Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
06-11-2020 11:46
Static task
static1
Behavioral task
behavioral1
Sample
58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe
Resource
win7v20201028
General
-
Target
58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe
-
Size
752KB
-
MD5
72cb9f5693c7dff79fecd8cdb3880ea8
-
SHA1
9b7ac2f7dd26ae17c0048f630286f13689f195bb
-
SHA256
58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453
-
SHA512
06b040c5766c6d4639d77130ca4653dc7083d9af47d25d7a0975958d1412d9606ba8cc2b20b67594355b60c1f9d2ce1a8b8adbc323f65276c30e7e56b03786f5
Malware Config
Extracted
darkcomet
2020NOV5
sandyclark255.hopto.org:1605
DC_MUTEX-XRQ89VC
-
InstallPath
skypew.exe
-
gencode
pZP6alYpcpSq
-
install
true
-
offline_keylogger
true
-
password
hhhhhh
-
persistence
true
-
reg_key
skype
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svehoste.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\skypew.exe" svehoste.exe -
Disables Task Manager via registry modification
-
Drops file in Drivers directory 1 IoCs
Processes:
svehoste.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts svehoste.exe -
Executes dropped EXE 3 IoCs
Processes:
svehoste.exeskypew.exesvehoste.exepid process 1288 svehoste.exe 1008 skypew.exe 1632 svehoste.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
svehoste.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation svehoste.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svehoste.exesvehoste.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\skype = "C:\\Users\\Admin\\Documents\\skypew.exe" svehoste.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\skype = "C:\\Users\\Admin\\Documents\\skypew.exe" svehoste.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exeskypew.exedescription pid process target process PID 3988 set thread context of 1288 3988 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 1008 set thread context of 1632 1008 skypew.exe svehoste.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3920 3988 WerFault.exe 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe 2704 1008 WerFault.exe skypew.exe -
Modifies registry class 1 IoCs
Processes:
svehoste.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance svehoste.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
Processes:
58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exeWerFault.exeskypew.exeWerFault.exepid process 3988 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe 3988 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe 3988 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 1008 skypew.exe 1008 skypew.exe 1008 skypew.exe 2704 WerFault.exe 2704 WerFault.exe 2704 WerFault.exe 2704 WerFault.exe 2704 WerFault.exe 2704 WerFault.exe 2704 WerFault.exe 2704 WerFault.exe 2704 WerFault.exe 2704 WerFault.exe 2704 WerFault.exe 2704 WerFault.exe 2704 WerFault.exe 2704 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 54 IoCs
Processes:
58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exesvehoste.exeWerFault.exeskypew.exesvehoste.exeWerFault.exedescription pid process Token: SeDebugPrivilege 3988 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe Token: SeIncreaseQuotaPrivilege 1288 svehoste.exe Token: SeSecurityPrivilege 1288 svehoste.exe Token: SeTakeOwnershipPrivilege 1288 svehoste.exe Token: SeLoadDriverPrivilege 1288 svehoste.exe Token: SeSystemProfilePrivilege 1288 svehoste.exe Token: SeSystemtimePrivilege 1288 svehoste.exe Token: SeProfSingleProcessPrivilege 1288 svehoste.exe Token: SeIncBasePriorityPrivilege 1288 svehoste.exe