Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
06-11-2020 11:46
Static task
static1
Behavioral task
behavioral1
Sample
58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe
Resource
win7v20201028
General
-
Target
58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe
-
Size
752KB
-
MD5
72cb9f5693c7dff79fecd8cdb3880ea8
-
SHA1
9b7ac2f7dd26ae17c0048f630286f13689f195bb
-
SHA256
58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453
-
SHA512
06b040c5766c6d4639d77130ca4653dc7083d9af47d25d7a0975958d1412d9606ba8cc2b20b67594355b60c1f9d2ce1a8b8adbc323f65276c30e7e56b03786f5
Malware Config
Extracted
darkcomet
2020NOV5
sandyclark255.hopto.org:1605
DC_MUTEX-XRQ89VC
-
InstallPath
skypew.exe
-
gencode
pZP6alYpcpSq
-
install
true
-
offline_keylogger
true
-
password
hhhhhh
-
persistence
true
-
reg_key
skype
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svehoste.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\skypew.exe" svehoste.exe -
Disables Task Manager via registry modification
-
Drops file in Drivers directory 1 IoCs
Processes:
svehoste.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts svehoste.exe -
Executes dropped EXE 4 IoCs
Processes:
svehoste.exesvehoste.exeskypew.exesvehoste.exepid process 1592 svehoste.exe 1580 svehoste.exe 936 skypew.exe 524 svehoste.exe -
Loads dropped DLL 4 IoCs
Processes:
58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exesvehoste.exeskypew.exepid process 1704 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe 1704 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe 1580 svehoste.exe 936 skypew.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svehoste.exesvehoste.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\skype = "C:\\Users\\Admin\\Documents\\skypew.exe" svehoste.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\skype = "C:\\Users\\Admin\\Documents\\skypew.exe" svehoste.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exeskypew.exedescription pid process target process PID 1704 set thread context of 1580 1704 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 936 set thread context of 524 936 skypew.exe svehoste.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exeskypew.exepid process 1704 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe 1704 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe 1704 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe 1704 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe 936 skypew.exe 936 skypew.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exesvehoste.exeskypew.exesvehoste.exedescription pid process Token: SeDebugPrivilege 1704 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe Token: SeIncreaseQuotaPrivilege 1580 svehoste.exe Token: SeSecurityPrivilege 1580 svehoste.exe Token: SeTakeOwnershipPrivilege 1580 svehoste.exe Token: SeLoadDriverPrivilege 1580 svehoste.exe Token: SeSystemProfilePrivilege 1580 svehoste.exe Token: SeSystemtimePrivilege 1580 svehoste.exe Token: SeProfSingleProcessPrivilege 1580 svehoste.exe Token: SeIncBasePriorityPrivilege 1580 svehoste.exe Token: SeCreatePagefilePrivilege 1580 svehoste.exe Token: SeBackupPrivilege 1580 svehoste.exe Token: SeRestorePrivilege 1580 svehoste.exe Token: SeShutdownPrivilege 1580 svehoste.exe Token: SeDebugPrivilege 1580 svehoste.exe Token: SeSystemEnvironmentPrivilege 1580 svehoste.exe Token: SeChangeNotifyPrivilege 1580 svehoste.exe Token: SeRemoteShutdownPrivilege 1580 svehoste.exe Token: SeUndockPrivilege 1580 svehoste.exe Token: SeManageVolumePrivilege 1580 svehoste.exe Token: SeImpersonatePrivilege 1580 svehoste.exe Token: SeCreateGlobalPrivilege 1580 svehoste.exe Token: 33 1580 