Analysis
-
max time kernel
151s -
max time network
142s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
13-11-2020 15:32
Static task
static1
Behavioral task
behavioral1
Sample
136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe
Resource
win7v20201028
General
-
Target
136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe
-
Size
252KB
-
MD5
8ac0a60849f224af190f126a5222788f
-
SHA1
afd425ae211d493f85227cb05929d2784345f4b3
-
SHA256
136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b
-
SHA512
928932ee4910fecbeee60052f81235c5a8fb6e0a8f20873f4db98e22559b9134d4d33b27f654a613880eb4df5bbe3d10930e0e6f57ebc60cb78494a8b5214d02
Malware Config
Extracted
darkcomet
Guest16
ximer2020.ddns.net:1604
DC_MUTEX-4U0HFC0
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
aDFqoxfKfrcR
-
install
true
-
offline_keylogger
true
-
password
82121020202222
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 1940 msdcsc.exe -
Processes:
resource yara_rule C:\Users\Admin\Documents\MSDCSC\msdcsc.exe upx \Users\Admin\Documents\MSDCSC\msdcsc.exe upx \Users\Admin\Documents\MSDCSC\msdcsc.exe upx C:\Users\Admin\Documents\MSDCSC\msdcsc.exe upx behavioral1/memory/1700-8-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1700-10-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1700-11-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 1900 notepad.exe -
Loads dropped DLL 2 IoCs
Processes:
136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exepid process 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exemsdcsc.exeiexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" iexplore.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
msdcsc.exedescription pid process target process PID 1940 set thread context of 1700 1940 msdcsc.exe iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 1700 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exemsdcsc.exeiexplore.exedescription pid process Token: SeIncreaseQuotaPrivilege 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe Token: SeSecurityPrivilege 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe Token: SeTakeOwnershipPrivilege 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe Token: SeLoadDriverPrivilege 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe Token: SeSystemProfilePrivilege 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe Token: SeSystemtimePrivilege 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe Token: SeProfSingleProcessPrivilege 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe Token: SeIncBasePriorityPrivilege 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe Token: SeCreatePagefilePrivilege 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe Token: SeBackupPrivilege 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe Token: SeRestorePrivilege 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe Token: SeShutdownPrivilege 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe Token: SeDebugPrivilege 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe Token: SeSystemEnvironmentPrivilege 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe Token: SeChangeNotifyPrivilege 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe Token: SeRemoteShutdownPrivilege 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe Token: SeUndockPrivilege 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe Token: SeManageVolumePrivilege 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe Token: SeImpersonatePrivilege 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe Token: SeCreateGlobalPrivilege 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe Token: 33 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe Token: 34 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe Token: 35 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe Token: SeIncreaseQuotaPrivilege 1940 msdcsc.exe Token: SeSecurityPrivilege 1940 msdcsc.exe Token: SeTakeOwnershipPrivilege 1940 msdcsc.exe Token: SeLoadDriverPrivilege 1940 msdcsc.exe Token: SeSystemProfilePrivilege 1940 msdcsc.exe Token: SeSystemtimePrivilege 1940 msdcsc.exe Token: SeProfSingleProcessPrivilege 1940 msdcsc.exe Token: SeIncBasePriorityPrivilege 1940 msdcsc.exe Token: SeCreatePagefilePrivilege 1940 msdcsc.exe Token: SeBackupPrivilege 1940 msdcsc.exe Token: SeRestorePrivilege 1940 msdcsc.exe Token: SeShutdownPrivilege 1940 msdcsc.exe Token: SeDebugPrivilege 1940 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1940 msdcsc.exe Token: SeChangeNotifyPrivilege 1940 msdcsc.exe Token: SeRemoteShutdownPrivilege 1940 msdcsc.exe Token: SeUndockPrivilege 1940 msdcsc.exe Token: SeManageVolumePrivilege 1940 msdcsc.exe Token: SeImpersonatePrivilege 1940 msdcsc.exe Token: SeCreateGlobalPrivilege 1940 msdcsc.exe Token: 33 1940 msdcsc.exe Token: 34 1940 msdcsc.exe Token: 35 1940 msdcsc.exe Token: SeIncreaseQuotaPrivilege 1700 iexplore.exe Token: SeSecurityPrivilege 1700 iexplore.exe Token: SeTakeOwnershipPrivilege 1700 iexplore.exe Token: SeLoadDriverPrivilege 1700 iexplore.exe Token: SeSystemProfilePrivilege 1700 iexplore.exe Token: SeSystemtimePrivilege 1700 iexplore.exe Token: SeProfSingleProcessPrivilege 1700 iexplore.exe Token: SeIncBasePriorityPrivilege 1700 iexplore.exe Token: SeCreatePagefilePrivilege 1700 iexplore.exe Token: SeBackupPrivilege 1700 iexplore.exe Token: SeRestorePrivilege 1700 iexplore.exe Token: SeShutdownPrivilege 1700 iexplore.exe Token: SeDebugPrivilege 1700 iexplore.exe Token: SeSystemEnvironmentPrivilege 1700 iexplore.exe Token: SeChangeNotifyPrivilege 1700 iexplore.exe Token: SeRemoteShutdownPrivilege 1700 iexplore.exe Token: SeUndockPrivilege 1700 iexplore.exe Token: SeManageVolumePrivilege 1700 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
iexplore.exepid process 1700 iexplore.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exemsdcsc.exeiexplore.exedescription pid process target process PID 536 wrote to memory of 1900 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe notepad.exe PID 536 wrote to memory of 1900 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe notepad.exe PID 536 wrote to memory of 1900 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe notepad.exe PID 536 wrote to memory of 1900 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe notepad.exe PID 536 wrote to memory of 1900 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe notepad.exe PID 536 wrote to memory of 1900 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe notepad.exe PID 536 wrote to memory of 1900 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe notepad.exe PID 536 wrote to memory of 1900 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe notepad.exe PID 536 wrote to memory of 1900 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe notepad.exe PID 536 wrote to memory of 1900 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe notepad.exe PID 536 wrote to memory of 1900 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe notepad.exe PID 536 wrote to memory of 1900 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe notepad.exe PID 536 wrote to memory of 1900 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe notepad.exe PID 536 wrote to memory of 1900 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe notepad.exe PID 536 wrote to memory of 1900 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe notepad.exe PID 536 wrote to memory of 1900 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe notepad.exe PID 536 wrote to memory of 1900 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe notepad.exe PID 536 wrote to memory of 1900 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe notepad.exe PID 536 wrote to memory of 1940 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe msdcsc.exe PID 536 wrote to memory of 1940 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe msdcsc.exe PID 536 wrote to memory of 1940 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe msdcsc.exe PID 536 wrote to memory of 1940 536 136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe msdcsc.exe PID 1940 wrote to memory of 1700 1940 msdcsc.exe iexplore.exe PID 1940 wrote to memory of 1700 1940 msdcsc.exe iexplore.exe PID 1940 wrote to memory of 1700 1940 msdcsc.exe iexplore.exe PID 1940 wrote to memory of 1700 1940 msdcsc.exe iexplore.exe PID 1940 wrote to memory of 1700 1940 msdcsc.exe iexplore.exe PID 1940 wrote to memory of 1700 1940 msdcsc.exe iexplore.exe PID 1700 wrote to memory of 2016 1700 iexplore.exe notepad.exe PID 1700 wrote to memory of 2016 1700 iexplore.exe notepad.exe PID 1700 wrote to memory of 2016 1700 iexplore.exe notepad.exe PID 1700 wrote to memory of 2016 1700 iexplore.exe notepad.exe PID 1700 wrote to memory of 2016 1700 iexplore.exe notepad.exe PID 1700 wrote to memory of 2016 1700 iexplore.exe notepad.exe PID 1700 wrote to memory of 2016 1700 iexplore.exe notepad.exe PID 1700 wrote to memory of 2016 1700 iexplore.exe notepad.exe PID 1700 wrote to memory of 2016 1700 iexplore.exe notepad.exe PID 1700 wrote to memory of 2016 1700 iexplore.exe notepad.exe PID 1700 wrote to memory of 2016 1700 iexplore.exe notepad.exe PID 1700 wrote to memory of 2016 1700 iexplore.exe notepad.exe PID 1700 wrote to memory of 2016 1700 iexplore.exe notepad.exe PID 1700 wrote to memory of 2016 1700 iexplore.exe notepad.exe PID 1700 wrote to memory of 2016 1700 iexplore.exe notepad.exe PID 1700 wrote to memory of 2016 1700 iexplore.exe notepad.exe PID 1700 wrote to memory of 2016 1700 iexplore.exe notepad.exe PID 1700 wrote to memory of 2016 1700 iexplore.exe notepad.exe PID 1700 wrote to memory of 2016 1700 iexplore.exe notepad.exe PID 1700 wrote to memory of 2016 1700 iexplore.exe notepad.exe PID 1700 wrote to memory of 2016 1700 iexplore.exe notepad.exe PID 1700 wrote to memory of 2016 1700 iexplore.exe notepad.exe PID 1700 wrote to memory of 2016 1700 iexplore.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe"C:\Users\Admin\AppData\Local\Temp\136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
8ac0a60849f224af190f126a5222788f
SHA1afd425ae211d493f85227cb05929d2784345f4b3
SHA256136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b
SHA512928932ee4910fecbeee60052f81235c5a8fb6e0a8f20873f4db98e22559b9134d4d33b27f654a613880eb4df5bbe3d10930e0e6f57ebc60cb78494a8b5214d02
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
8ac0a60849f224af190f126a5222788f
SHA1afd425ae211d493f85227cb05929d2784345f4b3
SHA256136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b
SHA512928932ee4910fecbeee60052f81235c5a8fb6e0a8f20873f4db98e22559b9134d4d33b27f654a613880eb4df5bbe3d10930e0e6f57ebc60cb78494a8b5214d02
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
8ac0a60849f224af190f126a5222788f
SHA1afd425ae211d493f85227cb05929d2784345f4b3
SHA256136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b
SHA512928932ee4910fecbeee60052f81235c5a8fb6e0a8f20873f4db98e22559b9134d4d33b27f654a613880eb4df5bbe3d10930e0e6f57ebc60cb78494a8b5214d02
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
8ac0a60849f224af190f126a5222788f
SHA1afd425ae211d493f85227cb05929d2784345f4b3
SHA256136a7ffea17fe69ac90d7af6ec1f17ff41bb8ce09bc8c28bd4d331861285ff5b
SHA512928932ee4910fecbeee60052f81235c5a8fb6e0a8f20873f4db98e22559b9134d4d33b27f654a613880eb4df5bbe3d10930e0e6f57ebc60cb78494a8b5214d02
-
memory/1700-9-0x00000000004B5820-mapping.dmp
-
memory/1700-8-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1700-10-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1700-11-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1900-2-0x0000000000000000-mapping.dmp
-
memory/1900-1-0x0000000000190000-0x0000000000191000-memory.dmpFilesize
4KB
-
memory/1900-0-0x0000000000000000-mapping.dmp
-
memory/1940-5-0x0000000000000000-mapping.dmp
-
memory/2016-12-0x0000000000000000-mapping.dmp
-
memory/2016-14-0x0000000000000000-mapping.dmp
-
memory/2016-13-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB