Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 21:09
Static task
static1
Behavioral task
behavioral1
Sample
030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe
Resource
win7v20201028
General
-
Target
030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe
-
Size
252KB
-
MD5
81d1f0ba69f70c3b8eb6c00dea432dfe
-
SHA1
f2e23705a6a465e8e6c7f02f3b175e2e06e84719
-
SHA256
030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9
-
SHA512
0fea7f04790a53638e2cc342f2d1713ba49363c31faa36bc5698f4f18be4b8d9f5006592b775d7c4bcf6f467f43fd005b80b5b6d5ad73aa3f0bfa344f0ad90ce
Malware Config
Extracted
darkcomet
Guest16
ximer2020.ddns.net:1604
DC_MUTEX-4U0HFC0
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
aDFqoxfKfrcR
-
install
true
-
offline_keylogger
true
-
password
82121020202222
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 1172 msdcsc.exe -
Processes:
resource yara_rule \Users\Admin\Documents\MSDCSC\msdcsc.exe upx \Users\Admin\Documents\MSDCSC\msdcsc.exe upx C:\Users\Admin\Documents\MSDCSC\msdcsc.exe upx C:\Users\Admin\Documents\MSDCSC\msdcsc.exe upx behavioral1/memory/1984-8-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1984-10-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1984-11-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 1824 notepad.exe -
Loads dropped DLL 2 IoCs
Processes:
030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exepid process 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exemsdcsc.exeiexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" iexplore.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
msdcsc.exedescription pid process target process PID 1172 set thread context of 1984 1172 msdcsc.exe iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 1984 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exemsdcsc.exeiexplore.exedescription pid process Token: SeIncreaseQuotaPrivilege 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe Token: SeSecurityPrivilege 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe Token: SeTakeOwnershipPrivilege 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe Token: SeLoadDriverPrivilege 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe Token: SeSystemProfilePrivilege 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe Token: SeSystemtimePrivilege 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe Token: SeProfSingleProcessPrivilege 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe Token: SeIncBasePriorityPrivilege 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe Token: SeCreatePagefilePrivilege 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe Token: SeBackupPrivilege 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe Token: SeRestorePrivilege 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe Token: SeShutdownPrivilege 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe Token: SeDebugPrivilege 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe Token: SeSystemEnvironmentPrivilege 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe Token: SeChangeNotifyPrivilege 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe Token: SeRemoteShutdownPrivilege 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe Token: SeUndockPrivilege 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe Token: SeManageVolumePrivilege 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe Token: SeImpersonatePrivilege 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe Token: SeCreateGlobalPrivilege 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe Token: 33 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe Token: 34 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe Token: 35 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe Token: SeIncreaseQuotaPrivilege 1172 msdcsc.exe Token: SeSecurityPrivilege 1172 msdcsc.exe Token: SeTakeOwnershipPrivilege 1172 msdcsc.exe Token: SeLoadDriverPrivilege 1172 msdcsc.exe Token: SeSystemProfilePrivilege 1172 msdcsc.exe Token: SeSystemtimePrivilege 1172 msdcsc.exe Token: SeProfSingleProcessPrivilege 1172 msdcsc.exe Token: SeIncBasePriorityPrivilege 1172 msdcsc.exe Token: SeCreatePagefilePrivilege 1172 msdcsc.exe Token: SeBackupPrivilege 1172 msdcsc.exe Token: SeRestorePrivilege 1172 msdcsc.exe Token: SeShutdownPrivilege 1172 msdcsc.exe Token: SeDebugPrivilege 1172 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1172 msdcsc.exe Token: SeChangeNotifyPrivilege 1172 msdcsc.exe Token: SeRemoteShutdownPrivilege 1172 msdcsc.exe Token: SeUndockPrivilege 1172 msdcsc.exe Token: SeManageVolumePrivilege 1172 msdcsc.exe Token: SeImpersonatePrivilege 1172 msdcsc.exe Token: SeCreateGlobalPrivilege 1172 msdcsc.exe Token: 33 1172 msdcsc.exe Token: 34 1172 msdcsc.exe Token: 35 1172 msdcsc.exe Token: SeIncreaseQuotaPrivilege 1984 iexplore.exe Token: SeSecurityPrivilege 1984 iexplore.exe Token: SeTakeOwnershipPrivilege 1984 iexplore.exe Token: SeLoadDriverPrivilege 1984 iexplore.exe Token: SeSystemProfilePrivilege 1984 iexplore.exe Token: SeSystemtimePrivilege 1984 iexplore.exe Token: SeProfSingleProcessPrivilege 1984 iexplore.exe Token: SeIncBasePriorityPrivilege 1984 iexplore.exe Token: SeCreatePagefilePrivilege 1984 iexplore.exe Token: SeBackupPrivilege 1984 iexplore.exe Token: SeRestorePrivilege 1984 iexplore.exe Token: SeShutdownPrivilege 1984 iexplore.exe Token: SeDebugPrivilege 1984 iexplore.exe Token: SeSystemEnvironmentPrivilege 1984 iexplore.exe Token: SeChangeNotifyPrivilege 1984 iexplore.exe Token: SeRemoteShutdownPrivilege 1984 iexplore.exe Token: SeUndockPrivilege 1984 iexplore.exe Token: SeManageVolumePrivilege 1984 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
iexplore.exepid process 1984 iexplore.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exemsdcsc.exeiexplore.exedescription pid process target process PID 1756 wrote to memory of 1824 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe notepad.exe PID 1756 wrote to memory of 1824 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe notepad.exe PID 1756 wrote to memory of 1824 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe notepad.exe PID 1756 wrote to memory of 1824 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe notepad.exe PID 1756 wrote to memory of 1824 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe notepad.exe PID 1756 wrote to memory of 1824 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe notepad.exe PID 1756 wrote to memory of 1824 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe notepad.exe PID 1756 wrote to memory of 1824 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe notepad.exe PID 1756 wrote to memory of 1824 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe notepad.exe PID 1756 wrote to memory of 1824 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe notepad.exe PID 1756 wrote to memory of 1824 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe notepad.exe PID 1756 wrote to memory of 1824 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe notepad.exe PID 1756 wrote to memory of 1824 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe notepad.exe PID 1756 wrote to memory of 1824 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe notepad.exe PID 1756 wrote to memory of 1824 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe notepad.exe PID 1756 wrote to memory of 1824 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe notepad.exe PID 1756 wrote to memory of 1824 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe notepad.exe PID 1756 wrote to memory of 1824 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe notepad.exe PID 1756 wrote to memory of 1172 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe msdcsc.exe PID 1756 wrote to memory of 1172 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe msdcsc.exe PID 1756 wrote to memory of 1172 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe msdcsc.exe PID 1756 wrote to memory of 1172 1756 030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe msdcsc.exe PID 1172 wrote to memory of 1984 1172 msdcsc.exe iexplore.exe PID 1172 wrote to memory of 1984 1172 msdcsc.exe iexplore.exe PID 1172 wrote to memory of 1984 1172 msdcsc.exe iexplore.exe PID 1172 wrote to memory of 1984 1172 msdcsc.exe iexplore.exe PID 1172 wrote to memory of 1984 1172 msdcsc.exe iexplore.exe PID 1172 wrote to memory of 1984 1172 msdcsc.exe iexplore.exe PID 1984 wrote to memory of 1732 1984 iexplore.exe notepad.exe PID 1984 wrote to memory of 1732 1984 iexplore.exe notepad.exe PID 1984 wrote to memory of 1732 1984 iexplore.exe notepad.exe PID 1984 wrote to memory of 1732 1984 iexplore.exe notepad.exe PID 1984 wrote to memory of 1732 1984 iexplore.exe notepad.exe PID 1984 wrote to memory of 1732 1984 iexplore.exe notepad.exe PID 1984 wrote to memory of 1732 1984 iexplore.exe notepad.exe PID 1984 wrote to memory of 1732 1984 iexplore.exe notepad.exe PID 1984 wrote to memory of 1732 1984 iexplore.exe notepad.exe PID 1984 wrote to memory of 1732 1984 iexplore.exe notepad.exe PID 1984 wrote to memory of 1732 1984 iexplore.exe notepad.exe PID 1984 wrote to memory of 1732 1984 iexplore.exe notepad.exe PID 1984 wrote to memory of 1732 1984 iexplore.exe notepad.exe PID 1984 wrote to memory of 1732 1984 iexplore.exe notepad.exe PID 1984 wrote to memory of 1732 1984 iexplore.exe notepad.exe PID 1984 wrote to memory of 1732 1984 iexplore.exe notepad.exe PID 1984 wrote to memory of 1732 1984 iexplore.exe notepad.exe PID 1984 wrote to memory of 1732 1984 iexplore.exe notepad.exe PID 1984 wrote to memory of 1732 1984 iexplore.exe notepad.exe PID 1984 wrote to memory of 1732 1984 iexplore.exe notepad.exe PID 1984 wrote to memory of 1732 1984 iexplore.exe notepad.exe PID 1984 wrote to memory of 1732 1984 iexplore.exe notepad.exe PID 1984 wrote to memory of 1732 1984 iexplore.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe"C:\Users\Admin\AppData\Local\Temp\030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
81d1f0ba69f70c3b8eb6c00dea432dfe
SHA1f2e23705a6a465e8e6c7f02f3b175e2e06e84719
SHA256030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9
SHA5120fea7f04790a53638e2cc342f2d1713ba49363c31faa36bc5698f4f18be4b8d9f5006592b775d7c4bcf6f467f43fd005b80b5b6d5ad73aa3f0bfa344f0ad90ce
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
81d1f0ba69f70c3b8eb6c00dea432dfe
SHA1f2e23705a6a465e8e6c7f02f3b175e2e06e84719
SHA256030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9
SHA5120fea7f04790a53638e2cc342f2d1713ba49363c31faa36bc5698f4f18be4b8d9f5006592b775d7c4bcf6f467f43fd005b80b5b6d5ad73aa3f0bfa344f0ad90ce
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
81d1f0ba69f70c3b8eb6c00dea432dfe
SHA1f2e23705a6a465e8e6c7f02f3b175e2e06e84719
SHA256030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9
SHA5120fea7f04790a53638e2cc342f2d1713ba49363c31faa36bc5698f4f18be4b8d9f5006592b775d7c4bcf6f467f43fd005b80b5b6d5ad73aa3f0bfa344f0ad90ce
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
81d1f0ba69f70c3b8eb6c00dea432dfe
SHA1f2e23705a6a465e8e6c7f02f3b175e2e06e84719
SHA256030e0523148995ec2e91544642cacded035534ef6bf42c534336167fc96501f9
SHA5120fea7f04790a53638e2cc342f2d1713ba49363c31faa36bc5698f4f18be4b8d9f5006592b775d7c4bcf6f467f43fd005b80b5b6d5ad73aa3f0bfa344f0ad90ce
-
memory/1172-5-0x0000000000000000-mapping.dmp
-
memory/1732-12-0x0000000000000000-mapping.dmp
-
memory/1732-14-0x0000000000000000-mapping.dmp
-
memory/1732-13-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/1824-0-0x0000000000000000-mapping.dmp
-
memory/1824-2-0x0000000000000000-mapping.dmp
-
memory/1824-1-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/1984-8-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1984-9-0x00000000004B5820-mapping.dmp
-
memory/1984-10-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1984-11-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB