a061e82c375227696c4db7ff98da
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeMD5
a537053d61af5278eea232eeb3ccc02f
SHA1d5159b8e11babcf46a844521d2a651b79c4ba8f1
SHA2568a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc
SHA512a073993c43ebf94638e64e248a06ff02fbae9d2bcea5343a2a9ce3f91280c322dd171abeabd5d72f8972259a60f4c8fbfbe0a061e82c375227696c4db7ff98da
-
memory/316-0-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/316-1-0x000000000048F888-mapping.dmp
-
memory/316-2-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/344-8-0x000000000048F888-mapping.dmp
-
memory/344-10-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1512-4-0x0000000000000000-mapping.dmp