Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
08-11-2020 18:01
Static task
static1
Behavioral task
behavioral1
Sample
3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exe
Resource
win10v20201028
General
-
Target
3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exe
-
Size
557KB
-
MD5
316ced1fc09909dff0b75efbd0da2ae0
-
SHA1
2d5cb13b6c956f8a7b6307d7f629a56117d2d9ee
-
SHA256
3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d
-
SHA512
fca713a6489bf4d87be23d9fbc6e9aa6fccf8a6329d1abed6e2e28bf2286f2fd78486cd77111eabed293f29fac81bfa1fbd9c8f9ebdb1452cd5af9eb41bdd5ad
Malware Config
Extracted
darkcomet
2020okt999+++4
sandyclark255.hopto.org:1605
DC_MUTEX-D50H81E
-
InstallPath
word64l.exe
-
gencode
0zgSCfjSH24W
-
install
true
-
offline_keylogger
true
-
password
hhhhhh
-
persistence
true
-
reg_key
winworde
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
rwewqr.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\word64l.exe" rwewqr.exe -
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory 1 IoCs
Processes:
rwewqr.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts rwewqr.exe -
Executes dropped EXE 3 IoCs
Processes:
rwewqr.exeword64l.exerwewqr.exepid process 1700 rwewqr.exe 1592 word64l.exe 436 rwewqr.exe -
Loads dropped DLL 3 IoCs
Processes:
3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exerwewqr.exeword64l.exepid process 288 3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exe 1700 rwewqr.exe 1592 word64l.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
rwewqr.exerwewqr.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\winworde = "C:\\Users\\Admin\\Documents\\word64l.exe" rwewqr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\winworde = "C:\\Users\\Admin\\Documents\\word64l.exe" rwewqr.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exeword64l.exedescription pid process target process PID 288 set thread context of 1700 288 3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exe rwewqr.exe PID 1592 set thread context of 436 1592 word64l.exe rwewqr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exeword64l.exepid process 288 3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exe 288 3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exe 288 3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exe 1592 word64l.exe 1592 word64l.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
Processes:
3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exerwewqr.exeword64l.exerwewqr.exedescription pid process Token: SeDebugPrivilege 288 3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exe Token: SeDebugPrivilege 288 3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exe Token: SeIncreaseQuotaPrivilege 1700 rwewqr.exe Token: SeSecurityPrivilege 1700 rwewqr.exe Token: SeTakeOwnershipPrivilege 1700 rwewqr.exe Token: SeLoadDriverPrivilege 1700 rwewqr.exe Token: SeSystemProfilePrivilege 1700 rwewqr.exe Token: SeSystemtimePrivilege 1700 rwewqr.exe Token: SeProfSingleProcessPrivilege 1700 rwewqr.exe Token: SeIncBasePriorityPrivilege 1700 rwewqr.exe Token: SeCreatePagefilePrivilege 1700 rwewqr.exe Token: SeBackupPrivilege 1700 rwewqr.exe Token: SeRestorePrivilege 1700 rwewqr.exe Token: SeShutdownPrivilege 1700 rwewqr.exe Token: SeDebugPrivilege 1700 rwewqr.exe Token: SeSystemEnvironmentPrivilege 1700 rwewqr.exe Token: SeChangeNotifyPrivilege 1700 rwewqr.exe Token: SeRemoteShutdownPrivilege 1700 rwewqr.exe Token: SeUndockPrivilege 1700 rwewqr.exe Token: SeManageVolumePrivilege 1700 rwewqr.exe Token: SeImpersonatePrivilege 1700 rwewqr.exe Token: SeCreateGlobalPrivilege 1700 rwewqr.exe Token: 33 1700 rwewqr.exe Token: 34 1700 rwewqr.exe Token: 35 1700 rwewqr.exe Token: SeDebugPrivilege 1592 word64l.exe Token: SeDebugPrivilege 1592 word64l.exe Token: SeIncreaseQuotaPrivilege 436 rwewqr.exe Token: SeSecurityPrivilege 436 rwewqr.exe Token: SeTakeOwnershipPrivilege 436 rwewqr.exe Token: SeLoadDriverPrivilege 436 rwewqr.exe Token: SeSystemProfilePrivilege 436 rwewqr.exe Token: SeSystemtimePrivilege 436 rwewqr.exe Token: SeProfSingleProcessPrivilege 436 rwewqr.exe Token: SeIncBasePriorityPrivilege 436 rwewqr.exe Token: SeCreatePagefilePrivilege 436 rwewqr.exe Token: SeBackupPrivilege 436 rwewqr.exe Token: SeRestorePrivilege 436 rwewqr.exe Token: SeShutdownPrivilege 436 rwewqr.exe Token: SeDebugPrivilege 436 rwewqr.exe Token: SeSystemEnvironmentPrivilege 436 rwewqr.exe Token: SeChangeNotifyPrivilege 436 rwewqr.exe Token: SeRemoteShutdownPrivilege 436 rwewqr.exe Token: SeUndockPrivilege 436 rwewqr.exe Token: SeManageVolumePrivilege 436 rwewqr.exe Token: SeImpersonatePrivilege 436 rwewqr.exe Token: SeCreateGlobalPrivilege 436 rwewqr.exe Token: 33 436 rwewqr.exe Token: 34 436 rwewqr.exe Token: 35 436 rwewqr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
rwewqr.exepid process 436 rwewqr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exerwewqr.exeword64l.exerwewqr.exedescription pid process target process PID 288 wrote to memory of 1700 288 3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exe rwewqr.exe PID 288 wrote to memory of 1700 288 3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exe rwewqr.exe PID 288 wrote to memory of 1700 288 3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exe rwewqr.exe PID 288 wrote to memory of 1700 288 3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exe rwewqr.exe PID 288 wrote to memory of 1700 288 3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exe rwewqr.exe PID 288 wrote to memory of 1700 288 3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exe rwewqr.exe PID 288 wrote to memory of 1700 288 3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exe rwewqr.exe PID 288 wrote to memory of 1700 288 3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exe rwewqr.exe PID 288 wrote to memory of 1700 288 3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exe rwewqr.exe PID 288 wrote to memory of 1700 288 3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exe rwewqr.exe PID 288 wrote to memory of 1700 288 3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exe rwewqr.exe PID 288 wrote to memory of 1700 288 3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exe rwewqr.exe PID 288 wrote to memory of 1700 288 3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exe rwewqr.exe PID 1700 wrote to memory of 1376 1700 rwewqr.exe notepad.exe PID 1700 wrote to memory of 1376 1700 rwewqr.exe notepad.exe PID 1700 wrote to memory of 1376 1700 rwewqr.exe notepad.exe PID 1700 wrote to memory of 1376 1700 rwewqr.exe notepad.exe PID 1700 wrote to memory of 1376 1700 rwewqr.exe notepad.exe PID 1700 wrote to memory of 1376 1700 rwewqr.exe notepad.exe PID 1700 wrote to memory of 1376 1700 rwewqr.exe notepad.exe PID 1700 wrote to memory of 