Token: SeCreatePagefilePrivilege 1288 svehoste.exe Token: SeBackupPrivilege 1288 svehoste.exe Token: SeRestorePrivilege 1288 svehoste.exe Token: SeShutdownPrivilege 1288 svehoste.exe Token: SeDebugPrivilege 1288 svehoste.exe Token: SeSystemEnvironmentPrivilege 1288 svehoste.exe Token: SeChangeNotifyPrivilege 1288 svehoste.exe Token: SeRemoteShutdownPrivilege 1288 svehoste.exe Token: SeUndockPrivilege 1288 svehoste.exe Token: SeManageVolumePrivilege 1288 svehoste.exe Token: SeImpersonatePrivilege 1288 svehoste.exe Token: SeCreateGlobalPrivilege 1288 svehoste.exe Token: 33 1288 svehoste.exe Token: 34 1288 svehoste.exe Token: 35 1288 svehoste.exe Token: 36 1288 svehoste.exe Token: SeRestorePrivilege 3920 WerFault.exe Token: SeBackupPrivilege 3920 WerFault.exe Token: SeDebugPrivilege 3920 WerFault.exe Token: SeDebugPrivilege 1008 skypew.exe Token: SeIncreaseQuotaPrivilege 1632 svehoste.exe Token: SeSecurityPrivilege 1632 svehoste.exe Token: SeTakeOwnershipPrivilege 1632 svehoste.exe Token: SeLoadDriverPrivilege 1632 svehoste.exe Token: SeSystemProfilePrivilege 1632 svehoste.exe Token: SeSystemtimePrivilege 1632 svehoste.exe Token: SeProfSingleProcessPrivilege 1632 svehoste.exe Token: SeIncBasePriorityPrivilege 1632 svehoste.exe Token: SeCreatePagefilePrivilege 1632 svehoste.exe Token: SeBackupPrivilege 1632 svehoste.exe Token: SeRestorePrivilege 1632 svehoste.exe Token: SeShutdownPrivilege 1632 svehoste.exe Token: SeDebugPrivilege 1632 svehoste.exe Token: SeSystemEnvironmentPrivilege 1632 svehoste.exe Token: SeChangeNotifyPrivilege 1632 svehoste.exe Token: SeRemoteShutdownPrivilege 1632 svehoste.exe Token: SeUndockPrivilege 1632 svehoste.exe Token: SeManageVolumePrivilege 1632 svehoste.exe Token: SeImpersonatePrivilege 1632 svehoste.exe Token: SeCreateGlobalPrivilege 1632 svehoste.exe Token: 33 1632 svehoste.exe Token: 34 1632 svehoste.exe Token: 35 1632 svehoste.exe Token: 36 1632 svehoste.exe Token: SeDebugPrivilege 2704 WerFault.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
svehoste.exepid process 1632 svehoste.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exesvehoste.exeskypew.exesvehoste.exedescription pid process target process PID 3988 wrote to memory of 1288 3988 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 3988 wrote to memory of 1288 3988 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 3988 wrote to memory of 1288 3988 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 3988 wrote to memory of 1288 3988 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 3988 wrote to memory of 1288 3988 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 3988 wrote to memory of 1288 3988 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 3988 wrote to memory of 1288 3988 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 3988 wrote to memory of 1288 3988 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 3988 wrote to memory of 1288 3988 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 3988 wrote to memory of 1288 3988 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 3988 wrote to memory of 1288 3988 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 3988 wrote to memory of 1288 3988 58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe svehoste.exe PID 1288 wrote to memory of 3280 1288 svehoste.exe notepad.exe PID 1288 wrote to memory of 3280 1288 svehoste.exe notepad.exe PID 1288 wrote to memory of 3280 1288 svehoste.exe notepad.exe PID 1288 wrote to memory of 3280 1288 svehoste.exe notepad.exe PID 1288 wrote to memory of 3280 1288 svehoste.exe