Analysis
-
max time kernel
38s -
max time network
53s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
29-06-2020 07:12
Static task
static1
Behavioral task
behavioral1
Sample
78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe
Resource
win10
General
-
Target
78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe
-
Size
1.5MB
-
MD5
edb8b19beede18b21ec7ebc847271fd1
-
SHA1
8ec1c660059fc6a0571782fe17ed30787055b278
-
SHA256
78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398
-
SHA512
88197dc5f5480378481f0fc8165c051dc87148176fcae89a9367eaf004506d82755596f89c0d6fecbea5005301514caf507c1145edd9b657192258d10804e5c3
Malware Config
Extracted
darkcomet
Sazan
ya123131.duckdns.org:1604
DC_MUTEX-LYRTGU5
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
m1B9veJm8Qlx
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exevbc.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft@Software = "C:\\Users\\Admin\\AppData\\Local\\Temp\\78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe" 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exedescription pid process target process PID 804 set thread context of 756 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe vbc.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
vbc.exedescription pid process Token: SeIncreaseQuotaPrivilege 756 vbc.exe Token: SeSecurityPrivilege 756 vbc.exe Token: SeTakeOwnershipPrivilege 756 vbc.exe Token: SeLoadDriverPrivilege 756 vbc.exe Token: SeSystemProfilePrivilege 756 vbc.exe Token: SeSystemtimePrivilege 756 vbc.exe Token: SeProfSingleProcessPrivilege 756 vbc.exe Token: SeIncBasePriorityPrivilege 756 vbc.exe Token: SeCreatePagefilePrivilege 756 vbc.exe Token: SeBackupPrivilege 756 vbc.exe Token: SeRestorePrivilege 756 vbc.exe Token: SeShutdownPrivilege 756 vbc.exe Token: SeDebugPrivilege 756 vbc.exe Token: SeSystemEnvironmentPrivilege 756 vbc.exe Token: SeChangeNotifyPrivilege 756 vbc.exe Token: SeRemoteShutdownPrivilege 756 vbc.exe Token: SeUndockPrivilege 756 vbc.exe Token: SeManageVolumePrivilege 756 vbc.exe Token: SeImpersonatePrivilege 756 vbc.exe Token: SeCreateGlobalPrivilege 756 vbc.exe Token: 33 756 vbc.exe Token: 34 756 vbc.exe Token: 35 756 vbc.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exepid process 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exepid process 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exedescription pid process target process PID 804 wrote to memory of 756 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe vbc.exe PID 804 wrote to memory of 756 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe vbc.exe PID 804 wrote to memory of 756 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe vbc.exe PID 804 wrote to memory of 756 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe vbc.exe PID 804 wrote to memory of 756 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe vbc.exe PID 804 wrote to memory of 756 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe vbc.exe PID 804 wrote to memory of 756 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe vbc.exe PID 804 wrote to memory of 756 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe vbc.exe PID 804 wrote to memory of 756 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe vbc.exe PID 804 wrote to memory of 756 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe vbc.exe PID 804 wrote to memory of 756 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe vbc.exe PID 804 wrote to memory of 756 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe vbc.exe PID 804 wrote to memory of 756 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe"C:\Users\Admin\AppData\Local\Temp\78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:756