Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
10-11-2020 11:49
Static task
static1
Behavioral task
behavioral1
Sample
f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe
Resource
win10v20201028
General
-
Target
f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe
-
Size
354KB
-
MD5
77761a1080c4b0b32f59254414490f67
-
SHA1
6bc2da22ab25b8eee137cff621f970ac28deffe0
-
SHA256
f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e
-
SHA512
48ee910e12c4b94346f99beecab7980be1bfc15c7637b4e0761f783aa57bf5fc44c9e7f090bcd48538f65911e3b3362578eeb6525a104c2484e1b54eec365d1d
Malware Config
Extracted
darkcomet
06-11-2020
LAMIA-41739.portmap.io:41739
karmina113.sytes.net:7777
karmina200.sytes.net:7777
DC_MUTEX-R9E2RDG
-
InstallPath
svchost\svchost.exe
-
gencode
dneJWn9fFTdt
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost\\svchost.exe" f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe -
Executes dropped EXE 2 IoCs
Processes:
svchost.exesvchost.exepid process 3436 svchost.exe 4436 svchost.exe -
Processes:
resource yara_rule behavioral2/memory/4196-7-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/4196-9-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/4196-10-0x0000000000400000-0x00000000004C7000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exef6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exesvchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update Folder\\Windows Update.exe" f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost\\svchost.exe" f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost\\svchost.exe" svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exesvchost.exedescription pid process target process PID 4760 set thread context of 4196 4760 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe PID 3436 set thread context of 4436 3436 svchost.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exesvchost.exedescription pid process Token: SeIncreaseQuotaPrivilege 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeSecurityPrivilege 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeTakeOwnershipPrivilege 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeLoadDriverPrivilege 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeSystemProfilePrivilege 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeSystemtimePrivilege 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeProfSingleProcessPrivilege 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeIncBasePriorityPrivilege 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeCreatePagefilePrivilege 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeBackupPrivilege 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeRestorePrivilege 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeShutdownPrivilege 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeDebugPrivilege 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeSystemEnvironmentPrivilege 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeChangeNotifyPrivilege 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeRemoteShutdownPrivilege 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeUndockPrivilege 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeManageVolumePrivilege 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeImpersonatePrivilege 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeCreateGlobalPrivilege 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: 33 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: 34 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: 35 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: 36 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeIncreaseQuotaPrivilege 4436 svchost.exe Token: SeSecurityPrivilege 4436 svchost.exe Token: SeTakeOwnershipPrivilege 4436 svchost.exe Token: SeLoadDriverPrivilege 4436 svchost.exe Token: SeSystemProfilePrivilege 4436 svchost.exe Token: SeSystemtimePrivilege 4436 svchost.exe Token: SeProfSingleProcessPrivilege 4436 svchost.exe Token: SeIncBasePriorityPrivilege 4436 svchost.exe Token: SeCreatePagefilePrivilege 4436 svchost.exe Token: SeBackupPrivilege 4436 svchost.exe Token: SeRestorePrivilege 4436 svchost.exe Token: SeShutdownPrivilege 4436 svchost.exe Token: SeDebugPrivilege 4436 svchost.exe Token: SeSystemEnvironmentPrivilege 4436 svchost.exe Token: SeChangeNotifyPrivilege 4436 svchost.exe Token: SeRemoteShutdownPrivilege 4436 svchost.exe Token: SeUndockPrivilege 4436 svchost.exe Token: SeManageVolumePrivilege 4436 svchost.exe Token: SeImpersonatePrivilege 4436 svchost.exe Token: SeCreateGlobalPrivilege 4436 svchost.exe Token: 33 4436 svchost.exe Token: 34 4436 svchost.exe Token: 35 4436 svchost.exe Token: 36 4436 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
svchost.exepid process 4436 svchost.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exef6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.execmd.execmd.exesvchost.exesvchost.exedescription pid process target process PID 4760 wrote to memory of 4196 4760 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe PID 4760 wrote to memory of 4196 4760 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe PID 4760 wrote to memory of 4196 4760 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe PID 4760 wrote to memory of 4196 4760 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe PID 4760 wrote to memory of 4196 4760 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe PID 4760 wrote to memory of 4196 4760 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe PID 4760 wrote to memory of 4196 4760 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe PID 4196 wrote to memory of 440 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe cmd.exe PID 4196 wrote to memory of 440 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe cmd.exe PID 4196 wrote to memory of 440 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe cmd.exe PID 4196 wrote to memory of 756 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe cmd.exe PID 4196 wrote to memory of 756 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe cmd.exe PID 4196 wrote to memory of 756 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe cmd.exe PID 756 wrote to memory of 4152 756 cmd.exe attrib.exe PID 756 wrote to memory of 4152 756 cmd.exe attrib.exe PID 756 wrote to memory of 4152 756 cmd.exe attrib.exe PID 440 wrote to memory of 3272 440 cmd.exe attrib.exe PID 440 wrote to memory of 3272 440 cmd.exe attrib.exe PID 440 wrote to memory of 3272 440 cmd.exe attrib.exe PID 4196 wrote to memory of 3436 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe svchost.exe PID 4196 wrote to memory of 3436 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe svchost.exe PID 4196 wrote to memory of 3436 4196 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe svchost.exe PID 3436 wrote to memory of 4436 3436 svchost.exe svchost.exe PID 3436 wrote to memory of 4436 3436 svchost.exe svchost.exe PID 3436 wrote to memory of 4436 3436 svchost.exe svchost.exe PID 3436 wrote to memory of 4436 3436 svchost.exe svchost.exe PID 3436 wrote to memory of 4436 3436 svchost.exe svchost.exe PID 3436 wrote to memory of 4436 3436 svchost.exe svchost.exe PID 3436 wrote to memory of 4436 3436 svchost.exe svchost.exe PID 4436 wrote to memory of 4504 4436 svchost.exe notepad.exe PID 4436 wrote to memory of 4504 4436 svchost.exe notepad.exe PID 4436 wrote to memory of 4504 4436 svchost.exe notepad.exe PID 4436 wrote to memory of 4504 4436 svchost.exe notepad.exe PID 4436 wrote to memory of 4504 4436 svchost.exe notepad.exe PID 4436 wrote to memory of 4504 4436 svchost.exe notepad.exe PID 4436 wrote to memory of 4504 4436 svchost.exe notepad.exe PID 4436 wrote to memory of 4504 4436 svchost.exe notepad.exe PID 4436 wrote to memory of 4504 4436 svchost.exe notepad.exe PID 4436 wrote to memory of 4504 4436 svchost.exe notepad.exe PID 4436 wrote to memory of 4504 4436 svchost.exe notepad.exe PID 4436 wrote to memory of 4504 4436 svchost.exe notepad.exe PID 4436 wrote to memory of 4504 4436 svchost.exe notepad.exe PID 4436 wrote to memory of 4504 4436 svchost.exe notepad.exe PID 4436 wrote to memory of 4504 4436 svchost.exe notepad.exe PID 4436 wrote to memory of 4504 4436 svchost.exe notepad.exe PID 4436 wrote to memory of 4504 4436 svchost.exe notepad.exe PID 4436 wrote to memory of 4504 4436 svchost.exe notepad.exe PID 4436 wrote to memory of 4504 4436 svchost.exe notepad.exe PID 4436 wrote to memory of 4504 4436 svchost.exe notepad.exe PID 4436 wrote to memory of 4504 4436 svchost.exe notepad.exe PID 4436 wrote to memory of 4504 4436 svchost.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 4152 attrib.exe 3272 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe"C:\Users\Admin\AppData\Local\Temp\f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe"C:\Users\Admin\AppData\Local\Temp\f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe" +s +h4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\svchost\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost\svchost.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\svchost\svchost.exeMD5
77761a1080c4b0b32f59254414490f67
SHA16bc2da22ab25b8eee137cff621f970ac28deffe0
SHA256f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e
SHA51248ee910e12c4b94346f99beecab7980be1bfc15c7637b4e0761f783aa57bf5fc44c9e7f090bcd48538f65911e3b3362578eeb6525a104c2484e1b54eec365d1d
-
C:\Users\Admin\AppData\Local\Temp\svchost\svchost.exeMD5
77761a1080c4b0b32f59254414490f67
SHA16bc2da22ab25b8eee137cff621f970ac28deffe0
SHA256f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e
SHA51248ee910e12c4b94346f99beecab7980be1bfc15c7637b4e0761f783aa57bf5fc44c9e7f090bcd48538f65911e3b3362578eeb6525a104c2484e1b54eec365d1d
-
C:\Users\Admin\AppData\Local\Temp\svchost\svchost.exeMD5
77761a1080c4b0b32f59254414490f67
SHA16bc2da22ab25b8eee137cff621f970ac28deffe0
SHA256f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e
SHA51248ee910e12c4b94346f99beecab7980be1bfc15c7637b4e0761f783aa57bf5fc44c9e7f090bcd48538f65911e3b3362578eeb6525a104c2484e1b54eec365d1d
-
memory/440-11-0x0000000000000000-mapping.dmp
-
memory/756-12-0x0000000000000000-mapping.dmp
-
memory/3272-14-0x0000000000000000-mapping.dmp
-
memory/3436-18-0x0000000071CE0000-0x00000000723CE000-memory.dmpFilesize
6.9MB
-
memory/3436-15-0x0000000000000000-mapping.dmp
-
memory/4152-13-0x0000000000000000-mapping.dmp
-
memory/4196-9-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/4196-10-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/4196-8-0x00000000004BD830-mapping.dmp
-
memory/4196-7-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/4436-26-0x00000000004BD830-mapping.dmp
-
memory/4504-32-0x0000000000000000-mapping.dmp
-
memory/4504-31-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4504-30-0x0000000000000000-mapping.dmp
-
memory/4760-3-0x00000000053A0000-0x00000000053A1000-memory.dmpFilesize
4KB
-
memory/4760-6-0x0000000004DD0000-0x0000000004DD3000-memory.dmpFilesize
12KB
-
memory/4760-1-0x00000000005A0000-0x00000000005A1000-memory.dmpFilesize
4KB
-
memory/4760-0-0x0000000073370000-0x0000000073A5E000-memory.dmpFilesize
6.9MB
-
memory/4760-4-0x0000000004EA0000-0x0000000004EA1000-memory.dmpFilesize
4KB
-
memory/4760-5-0x0000000004F40000-0x0000000004F41000-memory.dmpFilesize
4KB