1376 1700 rwewqr.exe notepad.exe PID 1700 wrote to memory of 1376 1700 rwewqr.exe notepad.exe PID 1700 wrote to memory of 1376 1700 rwewqr.exe notepad.exe PID 1700 wrote to memory of 1376 1700 rwewqr.exe notepad.exe PID 1700 wrote to memory of 1376 1700 rwewqr.exe notepad.exe PID 1700 wrote to memory of 1376 1700 rwewqr.exe notepad.exe PID 1700 wrote to memory of 1376 1700 rwewqr.exe notepad.exe PID 1700 wrote to memory of 1376 1700 rwewqr.exe notepad.exe PID 1700 wrote to memory of 1376 1700 rwewqr.exe notepad.exe PID 1700 wrote to memory of 1376 1700 rwewqr.exe notepad.exe PID 1700 wrote to memory of 1376 1700 rwewqr.exe notepad.exe PID 1700 wrote to memory of 1592 1700 rwewqr.exe word64l.exe PID 1700 wrote to memory of 1592 1700 rwewqr.exe word64l.exe PID 1700 wrote to memory of 1592 1700 rwewqr.exe word64l.exe PID 1700 wrote to memory of 1592 1700 rwewqr.exe word64l.exe PID 1592 wrote to memory of 436 1592 word64l.exe rwewqr.exe PID 1592 wrote to memory of 436 1592 word64l.exe rwewqr.exe PID 1592 wrote to memory of 436 1592 word64l.exe rwewqr.exe PID 1592 wrote to memory of 436 1592 word64l.exe rwewqr.exe PID 1592 wrote to memory of 436 1592 word64l.exe rwewqr.exe PID 1592 wrote to memory of 436 1592 word64l.exe rwewqr.exe PID 1592 wrote to memory of 436 1592 word64l.exe rwewqr.exe PID 1592 wrote to memory of 436 1592 word64l.exe rwewqr.exe PID 1592 wrote to memory of 436 1592 word64l.exe rwewqr.exe PID 1592 wrote to memory of 436 1592 word64l.exe rwewqr.exe PID 1592 wrote to memory of 436 1592 word64l.exe rwewqr.exe PID 1592 wrote to memory of 436 1592 word64l.exe rwewqr.exe PID 1592 wrote to memory of 436 1592 word64l.exe rwewqr.exe PID 436 wrote to memory of 968 436 rwewqr.exe notepad.exe PID 436 wrote to memory of 968 436 rwewqr.exe notepad.exe PID 436 wrote to memory of 968 436 rwewqr.exe notepad.exe PID 436 wrote to memory of 968 436 rwewqr.exe notepad.exe PID 436 wrote to memory of 968 436 rwewqr.exe notepad.exe PID 436 wrote to memory of 968 436 rwewqr.exe notepad.exe PID 436 wrote to memory of 968 436 rwewqr.exe notepad.exe PID 436 wrote to memory of 968 436 rwewqr.exe notepad.exe PID 436 wrote to memory of 968 436 rwewqr.exe notepad.exe PID 436 wrote to memory of 968 436 rwewqr.exe notepad.exe PID 436 wrote to memory of 968 436 rwewqr.exe notepad.exe PID 436 wrote to memory of 968 436 rwewqr.exe notepad.exe PID 436 wrote to memory of 968 436 rwewqr.exe notepad.exe PID 436 wrote to memory of 968 436 rwewqr.exe notepad.exe PID 436 wrote to memory of 968 436 rwewqr.exe notepad.exe PID 436 wrote to memory of 968 436 rwewqr.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exe"C:\Users\Admin\AppData\Local\Temp\3b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0ed94wxm0ij5U6Fj\rwewqr.exe"C:\Users\Admin\AppData\Local\Temp\0ed94wxm0ij5U6Fj\rwewqr.exe"2⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
-
C:\Users\Admin\Documents\word64l.exe"C:\Users\Admin\Documents\word64l.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0ed94wxm0ij5U6Fj\rwewqr.exe"C:\Users\Admin\AppData\Local\Temp\0ed94wxm0ij5U6Fj\rwewqr.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\0ed94wxm0ij5U6Fj\rwewqr.exeMD5
316ced1fc09909dff0b75efbd0da2ae0
SHA12d5cb13b6c956f8a7b6307d7f629a56117d2d9ee
SHA2563b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d
SHA512fca713a6489bf4d87be23d9fbc6e9aa6fccf8a6329d1abed6e2e28bf2286f2fd78486cd77111eabed293f29fac81bfa1fbd9c8f9ebdb1452cd5af9eb41bdd5ad
-
C:\Users\Admin\AppData\Local\Temp\0ed94wxm0ij5U6Fj\rwewqr.exeMD5
316ced1fc09909dff0b75efbd0da2ae0
SHA12d5cb13b6c956f8a7b6307d7f629a56117d2d9ee
SHA2563b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d
SHA512fca713a6489bf4d87be23d9fbc6e9aa6fccf8a6329d1abed6e2e28bf2286f2fd78486cd77111eabed293f29fac81bfa1fbd9c8f9ebdb1452cd5af9eb41bdd5ad
-
C:\Users\Admin\AppData\Local\Temp\0ed94wxm0ij5U6Fj\rwewqr.exeMD5
316ced1fc09909dff0b75efbd0da2ae0
SHA12d5cb13b6c956f8a7b6307d7f629a56117d2d9ee
SHA2563b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d
SHA512fca713a6489bf4d87be23d9fbc6e9aa6fccf8a6329d1abed6e2e28bf2286f2fd78486cd77111eabed293f29fac81bfa1fbd9c8f9ebdb1452cd5af9eb41bdd5ad
-
C:\Users\Admin\AppData\Local\Temp\0ed94wxm0ij5U6Fj\rwewqr.exeMD5
316ced1fc09909dff0b75efbd0da2ae0
SHA12d5cb13b6c956f8a7b6307d7f629a56117d2d9ee
SHA2563b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d
SHA512fca713a6489bf4d87be23d9fbc6e9aa6fccf8a6329d1abed6e2e28bf2286f2fd78486cd77111eabed293f29fac81bfa1fbd9c8f9ebdb1452cd5af9eb41bdd5ad
-
C:\Users\Admin\Documents\word64l.exeMD5
316ced1fc09909dff0b75efbd0da2ae0
SHA12d5cb13b6c956f8a7b6307d7f629a56117d2d9ee
SHA2563b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d
SHA512fca713a6489bf4d87be23d9fbc6e9aa6fccf8a6329d1abed6e2e28bf2286f2fd78486cd77111eabed293f29fac81bfa1fbd9c8f9ebdb1452cd5af9eb41bdd5ad
-
C:\Users\Admin\Documents\word64l.exeMD5
316ced1fc09909dff0b75efbd0da2ae0
SHA12d5cb13b6c956f8a7b6307d7f629a56117d2d9ee
SHA2563b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d
SHA512fca713a6489bf4d87be23d9fbc6e9aa6fccf8a6329d1abed6e2e28bf2286f2fd78486cd77111eabed293f29fac81bfa1fbd9c8f9ebdb1452cd5af9eb41bdd5ad
-
\Users\Admin\AppData\Local\Temp\0ed94wxm0ij5U6Fj\rwewqr.exeMD5
316ced1fc09909dff0b75efbd0da2ae0
SHA12d5cb13b6c956f8a7b6307d7f629a56117d2d9ee
SHA2563b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d
SHA512fca713a6489bf4d87be23d9fbc6e9aa6fccf8a6329d1abed6e2e28bf2286f2fd78486cd77111eabed293f29fac81bfa1fbd9c8f9ebdb1452cd5af9eb41bdd5ad
-
\Users\Admin\AppData\Local\Temp\0ed94wxm0ij5U6Fj\rwewqr.exeMD5
316ced1fc09909dff0b75efbd0da2ae0
SHA12d5cb13b6c956f8a7b6307d7f629a56117d2d9ee
SHA2563b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d
SHA512fca713a6489bf4d87be23d9fbc6e9aa6fccf8a6329d1abed6e2e28bf2286f2fd78486cd77111eabed293f29fac81bfa1fbd9c8f9ebdb1452cd5af9eb41bdd5ad
-
\Users\Admin\Documents\word64l.exeMD5
316ced1fc09909dff0b75efbd0da2ae0
SHA12d5cb13b6c956f8a7b6307d7f629a56117d2d9ee
SHA2563b93bbc5e1fe38dd279812cc19777eea51faf580c97d1713e8c54448f949647d
SHA512fca713a6489bf4d87be23d9fbc6e9aa6fccf8a6329d1abed6e2e28bf2286f2fd78486cd77111eabed293f29fac81bfa1fbd9c8f9ebdb1452cd5af9eb41bdd5ad
-
memory/436-17-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/436-15-0x000000000048F888-mapping.dmp
-
memory/968-19-0x0000000000000000-mapping.dmp
-
memory/968-20-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/968-21-0x0000000000000000-mapping.dmp
-
memory/1376-6-0x0000000000000000-mapping.dmp
-
memory/1376-8-0x0000000000000000-mapping.dmp
-
memory/1376-7-0x0000000000190000-0x0000000000191000-memory.dmpFilesize
4KB
-
memory/1592-10-0x0000000000000000-mapping.dmp
-
memory/1700-1-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1700-2-0x000000000048F888-mapping.dmp
-
memory/1700-4-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB