Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
06-11-2020 11:46
Static task
static1
Behavioral task
behavioral1
Sample
8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe
Resource
win10v20201028
General
-
Target
8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe
-
Size
3.6MB
-
MD5
0cc4b215bf319dfc3a93c784a9e455ec
-
SHA1
4f39f687c1449665f66081325bebada166772d28
-
SHA256
8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d
-
SHA512
ed84d3e693c18348fc61a6e0698d095e3efbedb8b99cafc5cd47d938905a276dfaecae4c789ae2a17b2bfc4dc6a4b4b5c0c9e607fe9d16899351724a7309d993
Malware Config
Extracted
darkcomet
Puffy 001
againme666.ddns.net:1604
DC_MUTEX-8FFHWUR
-
gencode
iGsZPLQk83py
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\OlYUmI05WEo90cnM\\uz7566yjHoIq.exe\",explorer.exe" 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exedescription pid process target process PID 756 set thread context of 532 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe vbc.exe PID 756 set thread context of 532 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe vbc.exe PID 756 set thread context of 532 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 1560 vlc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exepid process 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid process 1560 vlc.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exevbc.exeAUDIODG.EXEvlc.exedescription pid process Token: SeDebugPrivilege 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe Token: SeDebugPrivilege 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe Token: SeIncreaseQuotaPrivilege 532 vbc.exe Token: SeSecurityPrivilege 532 vbc.exe Token: SeTakeOwnershipPrivilege 532 vbc.exe Token: SeLoadDriverPrivilege 532 vbc.exe Token: SeSystemProfilePrivilege 532 vbc.exe Token: SeSystemtimePrivilege 532 vbc.exe Token: SeProfSingleProcessPrivilege 532 vbc.exe Token: SeIncBasePriorityPrivilege 532 vbc.exe Token: SeCreatePagefilePrivilege 532 vbc.exe Token: SeBackupPrivilege 532 vbc.exe Token: SeRestorePrivilege 532 vbc.exe Token: SeShutdownPrivilege 532 vbc.exe Token: SeDebugPrivilege 532 vbc.exe Token: SeSystemEnvironmentPrivilege 532 vbc.exe Token: SeChangeNotifyPrivilege 532 vbc.exe Token: SeRemoteShutdownPrivilege 532 vbc.exe Token: SeUndockPrivilege 532 vbc.exe Token: SeManageVolumePrivilege 532 vbc.exe Token: SeImpersonatePrivilege 532 vbc.exe Token: SeCreateGlobalPrivilege 532 vbc.exe Token: 33 532 vbc.exe Token: 34 532 vbc.exe Token: 35 532 vbc.exe Token: 33 1644 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1644 AUDIODG.EXE Token: 33 1644 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1644 AUDIODG.EXE Token: 33 1644 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1644 AUDIODG.EXE Token: 33 1560 vlc.exe Token: SeIncBasePriorityPrivilege 1560 vlc.exe -
Suspicious use of FindShellTrayWindow 12 IoCs
Processes:
vlc.exepid process 1560 vlc.exe 1560 vlc.exe 1560 vlc.exe 1560 vlc.exe 1560 vlc.exe 1560 vlc.exe 1560 vlc.exe 1560 vlc.exe 1560 vlc.exe 1560 vlc.exe 1560 vlc.exe 1560 vlc.exe -
Suspicious use of SendNotifyMessage 5 IoCs
Processes:
vlc.exepid process 1560 vlc.exe 1560 vlc.exe 1560 vlc.exe 1560 vlc.exe 1560 vlc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
vbc.exevlc.exepid process 532 vbc.exe 1560 vlc.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exedescription pid process target process PID 756 wrote to memory of 1560 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe vlc.exe PID 756 wrote to memory of 1560 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe vlc.exe PID 756 wrote to memory of 1560 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe vlc.exe PID 756 wrote to memory of 1560 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe vlc.exe PID 756 wrote to memory of 532 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe vbc.exe PID 756 wrote to memory of 532 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe vbc.exe PID 756 wrote to memory of 532 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe vbc.exe PID 756 wrote to memory of 532 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe vbc.exe PID 756 wrote to memory of 532 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe vbc.exe PID 756 wrote to memory of 532 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe vbc.exe PID 756 wrote to memory of 532 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe vbc.exe PID 756 wrote to memory of 532 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe vbc.exe PID 756 wrote to memory of 532 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe vbc.exe PID 756 wrote to memory of 532 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe vbc.exe PID 756 wrote to memory of 532 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe vbc.exe PID 756 wrote to memory of 532 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe vbc.exe PID 756 wrote to memory of 532 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe vbc.exe PID 756 wrote to memory of 532 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe vbc.exe PID 756 wrote to memory of 532 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe vbc.exe PID 756 wrote to memory of 532 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe vbc.exe PID 756 wrote to memory of 532 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe vbc.exe PID 756 wrote to memory of 532 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe vbc.exe PID 756 wrote to memory of 532 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe vbc.exe PID 756 wrote to memory of 532 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe vbc.exe PID 756 wrote to memory of 532 756 8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe"C:\Users\Admin\AppData\Local\Temp\8b540bf1f0f283d0a074b95422f7c619f7c81a73067d2e1e00e72d923575c51d.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\wUHusJaoxlClQ8Fm.3gp"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5881⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\wUHusJaoxlClQ8Fm.3gpMD5
0610fb6636f76c56816b58a2a45425d9
SHA1df269608977d20f5ee9edd5180bfaf188c6ccd3a
SHA2567b0d241e30bd6b2a18e6089d0f46bf12117356c3528f2b6a45ea4ec7a4fb344a
SHA512039e6015a858d6915dc10b1c571c86239627b4880b652404897f50435df272147dedad32c663251e8bd702fc1bb99d68f61309e977b24f67db6cbb2237eafbba
-
memory/532-6-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/532-7-0x000000000048F888-mapping.dmp
-
memory/532-8-0x000000000048F888-mapping.dmp
-
memory/532-9-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/532-11-0x00000000007C1000-0x00000000007C2000-memory.dmpFilesize
4KB
-
memory/532-10-0x00000000007C1000-0x00000000007C2000-memory.dmpFilesize
4KB
-
memory/532-12-0x00000000007C2000-0x00000000007C4000-memory.dmpFilesize
8KB
-
memory/1560-2-0x0000000000000000-mapping.dmp