notepad.exe PID 1288 wrote to memory of 3280 1288 svehoste.exe notepad.exe PID 1288 wrote to memory of 3280 1288 svehoste.exe notepad.exe PID 1288 wrote to memory of 3280 1288 svehoste.exe notepad.exe PID 1288 wrote to memory of 3280 1288 svehoste.exe notepad.exe PID 1288 wrote to memory of 3280 1288 svehoste.exe notepad.exe PID 1288 wrote to memory of 3280 1288 svehoste.exe notepad.exe PID 1288 wrote to memory of 3280 1288 svehoste.exe notepad.exe PID 1288 wrote to memory of 3280 1288 svehoste.exe notepad.exe PID 1288 wrote to memory of 3280 1288 svehoste.exe notepad.exe PID 1288 wrote to memory of 3280 1288 svehoste.exe notepad.exe PID 1288 wrote to memory of 3280 1288 svehoste.exe notepad.exe PID 1288 wrote to memory of 3280 1288 svehoste.exe notepad.exe PID 1288 wrote to memory of 1008 1288 svehoste.exe skypew.exe PID 1288 wrote to memory of 1008 1288 svehoste.exe skypew.exe PID 1288 wrote to memory of 1008 1288 svehoste.exe skypew.exe PID 1008 wrote to memory of 1632 1008 skypew.exe svehoste.exe PID 1008 wrote to memory of 1632 1008 skypew.exe svehoste.exe PID 1008 wrote to memory of 1632 1008 skypew.exe svehoste.exe PID 1008 wrote to memory of 1632 1008 skypew.exe svehoste.exe PID 1008 wrote to memory of 1632 1008 skypew.exe svehoste.exe PID 1008 wrote to memory of 1632 1008 skypew.exe svehoste.exe PID 1008 wrote to memory of 1632 1008 skypew.exe svehoste.exe PID 1008 wrote to memory of 1632 1008 skypew.exe svehoste.exe PID 1008 wrote to memory of 1632 1008 skypew.exe svehoste.exe PID 1008 wrote to memory of 1632 1008 skypew.exe svehoste.exe PID 1008 wrote to memory of 1632 1008 skypew.exe svehoste.exe PID 1008 wrote to memory of 1632 1008 skypew.exe svehoste.exe PID 1632 wrote to memory of 2696 1632 svehoste.exe notepad.exe PID 1632 wrote to memory of 2696 1632 svehoste.exe notepad.exe PID 1632 wrote to memory of 2696 1632 svehoste.exe notepad.exe PID 1632 wrote to memory of 2696 1632 svehoste.exe notepad.exe PID 1632 wrote to memory of 2696 1632 svehoste.exe notepad.exe PID 1632 wrote to memory of 2696 1632 svehoste.exe notepad.exe PID 1632 wrote to memory of 2696 1632 svehoste.exe notepad.exe PID 1632 wrote to memory of 2696 1632 svehoste.exe notepad.exe PID 1632 wrote to memory of 2696 1632 svehoste.exe notepad.exe PID 1632 wrote to memory of 2696 1632 svehoste.exe notepad.exe PID 1632 wrote to memory of 2696 1632 svehoste.exe notepad.exe PID 1632 wrote to memory of 2696 1632 svehoste.exe notepad.exe PID 1632 wrote to memory of 2696 1632 svehoste.exe notepad.exe PID 1632 wrote to memory of 2696 1632 svehoste.exe notepad.exe PID 1632 wrote to memory of 2696 1632 svehoste.exe notepad.exe PID 1632 wrote to memory of 2696 1632 svehoste.exe notepad.exe PID 1632 wrote to memory of 2696 1632 svehoste.exe notepad.exe PID 1632 wrote to memory of 2696 1632 svehoste.exe notepad.exe PID 1632 wrote to memory of 2696 1632 svehoste.exe notepad.exe PID 1632 wrote to memory of 2696 1632 svehoste.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe"C:\Users\Admin\AppData\Local\Temp\58a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sduiHi6p255fGT7C\svehoste.exe"C:\Users\Admin\AppData\Local\Temp\sduiHi6p255fGT7C\svehoste.exe"2⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
-
C:\Users\Admin\Documents\skypew.exe"C:\Users\Admin\Documents\skypew.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sduiHi6p255fGT7C\svehoste.exe"C:\Users\Admin\AppData\Local\Temp\sduiHi6p255fGT7C\svehoste.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 10684⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 10762⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\sduiHi6p255fGT7C\svehoste.exeMD5
72cb9f5693c7dff79fecd8cdb3880ea8
SHA19b7ac2f7dd26ae17c0048f630286f13689f195bb
SHA25658a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453
SHA51206b040c5766c6d4639d77130ca4653dc7083d9af47d25d7a0975958d1412d9606ba8cc2b20b67594355b60c1f9d2ce1a8b8adbc323f65276c30e7e56b03786f5
-
C:\Users\Admin\AppData\Local\Temp\sduiHi6p255fGT7C\svehoste.exeMD5
72cb9f5693c7dff79fecd8cdb3880ea8
SHA19b7ac2f7dd26ae17c0048f630286f13689f195bb
SHA25658a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453
SHA51206b040c5766c6d4639d77130ca4653dc7083d9af47d25d7a0975958d1412d9606ba8cc2b20b67594355b60c1f9d2ce1a8b8adbc323f65276c30e7e56b03786f5
-
C:\Users\Admin\AppData\Local\Temp\sduiHi6p255fGT7C\svehoste.exeMD5
72cb9f5693c7dff79fecd8cdb3880ea8
SHA19b7ac2f7dd26ae17c0048f630286f13689f195bb
SHA25658a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453
SHA51206b040c5766c6d4639d77130ca4653dc7083d9af47d25d7a0975958d1412d9606ba8cc2b20b67594355b60c1f9d2ce1a8b8adbc323f65276c30e7e56b03786f5
-
C:\Users\Admin\AppData\Local\Temp\sduiHi6p255fGT7C\svehoste.exeMD5
72cb9f5693c7dff79fecd8cdb3880ea8
SHA19b7ac2f7dd26ae17c0048f630286f13689f195bb
SHA25658a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453
SHA51206b040c5766c6d4639d77130ca4653dc7083d9af47d25d7a0975958d1412d9606ba8cc2b20b67594355b60c1f9d2ce1a8b8adbc323f65276c30e7e56b03786f5
-
C:\Users\Admin\Documents\skypew.exeMD5
72cb9f5693c7dff79fecd8cdb3880ea8
SHA19b7ac2f7dd26ae17c0048f630286f13689f195bb
SHA25658a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453
SHA51206b040c5766c6d4639d77130ca4653dc7083d9af47d25d7a0975958d1412d9606ba8cc2b20b67594355b60c1f9d2ce1a8b8adbc323f65276c30e7e56b03786f5
-
C:\Users\Admin\Documents\skypew.exeMD5
72cb9f5693c7dff79fecd8cdb3880ea8
SHA19b7ac2f7dd26ae17c0048f630286f13689f195bb
SHA25658a2fa4a15e85f2cba62f30a84220cda8dffc43193acb8aa5cd83c4d40d28453
SHA51206b040c5766c6d4639d77130ca4653dc7083d9af47d25d7a0975958d1412d9606ba8cc2b20b67594355b60c1f9d2ce1a8b8adbc323f65276c30e7e56b03786f5
-
memory/1008-25-0x0000000000000000-mapping.dmp
-
memory/1008-29-0x0000000000000000-mapping.dmp
-
memory/1008-33-0x0000000000000000-mapping.dmp
-
memory/1008-32-0x0000000000000000-mapping.dmp
-
memory/1008-10-0x0000000000000000-mapping.dmp
-
memory/1008-30-0x0000000000000000-mapping.dmp
-
memory/1008-31-0x0000000000000000-mapping.dmp
-
memory/1008-22-0x0000000000000000-mapping.dmp
-
memory/1008-23-0x0000000000000000-mapping.dmp
-
memory/1008-27-0x0000000000000000-mapping.dmp
-
memory/1008-24-0x0000000000000000-mapping.dmp
-
memory/1008-26-0x0000000000000000-mapping.dmp
-
memory/1288-1-0x000000000048F888-mapping.dmp
-
memory/1288-0-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/1288-4-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/1632-14-0x000000000048F888-mapping.dmp
-
memory/1632-16-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/2696-20-0x0000000000000000-mapping.dmp
-
memory/2696-19-0x0000000000EC0000-0x0000000000EC1000-memory.dmpFilesize
4KB
-
memory/2696-18-0x0000000000000000-mapping.dmp
-
memory/2704-21-0x0000000004770000-0x0000000004771000-memory.dmpFilesize
4KB
-
memory/2704-28-0x0000000005230000-0x0000000005231000-memory.dmpFilesize
4KB
-
memory/3280-7-0x0000000000C10000-0x0000000000C11000-memory.dmpFilesize
4KB
-
memory/3280-6-0x0000000000000000-mapping.dmp
-
memory/3280-8-0x0000000000000000-mapping.dmp
-
memory/3920-5-0x0000000004D00000-0x0000000004D01000-memory.dmpFilesize
4KB
-
memory/3920-9-0x00000000058F0000-0x00000000058F1000-memory.dmpFilesize
4KB