Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10_x64 -
resource
win10 -
submitted
25-10-2020 19:54
Static task
static1
Behavioral task
behavioral1
Sample
d1e4712d3aaa767f88370dd745cef939.exe
Resource
win7
General
-
Target
d1e4712d3aaa767f88370dd745cef939.exe
-
Size
952KB
-
MD5
d1e4712d3aaa767f88370dd745cef939
-
SHA1
a48f26a9d9e1c383938ca74be47c39dafcdf4a49
-
SHA256
81bb2960d19ec9b9c778b010051b08a27dcf29e9fa4ea382bc5163c7e60f55e3
-
SHA512
5613da65ca1cd568ddb2cb27014fe09339145976592ed318600019c022f771b297609b058ea740f47ab307c640e62375ebb6fdcb4634213dadb400d2cbfcce79
Malware Config
Extracted
darkcomet
Guest16
joylynch.ddns.net:100
DC_MUTEX-GUU4ZZV
-
gencode
USwcMCrQTcVd
-
install
false
-
offline_keylogger
true
-
persistence
false
Extracted
pony
http://lynch.herobo.com/pcss/gate.php
Signatures
-
Executes dropped EXE 5 IoCs
Processes:
pony#904.exeNcbService.exeBthHFSrv.exepony#904.exeNcbService.exepid process 3392 pony#904.exe 2464 NcbService.exe 3388 BthHFSrv.exe 1380 pony#904.exe 2076 NcbService.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
d1e4712d3aaa767f88370dd745cef939.exepony#904.exeBthHFSrv.exedescription pid process target process PID 4092 set thread context of 2328 4092 d1e4712d3aaa767f88370dd745cef939.exe vbc.exe PID 3392 set thread context of 1380 3392 pony#904.exe pony#904.exe PID 3388 set thread context of 3708 3388 BthHFSrv.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d1e4712d3aaa767f88370dd745cef939.exeNcbService.exepid process 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 2464 NcbService.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 2464 NcbService.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe 4092 d1e4712d3aaa767f88370dd745cef939.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
d1e4712d3aaa767f88370dd745cef939.exevbc.exeNcbService.exepony#904.exeBthHFSrv.exepony#904.exeNcbService.exedescription pid process Token: SeDebugPrivilege 4092 d1e4712d3aaa767f88370dd745cef939.exe Token: SeIncreaseQuotaPrivilege 2328 vbc.exe Token: SeSecurityPrivilege 2328 vbc.exe Token: SeTakeOwnershipPrivilege 2328 vbc.exe Token: SeLoadDriverPrivilege 2328 vbc.exe Token: SeSystemProfilePrivilege 2328 vbc.exe Token: SeSystemtimePrivilege 2328 vbc.exe Token: SeProfSingleProcessPrivilege 2328 vbc.exe Token: SeIncBasePriorityPrivilege 2328 vbc.exe Token: SeCreatePagefilePrivilege 2328 vbc.exe Token: SeBackupPrivilege 2328 vbc.exe Token: SeRestorePrivilege 2328 vbc.exe Token: SeShutdownPrivilege 2328 vbc.exe Token: SeDebugPrivilege 2328 vbc.exe Token: SeSystemEnvironmentPrivilege 2328 vbc.exe Token: SeChangeNotifyPrivilege 2328 vbc.exe Token: SeRemoteShutdownPrivilege 2328 vbc.exe Token: SeUndockPrivilege 2328 vbc.exe Token: SeManageVolumePrivilege 2328 vbc.exe Token: SeImpersonatePrivilege 2328 vbc.exe Token: SeCreateGlobalPrivilege 2328 vbc.exe Token: 33 2328 vbc.exe Token: 34 2328 vbc.exe Token: 35 2328 vbc.exe Token: 36 2328 vbc.exe Token: SeDebugPrivilege 2464 NcbService.exe Token: SeDebugPrivilege 3392 pony#904.exe Token: SeDebugPrivilege 3388 BthHFSrv.exe Token: SeImpersonatePrivilege 1380 pony#904.exe Token: SeTcbPrivilege 1380 pony#904.exe Token: SeChangeNotifyPrivilege 1380 pony#904.exe Token: SeCreateTokenPrivilege 1380 pony#904.exe Token: SeBackupPrivilege 1380 pony#904.exe Token: SeRestorePrivilege 1380 pony#904.exe Token: SeIncreaseQuotaPrivilege 1380 pony#904.exe Token: SeAssignPrimaryTokenPrivilege 1380 pony#904.exe Token: SeDebugPrivilege 2076 NcbService.exe Token: SeImpersonatePrivilege 1380 pony#904.exe Token: SeTcbPrivilege 1380 pony#904.exe Token: SeChangeNotifyPrivilege 1380 pony#904.exe Token: SeCreateTokenPrivilege 1380 pony#904.exe Token: SeBackupPrivilege 1380 pony#904.exe Token: SeRestorePrivilege 1380 pony#904.exe Token: SeIncreaseQuotaPrivilege 1380 pony#904.exe Token: SeAssignPrimaryTokenPrivilege 1380 pony#904.exe Token: SeImpersonatePrivilege 1380 pony#904.exe Token: SeTcbPrivilege 1380 pony#904.exe Token: SeChangeNotifyPrivilege 1380 pony#904.exe Token: SeCreateTokenPrivilege 1380 pony#904.exe Token: SeBackupPrivilege 1380 pony#904.exe Token: SeRestorePrivilege 1380 pony#904.exe Token: SeIncreaseQuotaPrivilege 1380 pony#904.exe Token: SeAssignPrimaryTokenPrivilege 1380 pony#904.exe Token: SeImpersonatePrivilege 1380 pony#904.exe Token: SeTcbPrivilege 1380 pony#904.exe Token: SeChangeNotifyPrivilege 1380 pony#904.exe Token: SeCreateTokenPrivilege 1380 pony#904.exe Token: SeBackupPrivilege 1380 pony#904.exe Token: SeRestorePrivilege 1380 pony#904.exe Token: SeIncreaseQuotaPrivilege 1380 pony#904.exe Token: SeAssignPrimaryTokenPrivilege 1380 pony#904.exe Token: SeImpersonatePrivilege 1380 pony#904.exe Token: SeTcbPrivilege 1380 pony#904.exe Token: SeChangeNotifyPrivilege 1380 pony#904.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vbc.exepid process 2328 vbc.exe -
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
d1e4712d3aaa767f88370dd745cef939.exeNcbService.exepony#904.exeBthHFSrv.exedescription pid process target process PID 4092 wrote to memory of 3392 4092 d1e4712d3aaa767f88370dd745cef939.exe pony#904.exe PID 4092 wrote to memory of 3392 4092 d1e4712d3aaa767f88370dd745cef939.exe pony#904.exe PID 4092 wrote to memory of 3392 4092 d1e4712d3aaa767f88370dd745cef939.exe pony#904.exe PID 4092 wrote to memory of 2328 4092 d1e4712d3aaa767f88370dd745cef939.exe vbc.exe PID 4092 wrote to memory of 2328 4092 d1e4712d3aaa767f88370dd745cef939.exe vbc.exe PID 4092 wrote to memory of 2328 4092 d1e4712d3aaa767f88370dd745cef939.exe vbc.exe PID 4092 wrote to memory of 2328 4092 d1e4712d3aaa767f88370dd745cef939.exe vbc.exe PID 4092 wrote to memory of 2328 4092 d1e4712d3aaa767f88370dd745cef939.exe vbc.exe PID 4092 wrote to memory of 2328 4092 d1e4712d3aaa767f88370dd745cef939.exe vbc.exe PID 4092 wrote to memory of 2328 4092 d1e4712d3aaa767f88370dd745cef939.exe vbc.exe PID 4092 wrote to memory of 2328 4092 d1e4712d3aaa767f88370dd745cef939.exe vbc.exe PID 4092 wrote to memory of 2328 4092 d1e4712d3aaa767f88370dd745cef939.exe vbc.exe PID 4092 wrote to memory of 2328 4092 d1e4712d3aaa767f88370dd745cef939.exe vbc.exe PID 4092 wrote to memory of 2328 4092 d1e4712d3aaa767f88370dd745cef939.exe vbc.exe PID 4092 wrote to memory of 2328 4092 d1e4712d3aaa767f88370dd745cef939.exe vbc.exe PID 4092 wrote to memory of 2464 4092 d1e4712d3aaa767f88370dd745cef939.exe NcbService.exe PID 4092 wrote to memory of 2464 4092 d1e4712d3aaa767f88370dd745cef939.exe NcbService.exe PID 4092 wrote to memory of 2464 4092 d1e4712d3aaa767f88370dd745cef939.exe NcbService.exe PID 2464 wrote to memory of 3388 2464 NcbService.exe BthHFSrv.exe PID 2464 wrote to memory of 3388 2464 NcbService.exe BthHFSrv.exe PID 2464 wrote to memory of 3388 2464 NcbService.exe BthHFSrv.exe PID 3392 wrote to memory of 1380 3392 pony#904.exe pony#904.exe PID 3392 wrote to memory of 1380 3392 pony#904.exe pony#904.exe PID 3392 wrote to memory of 1380 3392 pony#904.exe pony#904.exe PID 3392 wrote to memory of 1380 3392 pony#904.exe pony#904.exe PID 3392 wrote to memory of 1380 3392 pony#904.exe pony#904.exe PID 3392 wrote to memory of 1380 3392 pony#904.exe pony#904.exe PID 3392 wrote to memory of 1380 3392 pony#904.exe pony#904.exe PID 3392 wrote to memory of 1380 3392 pony#904.exe pony#904.exe PID 3392 wrote to memory of 2076 3392 pony#904.exe NcbService.exe PID 3392 wrote to memory of 2076 3392 pony#904.exe NcbService.exe PID 3392 wrote to memory of 2076 3392 pony#904.exe NcbService.exe PID 3388 wrote to memory of 3708 3388 BthHFSrv.exe vbc.exe PID 3388 wrote to memory of 3708 3388 BthHFSrv.exe vbc.exe PID 3388 wrote to memory of 3708 3388 BthHFSrv.exe vbc.exe PID 3388 wrote to memory of 3708 3388 BthHFSrv.exe vbc.exe PID 3388 wrote to memory of 3708 3388 BthHFSrv.exe vbc.exe PID 3388 wrote to memory of 3708 3388 BthHFSrv.exe vbc.exe PID 3388 wrote to memory of 3708 3388 BthHFSrv.exe vbc.exe PID 3388 wrote to memory of 3708 3388 BthHFSrv.exe vbc.exe PID 3388 wrote to memory of 3708 3388 BthHFSrv.exe vbc.exe PID 3388 wrote to memory of 3708 3388 BthHFSrv.exe vbc.exe PID 3388 wrote to memory of 3708 3388 BthHFSrv.exe vbc.exe PID 3388 wrote to memory of 3708 3388 BthHFSrv.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1e4712d3aaa767f88370dd745cef939.exe"C:\Users\Admin\AppData\Local\Temp\d1e4712d3aaa767f88370dd745cef939.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\Desktop\pony#904.exe"C:\Users\Admin\Desktop\pony#904.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\Desktop\pony#904.exe"C:\Users\Admin\Desktop\pony#904.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1380 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2076 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2328 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\BthHFSrv.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\BthHFSrv3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"4⤵PID:3708
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\NcbService.exe.logMD5
ddad48a7f0ac6322423ee84d360e424c
SHA1e504684c281f04172fc56a55dab6080648b648d0
SHA2562c3b5c83b2d155e15eaaf85853dce51d0a0664d8613e97dfdfda212207dcaf4f
SHA512b5f452a80b2edbe7bb5e3fcac5048bf4b4785d39b815ce4a68eaee79b2efcebd46dd3b585be4c3e53f24ab89e7ad72ed9a6bab1aafd6f0a270d34d9f53224af0
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\BthHFSrv.exeMD5
d1e4712d3aaa767f88370dd745cef939
SHA1a48f26a9d9e1c383938ca74be47c39dafcdf4a49
SHA25681bb2960d19ec9b9c778b010051b08a27dcf29e9fa4ea382bc5163c7e60f55e3
SHA5125613da65ca1cd568ddb2cb27014fe09339145976592ed318600019c022f771b297609b058ea740f47ab307c640e62375ebb6fdcb4634213dadb400d2cbfcce79
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\BthHFSrv.exeMD5
d1e4712d3aaa767f88370dd745cef939
SHA1a48f26a9d9e1c383938ca74be47c39dafcdf4a49
SHA25681bb2960d19ec9b9c778b010051b08a27dcf29e9fa4ea382bc5163c7e60f55e3
SHA5125613da65ca1cd568ddb2cb27014fe09339145976592ed318600019c022f771b297609b058ea740f47ab307c640e62375ebb6fdcb4634213dadb400d2cbfcce79
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exeMD5
9414df91ba64c4c82bfd956988879e61
SHA1d19a527f58c4102d92b4108a6564a4247e3aa844
SHA256fb407f6cdce0fbb2efc69e878f32b5d0ec4c86d928c726a27b4e98c843813bb7
SHA51241abec7d8c0416bc5bb61916c7dc78da1fa06a0cb8f87ccc9795bc8cebca84067640c6907b5eb3f89884509c8f7b4e61a6c0ea38f8b5da579eba650adb144309
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exeMD5
9414df91ba64c4c82bfd956988879e61
SHA1d19a527f58c4102d92b4108a6564a4247e3aa844
SHA256fb407f6cdce0fbb2efc69e878f32b5d0ec4c86d928c726a27b4e98c843813bb7
SHA51241abec7d8c0416bc5bb61916c7dc78da1fa06a0cb8f87ccc9795bc8cebca84067640c6907b5eb3f89884509c8f7b4e61a6c0ea38f8b5da579eba650adb144309
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exeMD5
9414df91ba64c4c82bfd956988879e61
SHA1d19a527f58c4102d92b4108a6564a4247e3aa844
SHA256fb407f6cdce0fbb2efc69e878f32b5d0ec4c86d928c726a27b4e98c843813bb7
SHA51241abec7d8c0416bc5bb61916c7dc78da1fa06a0cb8f87ccc9795bc8cebca84067640c6907b5eb3f89884509c8f7b4e61a6c0ea38f8b5da579eba650adb144309
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exeMD5
9414df91ba64c4c82bfd956988879e61
SHA1d19a527f58c4102d92b4108a6564a4247e3aa844
SHA256fb407f6cdce0fbb2efc69e878f32b5d0ec4c86d928c726a27b4e98c843813bb7
SHA51241abec7d8c0416bc5bb61916c7dc78da1fa06a0cb8f87ccc9795bc8cebca84067640c6907b5eb3f89884509c8f7b4e61a6c0ea38f8b5da579eba650adb144309
-
C:\Users\Admin\Desktop\pony#904.exeMD5
2c859cb22d53ca31d82916ba16dbde1a
SHA1150d442f694d8fe962f42f0db5531adcd0700851
SHA25622b74388c7b6da854adac2900b6577aab0e180a5d3daff90e1b1049751fd87b2
SHA512192a2f609624f4b6c92de626964fd3c967efec0ac68bf5cea2c315830a35dc5b13acb2da00be0ec2887e8472dbe4d2c27c86f9ceb9991f3a8ea41ed708720134
-
C:\Users\Admin\Desktop\pony#904.exeMD5
2c859cb22d53ca31d82916ba16dbde1a
SHA1150d442f694d8fe962f42f0db5531adcd0700851
SHA25622b74388c7b6da854adac2900b6577aab0e180a5d3daff90e1b1049751fd87b2
SHA512192a2f609624f4b6c92de626964fd3c967efec0ac68bf5cea2c315830a35dc5b13acb2da00be0ec2887e8472dbe4d2c27c86f9ceb9991f3a8ea41ed708720134
-
C:\Users\Admin\Desktop\pony#904.exeMD5
2c859cb22d53ca31d82916ba16dbde1a
SHA1150d442f694d8fe962f42f0db5531adcd0700851
SHA25622b74388c7b6da854adac2900b6577aab0e180a5d3daff90e1b1049751fd87b2
SHA512192a2f609624f4b6c92de626964fd3c967efec0ac68bf5cea2c315830a35dc5b13acb2da00be0ec2887e8472dbe4d2c27c86f9ceb9991f3a8ea41ed708720134
-
memory/1380-15-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1380-12-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1380-13-0x000000000041003A-mapping.dmp
-
memory/2076-16-0x0000000000000000-mapping.dmp
-
memory/2328-5-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2328-4-0x000000000048F888-mapping.dmp
-
memory/2328-3-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2464-6-0x0000000000000000-mapping.dmp
-
memory/3388-9-0x0000000000000000-mapping.dmp
-
memory/3392-0-0x0000000000000000-mapping.dmp
-
memory/3708-21-0x000000000048F888-mapping.dmp