Analysis
- max time kernel
38s - max time network
53s - platform
windows7_x64 - resource
win7v200430 - submitted
29/06/2020, 07:12
Static task
static1
Behavioral task
behavioral1
Sample
78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe
- Size 1.5MB
- Sample200629-jjdlydfl4j
- SHA256 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398
- MD5 edb8b19beede18b21ec7ebc847271fd1
- SHA1 8ec1c660059fc6a0571782fe17ed30787055b278
- SHA512 88197dc5f5480378481f0fc8165c051dc87148176fcae89a9367eaf004506d82755596f89c0d6fecbea5005301514caf507c1145edd9b657192258d10804e5c3
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
Sazan
C2
-
ya123131.duckdns.org:1604
Mutex
-
DC_MUTEX-LYRTGU5
Attributes
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
m1B9veJm8Qlx
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" vbc.exe - Uses the VBS compiler for execution 1 TTPs
- Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft@Software = "C:\\Users\\Admin\\AppData\\Local\\Temp\\78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe" 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" vbc.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 804 set thread context of 756 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe 24 - Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 756 vbc.exe Token: SeSecurityPrivilege 756 vbc.exe Token: SeTakeOwnershipPrivilege 756 vbc.exe Token: SeLoadDriverPrivilege 756 vbc.exe Token: SeSystemProfilePrivilege 756 vbc.exe Token: SeSystemtimePrivilege 756 vbc.exe Token: SeProfSingleProcessPrivilege 756 vbc.exe Token: SeIncBasePriorityPrivilege 756 vbc.exe Token: SeCreatePagefilePrivilege 756 vbc.exe Token: SeBackupPrivilege 756 vbc.exe Token: SeRestorePrivilege 756 vbc.exe Token: SeShutdownPrivilege 756 vbc.exe Token: SeDebugPrivilege 756 vbc.exe Token: SeSystemEnvironmentPrivilege 756 vbc.exe Token: SeChangeNotifyPrivilege 756 vbc.exe Token: SeRemoteShutdownPrivilege 756 vbc.exe Token: SeUndockPrivilege 756 vbc.exe Token: SeManageVolumePrivilege 756 vbc.exe Token: SeImpersonatePrivilege 756 vbc.exe Token: SeCreateGlobalPrivilege 756 vbc.exe Token: 33 756 vbc.exe Token: 34 756 vbc.exe Token: 35 756 vbc.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 804 wrote to memory of 756 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe 24 PID 804 wrote to memory of 756 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe 24 PID 804 wrote to memory of 756 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe 24 PID 804 wrote to memory of 756 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe 24 PID 804 wrote to memory of 756 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe 24 PID 804 wrote to memory of 756 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe 24 PID 804 wrote to memory of 756 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe 24 PID 804 wrote to memory of 756 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe 24 PID 804 wrote to memory of 756 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe 24 PID 804 wrote to memory of 756 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe 24 PID 804 wrote to memory of 756 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe 24 PID 804 wrote to memory of 756 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe 24 PID 804 wrote to memory of 756 804 78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe 24
Processes
-
C:\Users\Admin\AppData\Local\Temp\78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe"C:\Users\Admin\AppData\Local\Temp\78b1751491463b0d579eda079654d1dfb9296b98e2867b4fdc765256e5962398.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:756
-