Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
06-11-2020 11:11
Static task
static1
Behavioral task
behavioral1
Sample
c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe
Resource
win7v20201028
General
-
Target
c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe
-
Size
252KB
-
MD5
9d1f92ac5af5eff6e517e587e1e8278b
-
SHA1
732ca21d250323be7b2ef24c3c335005e839b196
-
SHA256
c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608
-
SHA512
715a7cdb9f2270c447aae9df60be3a2ace48fa276da2ef09161b558b255434e74f5fb3c423b82813c1574bd37e2645ea1cea3375bb613c2b6c7064ed95478063
Malware Config
Extracted
darkcomet
Guest16
ximer2020.ddns.net:1604
DC_MUTEX-4U0HFC0
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
aDFqoxfKfrcR
-
install
true
-
offline_keylogger
true
-
password
82121020202222
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 3948 msdcsc.exe -
Processes:
resource yara_rule C:\Users\Admin\Documents\MSDCSC\msdcsc.exe upx C:\Users\Admin\Documents\MSDCSC\msdcsc.exe upx behavioral2/memory/3028-6-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3028-8-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3028-9-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 3116 notepad.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exemsdcsc.exeiexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" iexplore.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
msdcsc.exedescription pid process target process PID 3948 set thread context of 3028 3948 msdcsc.exe iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 3028 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exemsdcsc.exeiexplore.exedescription pid process Token: SeIncreaseQuotaPrivilege 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeSecurityPrivilege 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeTakeOwnershipPrivilege 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeLoadDriverPrivilege 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeSystemProfilePrivilege 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeSystemtimePrivilege 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeProfSingleProcessPrivilege 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeIncBasePriorityPrivilege 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeCreatePagefilePrivilege 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeBackupPrivilege 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeRestorePrivilege 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeShutdownPrivilege 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeDebugPrivilege 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeSystemEnvironmentPrivilege 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeChangeNotifyPrivilege 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeRemoteShutdownPrivilege 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeUndockPrivilege 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeManageVolumePrivilege 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeImpersonatePrivilege 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeCreateGlobalPrivilege 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: 33 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: 34 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: 35 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: 36 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe Token: SeIncreaseQuotaPrivilege 3948 msdcsc.exe Token: SeSecurityPrivilege 3948 msdcsc.exe Token: SeTakeOwnershipPrivilege 3948 msdcsc.exe Token: SeLoadDriverPrivilege 3948 msdcsc.exe Token: SeSystemProfilePrivilege 3948 msdcsc.exe Token: SeSystemtimePrivilege 3948 msdcsc.exe Token: SeProfSingleProcessPrivilege 3948 msdcsc.exe Token: SeIncBasePriorityPrivilege 3948 msdcsc.exe Token: SeCreatePagefilePrivilege 3948 msdcsc.exe Token: SeBackupPrivilege 3948 msdcsc.exe Token: SeRestorePrivilege 3948 msdcsc.exe Token: SeShutdownPrivilege 3948 msdcsc.exe Token: SeDebugPrivilege 3948 msdcsc.exe Token: SeSystemEnvironmentPrivilege 3948 msdcsc.exe Token: SeChangeNotifyPrivilege 3948 msdcsc.exe Token: SeRemoteShutdownPrivilege 3948 msdcsc.exe Token: SeUndockPrivilege 3948 msdcsc.exe Token: SeManageVolumePrivilege 3948 msdcsc.exe Token: SeImpersonatePrivilege 3948 msdcsc.exe Token: SeCreateGlobalPrivilege 3948 msdcsc.exe Token: 33 3948 msdcsc.exe Token: 34 3948 msdcsc.exe Token: 35 3948 msdcsc.exe Token: 36 3948 msdcsc.exe Token: SeIncreaseQuotaPrivilege 3028 iexplore.exe Token: SeSecurityPrivilege 3028 iexplore.exe Token: SeTakeOwnershipPrivilege 3028 iexplore.exe Token: SeLoadDriverPrivilege 3028 iexplore.exe Token: SeSystemProfilePrivilege 3028 iexplore.exe Token: SeSystemtimePrivilege 3028 iexplore.exe Token: SeProfSingleProcessPrivilege 3028 iexplore.exe Token: SeIncBasePriorityPrivilege 3028 iexplore.exe Token: SeCreatePagefilePrivilege 3028 iexplore.exe Token: SeBackupPrivilege 3028 iexplore.exe Token: SeRestorePrivilege 3028 iexplore.exe Token: SeShutdownPrivilege 3028 iexplore.exe Token: SeDebugPrivilege 3028 iexplore.exe Token: SeSystemEnvironmentPrivilege 3028 iexplore.exe Token: SeChangeNotifyPrivilege 3028 iexplore.exe Token: SeRemoteShutdownPrivilege 3028 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
iexplore.exepid process 3028 iexplore.exe -
Suspicious use of WriteProcessMemory 47 IoCs
Processes:
c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exemsdcsc.exeiexplore.exedescription pid process target process PID 732 wrote to memory of 3116 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 732 wrote to memory of 3116 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 732 wrote to memory of 3116 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 732 wrote to memory of 3116 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 732 wrote to memory of 3116 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 732 wrote to memory of 3116 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 732 wrote to memory of 3116 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 732 wrote to memory of 3116 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 732 wrote to memory of 3116 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 732 wrote to memory of 3116 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 732 wrote to memory of 3116 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 732 wrote to memory of 3116 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 732 wrote to memory of 3116 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 732 wrote to memory of 3116 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 732 wrote to memory of 3116 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 732 wrote to memory of 3116 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 732 wrote to memory of 3116 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe notepad.exe PID 732 wrote to memory of 3948 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe msdcsc.exe PID 732 wrote to memory of 3948 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe msdcsc.exe PID 732 wrote to memory of 3948 732 c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe msdcsc.exe PID 3948 wrote to memory of 3028 3948 msdcsc.exe iexplore.exe PID 3948 wrote to memory of 3028 3948 msdcsc.exe iexplore.exe PID 3948 wrote to memory of 3028 3948 msdcsc.exe iexplore.exe PID 3948 wrote to memory of 3028 3948 msdcsc.exe iexplore.exe PID 3948 wrote to memory of 3028 3948 msdcsc.exe iexplore.exe PID 3028 wrote to memory of 1612 3028 iexplore.exe notepad.exe PID 3028 wrote to memory of 1612 3028 iexplore.exe notepad.exe PID 3028 wrote to memory of 1612 3028 iexplore.exe notepad.exe PID 3028 wrote to memory of 1612 3028 iexplore.exe notepad.exe PID 3028 wrote to memory of 1612 3028 iexplore.exe notepad.exe PID 3028 wrote to memory of 1612 3028 iexplore.exe notepad.exe PID 3028 wrote to memory of 1612 3028 iexplore.exe notepad.exe PID 3028 wrote to memory of 1612 3028 iexplore.exe notepad.exe PID 3028 wrote to memory of 1612 3028 iexplore.exe notepad.exe PID 3028 wrote to memory of 1612 3028 iexplore.exe notepad.exe PID 3028 wrote to memory of 1612 3028 iexplore.exe notepad.exe PID 3028 wrote to memory of 1612 3028 iexplore.exe notepad.exe PID 3028 wrote to memory of 1612 3028 iexplore.exe notepad.exe PID 3028 wrote to memory of 1612 3028 iexplore.exe notepad.exe PID 3028 wrote to memory of 1612 3028 iexplore.exe notepad.exe PID 3028 wrote to memory of 1612 3028 iexplore.exe notepad.exe PID 3028 wrote to memory of 1612 3028 iexplore.exe notepad.exe PID 3028 wrote to memory of 1612 3028 iexplore.exe notepad.exe PID 3028 wrote to memory of 1612 3028 iexplore.exe notepad.exe PID 3028 wrote to memory of 1612 3028 iexplore.exe notepad.exe PID 3028 wrote to memory of 1612 3028 iexplore.exe notepad.exe PID 3028 wrote to memory of 1612 3028 iexplore.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe"C:\Users\Admin\AppData\Local\Temp\c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
9d1f92ac5af5eff6e517e587e1e8278b
SHA1732ca21d250323be7b2ef24c3c335005e839b196
SHA256c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608
SHA512715a7cdb9f2270c447aae9df60be3a2ace48fa276da2ef09161b558b255434e74f5fb3c423b82813c1574bd37e2645ea1cea3375bb613c2b6c7064ed95478063
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
9d1f92ac5af5eff6e517e587e1e8278b
SHA1732ca21d250323be7b2ef24c3c335005e839b196
SHA256c97cf0d0a0a498ecfd3474d97cf5314f399dacea63701df422f1b0199ad28608
SHA512715a7cdb9f2270c447aae9df60be3a2ace48fa276da2ef09161b558b255434e74f5fb3c423b82813c1574bd37e2645ea1cea3375bb613c2b6c7064ed95478063
-
memory/1612-12-0x0000000000000000-mapping.dmp
-
memory/1612-11-0x0000000002C40000-0x0000000002C41000-memory.dmpFilesize
4KB
-
memory/1612-10-0x0000000000000000-mapping.dmp
-
memory/3028-9-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3028-6-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3028-7-0x00000000004B5820-mapping.dmp
-
memory/3028-8-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3116-0-0x0000000000000000-mapping.dmp
-
memory/3116-2-0x0000000000000000-mapping.dmp
-
memory/3116-1-0x0000000002E80000-0x0000000002E81000-memory.dmpFilesize
4KB
-
memory/3948-3-0x0000000000000000-mapping.dmp