svehoste.exe Token: 34 1580 svehoste.exe Token: 35 1580 svehoste.exe Token: SeDebugPrivilege 936 skypew.exe Token: SeIncreaseQuotaPrivilege 524 svehoste.exe Token: SeSecurityPrivilege 524 svehoste.exe Token: SeTakeOwnershipPrivilege 524 svehoste.exe Token: SeLoadDriverPrivilege 524 svehoste.exe Token: SeSystemProfilePrivilege 524 svehoste.exe Token: SeSystemtimePrivilege 524 svehoste.exe Token: SeProfSingleProcessPrivilege 524 svehoste.exe Token: SeIncBasePriorityPrivilege 524 svehoste.exe Token: SeCreatePagefilePrivilege 524 svehoste.exe Token: SeBackupPrivilege 524 svehoste.exe Token: SeRestorePrivilege 524 svehoste.exe Token: SeShutdownPrivilege 524 svehoste.exe Token: SeDebugPrivilege 524 svehoste.exe Token: SeSystemEnvironmentPrivilege 524 svehoste.exe Token: SeChangeNotifyPrivilege 524 svehoste.exe Token: SeRemoteShutdownPrivilege 524 svehoste.exe Token: SeUndockPrivilege 524 svehoste.exe Token: SeManageVolumePrivilege 524 svehoste.exe Token: SeImpersonatePrivilege 524 svehoste.exe Token: SeCreateGlobalPrivilege 524 svehoste.exe Token: 33 524 svehoste.exe Token: 34 524 svehoste.exe Token: 35 524 svehoste.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
svehoste.exepid process 524 svehoste.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exesvehoste.exeskypew.exesvehoste.exedescription pid process target process PID 1704 wrote to memory of 1592 1704 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 1704 wrote to memory of 1592 1704 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 1704 wrote to memory of 1592 1704 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 1704 wrote to memory of 1592 1704 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 1704 wrote to memory of 1580 1704 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 1704 wrote to memory of 1580 1704 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 1704 wrote to memory of 1580 1704 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 1704 wrote to memory of 1580 1704 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 1704 wrote to memory of 1580 1704 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 1704 wrote to memory of 1580 1704 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 1704 wrote to memory of 1580 1704 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 1704 wrote to memory of 1580 1704 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 1704 wrote to memory of 1580 1704 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 1704 wrote to memory of 1580 1704 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 1704 wrote to memory of 1580 1704 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 1704 wrote to memory of 1580 1704 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 1704 wrote to memory of 1580 1704 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 1580 wrote to memory of 592 1580 svehoste.exe notepad.exe PID 1580 wrote to memory of 592 1580 svehoste.exe notepad.exe PID 1580 wrote to memory of 592 1580 svehoste.exe notepad.exe PID 1580 wrote to memory of 592 1580 svehoste.exe notepad.exe PID 1580 wrote to memory of 592 1580 svehoste.exe notepad.exe PID 1580 wrote to memory of 592 1580 svehoste.exe notepad.exe PID 1580 wrote to memory of 592 1580 svehoste.exe notepad.exe PID 1580 wrote to memory of 592 1580 svehoste.exe notepad.exe PID 1580 wrote to memory of 592 1580 svehoste.exe notepad.exe PID 1580 wrote to memory of 592 1580 svehoste.exe notepad.exe PID 1580 wrote to memory of 592 1580 svehoste.exe notepad.exe PID 1580 wrote to memory of 592 1580 svehoste.exe notepad.exe PID 1580 wrote to memory of 592 1580 svehoste.exe notepad.exe PID 1580 wrote to memory of 592 1580 svehoste.exe notepad.exe PID 1580 wrote to memory of 592 1580 svehoste.exe notepad.exe PID 1580 wrote to memory of 592 1580 svehoste.exe notepad.exe PID 1580 wrote to memory of 592 1580 svehoste.exe notepad.exe PID 1580 wrote to memory of 592 1580 svehoste.exe notepad.exe PID 1580 wrote to memory of 936 1580 svehoste.exe skypew.exe PID 1580 wrote to memory of 936 1580 svehoste.exe skypew.exe PID 1580 wrote to memory of 936 1580 svehoste.exe skypew.exe PID 1580 wrote to memory of 936 1580 svehoste.exe skypew.exe PID 936 wrote to memory of 524 936 skypew.exe svehoste.exe PID 936 wrote to memory of 524 936 skypew.exe svehoste.exe PID 936 wrote to memory of 524 936 skypew.exe svehoste.exe PID 936 wrote to memory of 524 936 skypew.exe svehoste.exe PID 936 wrote to memory of 524 936 skypew.exe svehoste.exe PID 936 wrote to memory of 524 936 skypew.exe svehoste.exe PID 936 wrote to memory of 524 936 skypew.exe svehoste.exe PID 936 wrote to memory of 524 936 skypew.exe svehoste.exe PID 936 wrote to memory of 524 936 skypew.exe svehoste.exe PID 936 wrote to memory of 524 936 skypew.exe svehoste.exe PID 936 wrote to memory of 524 936 skypew.exe svehoste.exe PID 936 wrote to memory of 524 936 skypew.exe svehoste.exe PID 936 wrote to memory of 524 936 skypew.exe svehoste.exe PID 524 wrote to memory of 1540 524 svehoste.exe notepad.exe PID 524 wrote to memory of 1540 524 svehoste.exe notepad.exe PID 524 wrote to memory of 1540 524 svehoste.exe notepad.exe PID 524 wrote to memory of 1540 524 svehoste.exe notepad.exe PID 524 wrote to memory of 1540 524 svehoste.exe notepad.exe PID 524 wrote to memory of 1540 524 svehoste.exe notepad.exe PID 524 wrote to memory of 1540 524 svehoste.exe notepad.exe PID 524 wrote to memory of 1540 524 svehoste.exe notepad.exe PID 524 wrote to memory of 1540 524 svehoste.exe notepad.exe PID 524 wrote to memory of 1540 524 svehoste.exe notepad.exe PID 524 wrote to memory of 1540 524 svehoste.exe notepad.exe PID 524 wrote to memory of 1540 524 svehoste.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe"C:\Users\Admin\AppData\Local\Temp\58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sduiHi6p255fGT7C\svehoste.exe"C:\Users\Admin\AppData\Local\Temp\sduiHi6p255fGT7C\svehoste.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\sduiHi6p255fGT7C\svehoste.exe"C:\Users\Admin\AppData\Local\Temp\sduiHi6p255fGT7C\svehoste.exe"2⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
-
C:\Users\Admin\Documents\skypew.exe"C:\Users\Admin\Documents\skypew.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sduiHi6p255fGT7C\svehoste.exe"C:\Users\Admin\AppData\Local\Temp\sduiHi6p255fGT7C\svehoste.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\sduiHi6p255fGT7C\svehoste.exeMD5
72cb9f5693c7dff79fecd8cdb3880ea8
SHA19b7ac2f7dd26ae17c0048f630286f13689f195bb
SHA25658a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453
SHA51206b040c5766c6d4639d77130ca4653dc7083d9af47d25d7a0975958d1412d9606ba8cc2b20b67594355b60c1f9d2ce1a8b8adbc323f65276c30e7e56b03786f5
-
C:\Users\Admin\AppData\Local\Temp\sduiHi6p255fGT7C\svehoste.exeMD5
72cb9f5693c7dff79fecd8cdb3880ea8
SHA19b7ac2f7dd26ae17c0048f630286f13689f195bb
SHA25658a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453
SHA51206b040c5766c6d4639d77130ca4653dc7083d9af47d25d7a0975958d1412d9606ba8cc2b20b67594355b60c1f9d2ce1a8b8adbc323f65276c30e7e56b03786f5
-
C:\Users\Admin\AppData\Local\Temp\sduiHi6p255fGT7C\svehoste.exeMD5
72cb9f5693c7dff79fecd8cdb3880ea8
SHA19b7ac2f7dd26ae17c0048f630286f13689f195bb
SHA25658a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453
SHA51206b040c5766c6d4639d77130ca4653dc7083d9af47d25d7a0975958d1412d9606ba8cc2b20b67594355b60c1f9d2ce1a8b8adbc323f65276c30e7e56b03786f5
