Analysis
-
max time kernel
151s -
max time network
138s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
10-11-2020 11:15
Static task
static1
Behavioral task
behavioral1
Sample
99ed455cf7867678bf77bdbcd8fd1c73586a78402e451c436a2036060ae1fae3.exe
Resource
win7v20201028
General
-
Target
99ed455cf7867678bf77bdbcd8fd1c73586a78402e451c436a2036060ae1fae3.exe
-
Size
939KB
-
MD5
0e838be21a95730626f8751e6d58e1a7
-
SHA1
c5dbfdf431daa4e76029eb91ea622a2973ebbf18
-
SHA256
99ed455cf7867678bf77bdbcd8fd1c73586a78402e451c436a2036060ae1fae3
-
SHA512
746c6d95bd7a1f6fe02a6ab01617017143b4675c383dafcad7ced10d4372b804f584d9e3e271921141950130b3c5208cc181d7fee6dbe1a719917202a5cf0a90
Malware Config
Extracted
darkcomet
Guest16
127.0.0.1:1604
192.168.1.132:1604
DC_MUTEX-UZ5QYPV
-
gencode
00JBqsRoxY0q
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 1976 svchost.exe -
Loads dropped DLL 1 IoCs
Processes:
99ed455cf7867678bf77bdbcd8fd1c73586a78402e451c436a2036060ae1fae3.exepid process 1744 99ed455cf7867678bf77bdbcd8fd1c73586a78402e451c436a2036060ae1fae3.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
99ed455cf7867678bf77bdbcd8fd1c73586a78402e451c436a2036060ae1fae3.exedescription pid process target process PID 1744 set thread context of 1976 1744 99ed455cf7867678bf77bdbcd8fd1c73586a78402e451c436a2036060ae1fae3.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
svchost.exedescription pid process Token: SeIncreaseQuotaPrivilege 1976 svchost.exe Token: SeSecurityPrivilege 1976 svchost.exe Token: SeTakeOwnershipPrivilege 1976 svchost.exe Token: SeLoadDriverPrivilege 1976 svchost.exe Token: SeSystemProfilePrivilege 1976 svchost.exe Token: SeSystemtimePrivilege 1976 svchost.exe Token: SeProfSingleProcessPrivilege 1976 svchost.exe Token: SeIncBasePriorityPrivilege 1976 svchost.exe Token: SeCreatePagefilePrivilege 1976 svchost.exe Token: SeBackupPrivilege 1976 svchost.exe Token: SeRestorePrivilege 1976 svchost.exe Token: SeShutdownPrivilege 1976 svchost.exe Token: SeDebugPrivilege 1976 svchost.exe Token: SeSystemEnvironmentPrivilege 1976 svchost.exe Token: SeChangeNotifyPrivilege 1976 svchost.exe Token: SeRemoteShutdownPrivilege 1976 svchost.exe Token: SeUndockPrivilege 1976 svchost.exe Token: SeManageVolumePrivilege 1976 svchost.exe Token: SeImpersonatePrivilege 1976 svchost.exe Token: SeCreateGlobalPrivilege 1976 svchost.exe Token: 33 1976 svchost.exe Token: 34 1976 svchost.exe Token: 35 1976 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
svchost.exepid process 1976 svchost.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
99ed455cf7867678bf77bdbcd8fd1c73586a78402e451c436a2036060ae1fae3.exedescription pid process target process PID 1744 wrote to memory of 1976 1744 99ed455cf7867678bf77bdbcd8fd1c73586a78402e451c436a2036060ae1fae3.exe svchost.exe PID 1744 wrote to memory of 1976 1744 99ed455cf7867678bf77bdbcd8fd1c73586a78402e451c436a2036060ae1fae3.exe svchost.exe PID 1744 wrote to memory of 1976 1744 99ed455cf7867678bf77bdbcd8fd1c73586a78402e451c436a2036060ae1fae3.exe svchost.exe PID 1744 wrote to memory of 1976 1744 99ed455cf7867678bf77bdbcd8fd1c73586a78402e451c436a2036060ae1fae3.exe svchost.exe PID 1744 wrote to memory of 1976 1744 99ed455cf7867678bf77bdbcd8fd1c73586a78402e451c436a2036060ae1fae3.exe svchost.exe PID 1744 wrote to memory of 1976 1744 99ed455cf7867678bf77bdbcd8fd1c73586a78402e451c436a2036060ae1fae3.exe svchost.exe PID 1744 wrote to memory of 1976 1744 99ed455cf7867678bf77bdbcd8fd1c73586a78402e451c436a2036060ae1fae3.exe svchost.exe PID 1744 wrote to memory of 1976 1744 99ed455cf7867678bf77bdbcd8fd1c73586a78402e451c436a2036060ae1fae3.exe svchost.exe PID 1744 wrote to memory of 1976 1744 99ed455cf7867678bf77bdbcd8fd1c73586a78402e451c436a2036060ae1fae3.exe svchost.exe PID 1744 wrote to memory of 1976 1744 99ed455cf7867678bf77bdbcd8fd1c73586a78402e451c436a2036060ae1fae3.exe svchost.exe PID 1744 wrote to memory of 1976 1744 99ed455cf7867678bf77bdbcd8fd1c73586a78402e451c436a2036060ae1fae3.exe svchost.exe PID 1744 wrote to memory of 1976 1744 99ed455cf7867678bf77bdbcd8fd1c73586a78402e451c436a2036060ae1fae3.exe svchost.exe PID 1744 wrote to memory of 1976 1744 99ed455cf7867678bf77bdbcd8fd1c73586a78402e451c436a2036060ae1fae3.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\99ed455cf7867678bf77bdbcd8fd1c73586a78402e451c436a2036060ae1fae3.exe"C:\Users\Admin\AppData\Local\Temp\99ed455cf7867678bf77bdbcd8fd1c73586a78402e451c436a2036060ae1fae3.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\plugtemp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\plugtemp\svchost.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\plugtemp\svchost.exeMD5
34aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
C:\Users\Admin\AppData\Local\Temp\plugtemp\svchost.exeMD5
34aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
\Users\Admin\AppData\Local\Temp\plugtemp\svchost.exeMD5
34aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
memory/1976-1-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1976-2-0x000000000048F888-mapping.dmp
-
memory/1976-4-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB