Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
08-11-2020 17:48
Static task
static1
Behavioral task
behavioral1
Sample
2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe
Resource
win7v20201028
General
-
Target
2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe
-
Size
252KB
-
MD5
a0303b31a98b225c23583db05b31bb78
-
SHA1
1d2843958d2fb7873763be62df48a4ad9d281e0a
-
SHA256
2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a
-
SHA512
b0ea5c2f2b67412951a825a56e36cf4e749843bfbae4f86588cc3a49203886c399d2a040a83db74ccf79b13fbbc3ccd398b916ef1bee2ae75ca5bfade152729b
Malware Config
Extracted
darkcomet
Guest16
ximer2020.ddns.net:1604
DC_MUTEX-4U0HFC0
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
aDFqoxfKfrcR
-
install
true
-
offline_keylogger
true
-
password
82121020202222
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 508 msdcsc.exe -
Processes:
resource yara_rule C:\Users\Admin\Documents\MSDCSC\msdcsc.exe upx C:\Users\Admin\Documents\MSDCSC\msdcsc.exe upx behavioral2/memory/976-6-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/976-8-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/976-9-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 2548 notepad.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exemsdcsc.exeiexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" iexplore.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
msdcsc.exedescription pid process target process PID 508 set thread context of 976 508 msdcsc.exe iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 976 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exemsdcsc.exeiexplore.exedescription pid process Token: SeIncreaseQuotaPrivilege 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe Token: SeSecurityPrivilege 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe Token: SeTakeOwnershipPrivilege 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe Token: SeLoadDriverPrivilege 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe Token: SeSystemProfilePrivilege 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe Token: SeSystemtimePrivilege 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe Token: SeProfSingleProcessPrivilege 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe Token: SeIncBasePriorityPrivilege 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe Token: SeCreatePagefilePrivilege 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe Token: SeBackupPrivilege 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe Token: SeRestorePrivilege 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe Token: SeShutdownPrivilege 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe Token: SeDebugPrivilege 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe Token: SeSystemEnvironmentPrivilege 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe Token: SeChangeNotifyPrivilege 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe Token: SeRemoteShutdownPrivilege 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe Token: SeUndockPrivilege 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe Token: SeManageVolumePrivilege 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe Token: SeImpersonatePrivilege 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe Token: SeCreateGlobalPrivilege 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe Token: 33 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe Token: 34 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe Token: 35 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe Token: 36 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe Token: SeIncreaseQuotaPrivilege 508 msdcsc.exe Token: SeSecurityPrivilege 508 msdcsc.exe Token: SeTakeOwnershipPrivilege 508 msdcsc.exe Token: SeLoadDriverPrivilege 508 msdcsc.exe Token: SeSystemProfilePrivilege 508 msdcsc.exe Token: SeSystemtimePrivilege 508 msdcsc.exe Token: SeProfSingleProcessPrivilege 508 msdcsc.exe Token: SeIncBasePriorityPrivilege 508 msdcsc.exe Token: SeCreatePagefilePrivilege 508 msdcsc.exe Token: SeBackupPrivilege 508 msdcsc.exe Token: SeRestorePrivilege 508 msdcsc.exe Token: SeShutdownPrivilege 508 msdcsc.exe Token: SeDebugPrivilege 508 msdcsc.exe Token: SeSystemEnvironmentPrivilege 508 msdcsc.exe Token: SeChangeNotifyPrivilege 508 msdcsc.exe Token: SeRemoteShutdownPrivilege 508 msdcsc.exe Token: SeUndockPrivilege 508 msdcsc.exe Token: SeManageVolumePrivilege 508 msdcsc.exe Token: SeImpersonatePrivilege 508 msdcsc.exe Token: SeCreateGlobalPrivilege 508 msdcsc.exe Token: 33 508 msdcsc.exe Token: 34 508 msdcsc.exe Token: 35 508 msdcsc.exe Token: 36 508 msdcsc.exe Token: SeIncreaseQuotaPrivilege 976 iexplore.exe Token: SeSecurityPrivilege 976 iexplore.exe Token: SeTakeOwnershipPrivilege 976 iexplore.exe Token: SeLoadDriverPrivilege 976 iexplore.exe Token: SeSystemProfilePrivilege 976 iexplore.exe Token: SeSystemtimePrivilege 976 iexplore.exe Token: SeProfSingleProcessPrivilege 976 iexplore.exe Token: SeIncBasePriorityPrivilege 976 iexplore.exe Token: SeCreatePagefilePrivilege 976 iexplore.exe Token: SeBackupPrivilege 976 iexplore.exe Token: SeRestorePrivilege 976 iexplore.exe Token: SeShutdownPrivilege 976 iexplore.exe Token: SeDebugPrivilege 976 iexplore.exe Token: SeSystemEnvironmentPrivilege 976 iexplore.exe Token: SeChangeNotifyPrivilege 976 iexplore.exe Token: SeRemoteShutdownPrivilege 976 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
iexplore.exepid process 976 iexplore.exe -
Suspicious use of WriteProcessMemory 47 IoCs
Processes:
2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exemsdcsc.exeiexplore.exedescription pid process target process PID 1020 wrote to memory of 2548 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe notepad.exe PID 1020 wrote to memory of 2548 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe notepad.exe PID 1020 wrote to memory of 2548 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe notepad.exe PID 1020 wrote to memory of 2548 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe notepad.exe PID 1020 wrote to memory of 2548 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe notepad.exe PID 1020 wrote to memory of 2548 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe notepad.exe PID 1020 wrote to memory of 2548 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe notepad.exe PID 1020 wrote to memory of 2548 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe notepad.exe PID 1020 wrote to memory of 2548 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe notepad.exe PID 1020 wrote to memory of 2548 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe notepad.exe PID 1020 wrote to memory of 2548 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe notepad.exe PID 1020 wrote to memory of 2548 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe notepad.exe PID 1020 wrote to memory of 2548 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe notepad.exe PID 1020 wrote to memory of 2548 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe notepad.exe PID 1020 wrote to memory of 2548 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe notepad.exe PID 1020 wrote to memory of 2548 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe notepad.exe PID 1020 wrote to memory of 2548 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe notepad.exe PID 1020 wrote to memory of 508 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe msdcsc.exe PID 1020 wrote to memory of 508 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe msdcsc.exe PID 1020 wrote to memory of 508 1020 2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe msdcsc.exe PID 508 wrote to memory of 976 508 msdcsc.exe iexplore.exe PID 508 wrote to memory of 976 508 msdcsc.exe iexplore.exe PID 508 wrote to memory of 976 508 msdcsc.exe iexplore.exe PID 508 wrote to memory of 976 508 msdcsc.exe iexplore.exe PID 508 wrote to memory of 976 508 msdcsc.exe iexplore.exe PID 976 wrote to memory of 200 976 iexplore.exe notepad.exe PID 976 wrote to memory of 200 976 iexplore.exe notepad.exe PID 976 wrote to memory of 200 976 iexplore.exe notepad.exe PID 976 wrote to memory of 200 976 iexplore.exe notepad.exe PID 976 wrote to memory of 200 976 iexplore.exe notepad.exe PID 976 wrote to memory of 200 976 iexplore.exe notepad.exe PID 976 wrote to memory of 200 976 iexplore.exe notepad.exe PID 976 wrote to memory of 200 976 iexplore.exe notepad.exe PID 976 wrote to memory of 200 976 iexplore.exe notepad.exe PID 976 wrote to memory of 200 976 iexplore.exe notepad.exe PID 976 wrote to memory of 200 976 iexplore.exe notepad.exe PID 976 wrote to memory of 200 976 iexplore.exe notepad.exe PID 976 wrote to memory of 200 976 iexplore.exe notepad.exe PID 976 wrote to memory of 200 976 iexplore.exe notepad.exe PID 976 wrote to memory of 200 976 iexplore.exe notepad.exe PID 976 wrote to memory of 200 976 iexplore.exe notepad.exe PID 976 wrote to memory of 200 976 iexplore.exe notepad.exe PID 976 wrote to memory of 200 976 iexplore.exe notepad.exe PID 976 wrote to memory of 200 976 iexplore.exe notepad.exe PID 976 wrote to memory of 200 976 iexplore.exe notepad.exe PID 976 wrote to memory of 200 976 iexplore.exe notepad.exe PID 976 wrote to memory of 200 976 iexplore.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe"C:\Users\Admin\AppData\Local\Temp\2171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
a0303b31a98b225c23583db05b31bb78
SHA11d2843958d2fb7873763be62df48a4ad9d281e0a
SHA2562171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a
SHA512b0ea5c2f2b67412951a825a56e36cf4e749843bfbae4f86588cc3a49203886c399d2a040a83db74ccf79b13fbbc3ccd398b916ef1bee2ae75ca5bfade152729b
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
a0303b31a98b225c23583db05b31bb78
SHA11d2843958d2fb7873763be62df48a4ad9d281e0a
SHA2562171bac5512cef55ce1ffcf96bf1395d9a826f29bcff90a6c4cfe794d615575a
SHA512b0ea5c2f2b67412951a825a56e36cf4e749843bfbae4f86588cc3a49203886c399d2a040a83db74ccf79b13fbbc3ccd398b916ef1bee2ae75ca5bfade152729b
-
memory/200-10-0x0000000000000000-mapping.dmp
-
memory/200-12-0x0000000000000000-mapping.dmp
-
memory/200-11-0x0000000000430000-0x0000000000431000-memory.dmpFilesize
4KB
-
memory/508-3-0x0000000000000000-mapping.dmp
-
memory/976-6-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/976-7-0x00000000004B5820-mapping.dmp
-
memory/976-8-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/976-9-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2548-0-0x0000000000000000-mapping.dmp
-
memory/2548-2-0x0000000000000000-mapping.dmp
-
memory/2548-1-0x00000000009C0000-0x00000000009C1000-memory.dmpFilesize
4KB