-
C:\Users\Admin\AppData\Local\Temp\sduiHi6p255fGT7C\svehoste.exeMD5
72cb9f5693c7dff79fecd8cdb3880ea8
SHA19b7ac2f7dd26ae17c0048f630286f13689f195bb
SHA25658a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453
SHA51206b040c5766c6d4639d77130ca4653dc7083d9af47d25d7a0975958d1412d9606ba8cc2b20b67594355b60c1f9d2ce1a8b8adbc323f65276c30e7e56b03786f5
-
C:\Users\Admin\AppData\Local\Temp\sduiHi6p255fGT7C\svehoste.exeMD5
72cb9f5693c7dff79fecd8cdb3880ea8
SHA19b7ac2f7dd26ae17c0048f630286f13689f195bb
SHA25658a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453
SHA51206b040c5766c6d4639d77130ca4653dc7083d9af47d25d7a0975958d1412d9606ba8cc2b20b67594355b60c1f9d2ce1a8b8adbc323f65276c30e7e56b03786f5
-
C:\Users\Admin\Documents\skypew.exeMD5
72cb9f5693c7dff79fecd8cdb3880ea8
SHA19b7ac2f7dd26ae17c0048f630286f13689f195bb
SHA25658a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453
SHA51206b040c5766c6d4639d77130ca4653dc7083d9af47d25d7a0975958d1412d9606ba8cc2b20b67594355b60c1f9d2ce1a8b8adbc323f65276c30e7e56b03786f5
-
C:\Users\Admin\Documents\skypew.exeMD5
72cb9f5693c7dff79fecd8cdb3880ea8
SHA19b7ac2f7dd26ae17c0048f630286f13689f195bb
SHA25658a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453
SHA51206b040c5766c6d4639d77130ca4653dc7083d9af47d25d7a0975958d1412d9606ba8cc2b20b67594355b60c1f9d2ce1a8b8adbc323f65276c30e7e56b03786f5
-
\Users\Admin\AppData\Local\Temp\sduiHi6p255fGT7C\svehoste.exeMD5
72cb9f5693c7dff79fecd8cdb3880ea8
SHA19b7ac2f7dd26ae17c0048f630286f13689f195bb
SHA25658a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453
SHA51206b040c5766c6d4639d77130ca4653dc7083d9af47d25d7a0975958d1412d9606ba8cc2b20b67594355b60c1f9d2ce1a8b8adbc323f65276c30e7e56b03786f5
-
\Users\Admin\AppData\Local\Temp\sduiHi6p255fGT7C\svehoste.exeMD5
72cb9f5693c7dff79fecd8cdb3880ea8
SHA19b7ac2f7dd26ae17c0048f630286f13689f195bb
SHA25658a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453
SHA51206b040c5766c6d4639d77130ca4653dc7083d9af47d25d7a0975958d1412d9606ba8cc2b20b67594355b60c1f9d2ce1a8b8adbc323f65276c30e7e56b03786f5
-
\Users\Admin\AppData\Local\Temp\sduiHi6p255fGT7C\svehoste.exeMD5
72cb9f5693c7dff79fecd8cdb3880ea8
SHA19b7ac2f7dd26ae17c0048f630286f13689f195bb
SHA25658a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453
SHA51206b040c5766c6d4639d77130ca4653dc7083d9af47d25d7a0975958d1412d9606ba8cc2b20b67594355b60c1f9d2ce1a8b8adbc323f65276c30e7e56b03786f5
-
\Users\Admin\Documents\skypew.exeMD5
72cb9f5693c7dff79fecd8cdb3880ea8
SHA19b7ac2f7dd26ae17c0048f630286f13689f195bb
SHA25658a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453
SHA51206b040c5766c6d4639d77130ca4653dc7083d9af47d25d7a0975958d1412d9606ba8cc2b20b67594355b60c1f9d2ce1a8b8adbc323f65276c30e7e56b03786f5
-
memory/524-29-0x000000000048F888-mapping.dmp
-
memory/524-31-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/592-21-0x0000000000190000-0x0000000000191000-memory.dmpFilesize
4KB
-
memory/592-22-0x0000000000000000-mapping.dmp
-
memory/592-20-0x0000000000000000-mapping.dmp
-
memory/936-24-0x0000000000000000-mapping.dmp
-
memory/1540-33-0x0000000000000000-mapping.dmp
-
memory/1540-34-0x0000000000210000-0x0000000000211000-memory.dmpFilesize
4KB
-
memory/1540-35-0x0000000000000000-mapping.dmp
-
memory/1580-18-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/1580-16-0x000000000048F888-mapping.dmp
-
memory/1580-15-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/1704-0-0x0000000023370000-0x0000000023372000-memory.dmpFilesize
8KB
-
memory/1704-4-0x0000000035070000-0x0000000036870000-memory.dmpFilesize
24.0MB
-
memory/1704-1-0x0000000026370000-0x0000000026372000-memory.dmpFilesize
8KB