Analysis
-
max time kernel
132s -
max time network
142s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 20:18
Static task
static1
Behavioral task
behavioral1
Sample
643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.exe
Resource
win10v20201028
General
-
Target
643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.exe
-
Size
758KB
-
MD5
363b1f1af6f481e6498a1195272abe79
-
SHA1
9712b3c3df12c673623fd392adb97b239986fed4
-
SHA256
dcee7332f062683247eeb635ffea3a09c742e19bb0ea0f717b43bc1663195fd7
-
SHA512
e4f1490741fbe4ccd51f22e45e9c76a889492f47c45085cac9f38b7b7589d4733c3db01e1a2033a56640141f4d00660fe9a58589348a39613d58db279616d758
Malware Config
Extracted
darkcomet
Guest16
37.53.94.245:1604
DC_MUTEX-CA3JPES
-
InstallPath
MSDCSC\msdcsa.exe
-
gencode
NTfqNtVkHorv
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsa.exe" 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE -
Executes dropped EXE 2 IoCs
Processes:
msdcsa.exemsdcsa.EXEpid process 1392 msdcsa.exe 1668 msdcsa.EXE -
Loads dropped DLL 2 IoCs
Processes:
643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXEpid process 1968 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE 1968 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsa.exe" 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE -
Drops file in System32 directory 4 IoCs
Processes:
643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXEmsdcsa.exedescription ioc process File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsa.exe 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE File opened for modification C:\Windows\SysWOW64\MSDCSC\ 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsa.EXE msdcsa.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsa.exe 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE -
Suspicious use of SetThreadContext 2 IoCs
Processes:
643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.exemsdcsa.exedescription pid process target process PID 1032 set thread context of 1968 1032 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.exe 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE PID 1392 set thread context of 1668 1392 msdcsa.exe msdcsa.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXEmsdcsa.EXEdescription pid process Token: SeIncreaseQuotaPrivilege 1968 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE Token: SeSecurityPrivilege 1968 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE Token: SeTakeOwnershipPrivilege 1968 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE Token: SeLoadDriverPrivilege 1968 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE Token: SeSystemProfilePrivilege 1968 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE Token: SeSystemtimePrivilege 1968 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE Token: SeProfSingleProcessPrivilege 1968 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE Token: SeIncBasePriorityPrivilege 1968 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE Token: SeCreatePagefilePrivilege 1968 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE Token: SeBackupPrivilege 1968 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE Token: SeRestorePrivilege 1968 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE Token: SeShutdownPrivilege 1968 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE Token: SeDebugPrivilege 1968 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE Token: SeSystemEnvironmentPrivilege 1968 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE Token: SeChangeNotifyPrivilege 1968 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE Token: SeRemoteShutdownPrivilege 1968 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE Token: SeUndockPrivilege 1968 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE Token: SeManageVolumePrivilege 1968 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE Token: SeImpersonatePrivilege 1968 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE Token: SeCreateGlobalPrivilege 1968 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE Token: 33 1968 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE Token: 34 1968 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE Token: 35 1968 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE Token: SeIncreaseQuotaPrivilege 1668 msdcsa.EXE Token: SeSecurityPrivilege 1668 msdcsa.EXE Token: SeTakeOwnershipPrivilege 1668 msdcsa.EXE Token: SeLoadDriverPrivilege 1668 msdcsa.EXE Token: SeSystemProfilePrivilege 1668 msdcsa.EXE Token: SeSystemtimePrivilege 1668 msdcsa.EXE Token: SeProfSingleProcessPrivilege 1668 msdcsa.EXE Token: SeIncBasePriorityPrivilege 1668 msdcsa.EXE Token: SeCreatePagefilePrivilege 1668 msdcsa.EXE Token: SeBackupPrivilege 1668 msdcsa.EXE Token: SeRestorePrivilege 1668 msdcsa.EXE Token: SeShutdownPrivilege 1668 msdcsa.EXE Token: SeDebugPrivilege 1668 msdcsa.EXE Token: SeSystemEnvironmentPrivilege 1668 msdcsa.EXE Token: SeChangeNotifyPrivilege 1668 msdcsa.EXE Token: SeRemoteShutdownPrivilege 1668 msdcsa.EXE Token: SeUndockPrivilege 1668 msdcsa.EXE Token: SeManageVolumePrivilege 1668 msdcsa.EXE Token: SeImpersonatePrivilege 1668 msdcsa.EXE Token: SeCreateGlobalPrivilege 1668 msdcsa.EXE Token: 33 1668 msdcsa.EXE Token: 34 1668 msdcsa.EXE Token: 35 1668 msdcsa.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.exemsdcsa.exemsdcsa.EXEpid process 1032 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.exe 1392 msdcsa.exe 1668 msdcsa.EXE -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.exe643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXEmsdcsa.exedescription pid process target process PID 1032 wrote to memory of 1968 1032 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.exe 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE PID 1032 wrote to memory of 1968 1032 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.exe 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE PID 1032 wrote to memory of 1968 1032 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.exe 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE PID 1032 wrote to memory of 1968 1032 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.exe 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE PID 1032 wrote to memory of 1968 1032 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.exe 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE PID 1032 wrote to memory of 1968 1032 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.exe 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE PID 1032 wrote to memory of 1968 1032 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.exe 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE PID 1032 wrote to memory of 1968 1032 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.exe 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE PID 1032 wrote to memory of 1968 1032 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.exe 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE PID 1032 wrote to memory of 1968 1032 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.exe 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE PID 1032 wrote to memory of 1968 1032 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.exe 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE PID 1032 wrote to memory of 1968 1032 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.exe 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE PID 1032 wrote to memory of 1968 1032 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.exe 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE PID 1968 wrote to memory of 1392 1968 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE msdcsa.exe PID 1968 wrote to memory of 1392 1968 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE msdcsa.exe PID 1968 wrote to memory of 1392 1968 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE msdcsa.exe PID 1968 wrote to memory of 1392 1968 643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE msdcsa.exe PID 1392 wrote to memory of 1668 1392 msdcsa.exe msdcsa.EXE PID 1392 wrote to memory of 1668 1392 msdcsa.exe msdcsa.EXE PID 1392 wrote to memory of 1668 1392 msdcsa.exe msdcsa.EXE PID 1392 wrote to memory of 1668 1392 msdcsa.exe msdcsa.EXE PID 1392 wrote to memory of 1668 1392 msdcsa.exe msdcsa.EXE PID 1392 wrote to memory of 1668 1392 msdcsa.exe msdcsa.EXE PID 1392 wrote to memory of 1668 1392 msdcsa.exe msdcsa.EXE PID 1392 wrote to memory of 1668 1392 msdcsa.exe msdcsa.EXE PID 1392 wrote to memory of 1668 1392 msdcsa.exe msdcsa.EXE PID 1392 wrote to memory of 1668 1392 msdcsa.exe msdcsa.EXE PID 1392 wrote to memory of 1668 1392 msdcsa.exe msdcsa.EXE PID 1392 wrote to memory of 1668 1392 msdcsa.exe msdcsa.EXE PID 1392 wrote to memory of 1668 1392 msdcsa.exe msdcsa.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.exe"C:\Users\Admin\AppData\Local\Temp\643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE"C:\Users\Admin\AppData\Local\Temp\643360deb1ae0864baad3e8c8edea7ee5693720fe9fad84b4ddac29cb5f63891.EXE"2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\MSDCSC\msdcsa.exe"C:\Windows\system32\MSDCSC\msdcsa.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\MSDCSC\msdcsa.EXE"C:\Windows\SysWOW64\MSDCSC\msdcsa.EXE"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1668
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\MSDCSC\msdcsa.EXEMD5
363b1f1af6f481e6498a1195272abe79
SHA19712b3c3df12c673623fd392adb97b239986fed4
SHA256dcee7332f062683247eeb635ffea3a09c742e19bb0ea0f717b43bc1663195fd7
SHA512e4f1490741fbe4ccd51f22e45e9c76a889492f47c45085cac9f38b7b7589d4733c3db01e1a2033a56640141f4d00660fe9a58589348a39613d58db279616d758
-
C:\Windows\SysWOW64\MSDCSC\msdcsa.exeMD5
363b1f1af6f481e6498a1195272abe79
SHA19712b3c3df12c673623fd392adb97b239986fed4
SHA256dcee7332f062683247eeb635ffea3a09c742e19bb0ea0f717b43bc1663195fd7
SHA512e4f1490741fbe4ccd51f22e45e9c76a889492f47c45085cac9f38b7b7589d4733c3db01e1a2033a56640141f4d00660fe9a58589348a39613d58db279616d758
-
C:\Windows\SysWOW64\MSDCSC\msdcsa.exeMD5
363b1f1af6f481e6498a1195272abe79
SHA19712b3c3df12c673623fd392adb97b239986fed4
SHA256dcee7332f062683247eeb635ffea3a09c742e19bb0ea0f717b43bc1663195fd7
SHA512e4f1490741fbe4ccd51f22e45e9c76a889492f47c45085cac9f38b7b7589d4733c3db01e1a2033a56640141f4d00660fe9a58589348a39613d58db279616d758
-
\Windows\SysWOW64\MSDCSC\msdcsa.exeMD5
363b1f1af6f481e6498a1195272abe79
SHA19712b3c3df12c673623fd392adb97b239986fed4
SHA256dcee7332f062683247eeb635ffea3a09c742e19bb0ea0f717b43bc1663195fd7
SHA512e4f1490741fbe4ccd51f22e45e9c76a889492f47c45085cac9f38b7b7589d4733c3db01e1a2033a56640141f4d00660fe9a58589348a39613d58db279616d758
-
\Windows\SysWOW64\MSDCSC\msdcsa.exeMD5
363b1f1af6f481e6498a1195272abe79
SHA19712b3c3df12c673623fd392adb97b239986fed4
SHA256dcee7332f062683247eeb635ffea3a09c742e19bb0ea0f717b43bc1663195fd7
SHA512e4f1490741fbe4ccd51f22e45e9c76a889492f47c45085cac9f38b7b7589d4733c3db01e1a2033a56640141f4d00660fe9a58589348a39613d58db279616d758
-
memory/1392-7-0x0000000000000000-mapping.dmp
-
memory/1668-13-0x000000000048F888-mapping.dmp
-
memory/1968-3-0x000000000048F888-mapping.dmp
-
memory/1968-2-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1968-4-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB