Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
10-11-2020 10:54
Static task
static1
Behavioral task
behavioral1
Sample
23177b599c322119b7796bbfd6e8f0005ed1f3a6e51b28c19bfe85706cbc30ea.exe
Resource
win7v20201028
General
-
Target
23177b599c322119b7796bbfd6e8f0005ed1f3a6e51b28c19bfe85706cbc30ea.exe
-
Size
726KB
-
MD5
36f8a5356eaa170009cd6cc4bb7e4eeb
-
SHA1
fc4601d48e42cfbea7cee7891d9170d7d9de2370
-
SHA256
23177b599c322119b7796bbfd6e8f0005ed1f3a6e51b28c19bfe85706cbc30ea
-
SHA512
30cab5cb33f7fd22bfe004cb794e65ad7bd1513404893107ebcb8bc12ea6d7ee4526302cd352710ed650dc3043fd16c333eb131e8313951dea48273060096660
Malware Config
Extracted
darkcomet
Cybergate
xyk.no-ip.org:82
DC_MUTEX-CBRCJKD
-
gencode
dStG8rFqSf0i
-
install
false
-
offline_keylogger
true
-
password
12345678
-
persistence
false
Signatures
-
Processes:
resource yara_rule behavioral2/memory/900-0-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/900-2-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/900-3-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\wuauclt = "C:\\Users\\Admin\\AppData\\Local\\WinUpdate.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
23177b599c322119b7796bbfd6e8f0005ed1f3a6e51b28c19bfe85706cbc30ea.exedescription pid process target process PID 428 set thread context of 900 428 23177b599c322119b7796bbfd6e8f0005ed1f3a6e51b28c19bfe85706cbc30ea.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
dw20.exepid process 2684 dw20.exe 2684 dw20.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
Processes:
23177b599c322119b7796bbfd6e8f0005ed1f3a6e51b28c19bfe85706cbc30ea.exeAppLaunch.exedw20.exedescription pid process Token: SeDebugPrivilege 428 23177b599c322119b7796bbfd6e8f0005ed1f3a6e51b28c19bfe85706cbc30ea.exe Token: SeIncreaseQuotaPrivilege 900 AppLaunch.exe Token: SeSecurityPrivilege 900 AppLaunch.exe Token: SeTakeOwnershipPrivilege 900 AppLaunch.exe Token: SeLoadDriverPrivilege 900 AppLaunch.exe Token: SeSystemProfilePrivilege 900 AppLaunch.exe Token: SeSystemtimePrivilege 900 AppLaunch.exe Token: SeProfSingleProcessPrivilege 900 AppLaunch.exe Token: SeIncBasePriorityPrivilege 900 AppLaunch.exe Token: SeCreatePagefilePrivilege 900 AppLaunch.exe Token: SeBackupPrivilege 900 AppLaunch.exe Token: SeRestorePrivilege 900 AppLaunch.exe Token: SeShutdownPrivilege 900 AppLaunch.exe Token: SeDebugPrivilege 900 AppLaunch.exe Token: SeSystemEnvironmentPrivilege 900 AppLaunch.exe Token: SeChangeNotifyPrivilege 900 AppLaunch.exe Token: SeRemoteShutdownPrivilege 900 AppLaunch.exe Token: SeUndockPrivilege 900 AppLaunch.exe Token: SeManageVolumePrivilege 900 AppLaunch.exe Token: SeImpersonatePrivilege 900 AppLaunch.exe Token: SeCreateGlobalPrivilege 900 AppLaunch.exe Token: 33 900 AppLaunch.exe Token: 34 900 AppLaunch.exe Token: 35 900 AppLaunch.exe Token: 36 900 AppLaunch.exe Token: SeRestorePrivilege 2684 dw20.exe Token: SeBackupPrivilege 2684 dw20.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
AppLaunch.exepid process 900 AppLaunch.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
23177b599c322119b7796bbfd6e8f0005ed1f3a6e51b28c19bfe85706cbc30ea.execmd.exedescription pid process target process PID 428 wrote to memory of 900 428 23177b599c322119b7796bbfd6e8f0005ed1f3a6e51b28c19bfe85706cbc30ea.exe AppLaunch.exe PID 428 wrote to memory of 900 428 23177b599c322119b7796bbfd6e8f0005ed1f3a6e51b28c19bfe85706cbc30ea.exe AppLaunch.exe PID 428 wrote to memory of 900 428 23177b599c322119b7796bbfd6e8f0005ed1f3a6e51b28c19bfe85706cbc30ea.exe AppLaunch.exe PID 428 wrote to memory of 900 428 23177b599c322119b7796bbfd6e8f0005ed1f3a6e51b28c19bfe85706cbc30ea.exe AppLaunch.exe PID 428 wrote to memory of 900 428 23177b599c322119b7796bbfd6e8f0005ed1f3a6e51b28c19bfe85706cbc30ea.exe AppLaunch.exe PID 428 wrote to memory of 900 428 23177b599c322119b7796bbfd6e8f0005ed1f3a6e51b28c19bfe85706cbc30ea.exe AppLaunch.exe PID 428 wrote to memory of 900 428 23177b599c322119b7796bbfd6e8f0005ed1f3a6e51b28c19bfe85706cbc30ea.exe AppLaunch.exe PID 428 wrote to memory of 900 428 23177b599c322119b7796bbfd6e8f0005ed1f3a6e51b28c19bfe85706cbc30ea.exe AppLaunch.exe PID 428 wrote to memory of 2684 428 23177b599c322119b7796bbfd6e8f0005ed1f3a6e51b28c19bfe85706cbc30ea.exe dw20.exe PID 428 wrote to memory of 2684 428 23177b599c322119b7796bbfd6e8f0005ed1f3a6e51b28c19bfe85706cbc30ea.exe dw20.exe PID 428 wrote to memory of 2684 428 23177b599c322119b7796bbfd6e8f0005ed1f3a6e51b28c19bfe85706cbc30ea.exe dw20.exe PID 428 wrote to memory of 3712 428 23177b599c322119b7796bbfd6e8f0005ed1f3a6e51b28c19bfe85706cbc30ea.exe cmd.exe PID 428 wrote to memory of 3712 428 23177b599c322119b7796bbfd6e8f0005ed1f3a6e51b28c19bfe85706cbc30ea.exe cmd.exe PID 428 wrote to memory of 3712 428 23177b599c322119b7796bbfd6e8f0005ed1f3a6e51b28c19bfe85706cbc30ea.exe cmd.exe PID 3712 wrote to memory of 2980 3712 cmd.exe reg.exe PID 3712 wrote to memory of 2980 3712 cmd.exe reg.exe PID 3712 wrote to memory of 2980 3712 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23177b599c322119b7796bbfd6e8f0005ed1f3a6e51b28c19bfe85706cbc30ea.exe"C:\Users\Admin\AppData\Local\Temp\23177b599c322119b7796bbfd6e8f0005ed1f3a6e51b28c19bfe85706cbc30ea.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 9642⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "wuauclt" /t REG_SZ /d "C:\Users\Admin\AppData\Local\WinUpdate.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "wuauclt" /t REG_SZ /d "C:\Users\Admin\AppData\Local\WinUpdate.exe3⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/900-1-0x00000000004B5670-mapping.dmp
-
memory/900-0-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/900-2-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/900-3-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2684-4-0x0000000000000000-mapping.dmp
-
memory/2684-7-0x0000000002A50000-0x0000000002A51000-memory.dmpFilesize
4KB
-
memory/2684-8-0x0000000002A50000-0x0000000002A51000-memory.dmpFilesize
4KB
-
memory/2684-11-0x0000000003240000-0x0000000003241000-memory.dmpFilesize
4KB
-
memory/2684-10-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-12-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-13-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-14-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-15-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-16-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-17-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-18-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-19-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-20-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-22-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-21-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-23-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-24-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-25-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-26-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-27-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-28-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-29-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-30-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-31-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-32-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-33-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-34-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-35-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-36-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-37-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-38-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-39-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-40-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-41-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-42-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-43-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-44-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-45-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-46-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-47-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-48-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-49-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-50-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-51-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-52-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-53-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-54-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-55-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-56-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-57-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-58-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-59-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-60-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-61-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-62-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-63-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-64-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-65-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-66-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-67-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-68-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-69-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2684-70-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2980-6-0x0000000000000000-mapping.dmp
-
memory/3712-5-0x0000000000000000-mapping.dmp