Analysis
- max time kernel
150s - max time network
150s - platform
windows7_x64 - resource
win7v20201028 - submitted
17/11/2020, 12:29
Static task
static1
Behavioral task
behavioral1
Sample
72263cf2067ce1601a07f821b1b84755.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target 72263cf2067ce1601a07f821b1b84755.exe
- Size 1.8MB
- Sample201117-bnqaevy14e
- SHA256 52d5e596c1da82e5895bcd485a98989ff1b81ab3ee5baa13a41ff1c2808493eb
- MD5 739ca775c833ba8c469ee2a53e1db2b5
- SHA1 60fcb08996081e8ea4c7fee17a2861ee56c62a5d
- SHA512 4e36ed5e3359c21648290843d4607e64b2229399c1919438d2301c17b3cac010062dee23037cc9fd8d7311764ee832659c71c6f6b2612a3922d331de22941fb2
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
vbsted
C2
-
forshared.ddns.net:6722
Mutex
-
DC_MUTEX-6UPV0L8
Attributes
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
kWdnrSvNCdV5
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe" RegSvcs.exe - Executes dropped EXE 5 IoCs
pid Process 912 kngmpwequb.pif 1764 RegSvcs.exe 268 msdcsc.exe 1916 kngmpwequb.pif 776 RegSvcs.exe - Loads dropped DLL 7 IoCs
pid Process 1960 72263cf2067ce1601a07f821b1b84755.exe 1960 72263cf2067ce1601a07f821b1b84755.exe 1960 72263cf2067ce1601a07f821b1b84755.exe 1960 72263cf2067ce1601a07f821b1b84755.exe 912 kngmpwequb.pif 1764 RegSvcs.exe 1916 kngmpwequb.pif - Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe" RegSvcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run kngmpwequb.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vbsted = "c:\\33725277\\KNGMPW~1.PIF c:\\33725277\\XPOMRF~1.RQN" kngmpwequb.pif Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run kngmpwequb.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vbsted = "c:\\33725277\\KNGMPW~1.PIF c:\\33725277\\XPOMRF~1.RQN" kngmpwequb.pif -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA kngmpwequb.pif Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA kngmpwequb.pif - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 912 set thread context of 1764 912 kngmpwequb.pif 30 PID 1916 set thread context of 776 1916 kngmpwequb.pif 35 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 912 kngmpwequb.pif 912 kngmpwequb.pif 912 kngmpwequb.pif 912 kngmpwequb.pif 912 kngmpwequb.pif 912 kngmpwequb.pif 912 kngmpwequb.pif 912 kngmpwequb.pif 912 kngmpwequb.pif 912 kngmpwequb.pif 912 kngmpwequb.pif 912 kngmpwequb.pif 912 kngmpwequb.pif 912 kngmpwequb.pif 912 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif 1916 kngmpwequb.pif - Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1764 RegSvcs.exe Token: SeSecurityPrivilege 1764 RegSvcs.exe Token: SeTakeOwnershipPrivilege 1764 RegSvcs.exe Token: SeLoadDriverPrivilege 1764 RegSvcs.exe Token: SeSystemProfilePrivilege 1764 RegSvcs.exe Token: SeSystemtimePrivilege 1764 RegSvcs.exe Token: SeProfSingleProcessPrivilege 1764 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1764 RegSvcs.exe Token: SeCreatePagefilePrivilege 1764 RegSvcs.exe Token: SeBackupPrivilege 1764 RegSvcs.exe Token: SeRestorePrivilege 1764 RegSvcs.exe Token: SeShutdownPrivilege 1764 RegSvcs.exe Token: SeDebugPrivilege 1764 RegSvcs.exe Token: SeSystemEnvironmentPrivilege 1764 RegSvcs.exe Token: SeChangeNotifyPrivilege 1764 RegSvcs.exe Token: SeRemoteShutdownPrivilege 1764 RegSvcs.exe Token: SeUndockPrivilege 1764 RegSvcs.exe Token: SeManageVolumePrivilege 1764 RegSvcs.exe Token: SeImpersonatePrivilege 1764 RegSvcs.exe Token: SeCreateGlobalPrivilege 1764 RegSvcs.exe Token: 33 1764 RegSvcs.exe Token: 34 1764 RegSvcs.exe Token: 35 1764 RegSvcs.exe Token: SeIncreaseQuotaPrivilege 776 RegSvcs.exe Token: SeSecurityPrivilege 776 RegSvcs.exe Token: SeTakeOwnershipPrivilege 776 RegSvcs.exe Token: SeLoadDriverPrivilege 776 RegSvcs.exe Token: SeSystemProfilePrivilege 776 RegSvcs.exe Token: SeSystemtimePrivilege 776 RegSvcs.exe Token: SeProfSingleProcessPrivilege 776 RegSvcs.exe Token: SeIncBasePriorityPrivilege 776 RegSvcs.exe Token: SeCreatePagefilePrivilege 776 RegSvcs.exe Token: SeBackupPrivilege 776 RegSvcs.exe Token: SeRestorePrivilege 776 RegSvcs.exe Token: SeShutdownPrivilege 776 RegSvcs.exe Token: SeDebugPrivilege 776 RegSvcs.exe Token: SeSystemEnvironmentPrivilege 776 RegSvcs.exe Token: SeChangeNotifyPrivilege 776 RegSvcs.exe Token: SeRemoteShutdownPrivilege 776 RegSvcs.exe Token: SeUndockPrivilege 776 RegSvcs.exe Token: SeManageVolumePrivilege 776 RegSvcs.exe Token: SeImpersonatePrivilege 776 RegSvcs.exe Token: SeCreateGlobalPrivilege 776 RegSvcs.exe Token: 33 776 RegSvcs.exe Token: 34 776 RegSvcs.exe Token: 35 776 RegSvcs.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 776 RegSvcs.exe - Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 1960 wrote to memory of 912 1960 72263cf2067ce1601a07f821b1b84755.exe 26 PID 1960 wrote to memory of 912 1960 72263cf2067ce1601a07f821b1b84755.exe 26 PID 1960 wrote to memory of 912 1960 72263cf2067ce1601a07f821b1b84755.exe 26 PID 1960 wrote to memory of 912 1960 72263cf2067ce1601a07f821b1b84755.exe 26 PID 912 wrote to memory of 1764 912 kngmpwequb.pif 30 PID 912 wrote to memory of 1764 912 kngmpwequb.pif 30 PID 912 wrote to memory of 1764 912 kngmpwequb.pif 30 PID 912 wrote to memory of 1764 912 kngmpwequb.pif 30 PID 912 wrote to memory of 1764 912 kngmpwequb.pif 30 PID 912 wrote to memory of 1764 912 kngmpwequb.pif 30 PID 912 wrote to memory of 1764 912 kngmpwequb.pif 30 PID 912 wrote to memory of 1764 912 kngmpwequb.pif 30 PID 912 wrote to memory of 1764 912 kngmpwequb.pif 30 PID 1764 wrote to memory of 268 1764 RegSvcs.exe 31 PID 1764 wrote to memory of 268 1764 RegSvcs.exe 31 PID 1764 wrote to memory of 268 1764 RegSvcs.exe 31 PID 1764 wrote to memory of 268 1764 RegSvcs.exe 31 PID 1764 wrote to memory of 268 1764 RegSvcs.exe 31 PID 1764 wrote to memory of 268 1764 RegSvcs.exe 31 PID 1764 wrote to memory of 268 1764 RegSvcs.exe 31 PID 912 wrote to memory of 436 912 kngmpwequb.pif 33 PID 912 wrote to memory of 436 912 kngmpwequb.pif 33 PID 912 wrote to memory of 436 912 kngmpwequb.pif 33 PID 912 wrote to memory of 436 912 kngmpwequb.pif 33 PID 436 wrote to memory of 1916 436 WScript.exe 34 PID 436 wrote to memory of 1916 436 WScript.exe 34 PID 436 wrote to memory of 1916 436 WScript.exe 34 PID 436 wrote to memory of 1916 436 WScript.exe 34 PID 1916 wrote to memory of 776 1916 kngmpwequb.pif 35 PID 1916 wrote to memory of 776 1916 kngmpwequb.pif 35 PID 1916 wrote to memory of 776 1916 kngmpwequb.pif 35 PID 1916 wrote to memory of 776 1916 kngmpwequb.pif 35 PID 1916 wrote to memory of 776 1916 kngmpwequb.pif 35 PID 1916 wrote to memory of 776 1916 kngmpwequb.pif 35 PID 1916 wrote to memory of 776 1916 kngmpwequb.pif 35 PID 1916 wrote to memory of 776 1916 kngmpwequb.pif 35 PID 1916 wrote to memory of 776 1916 kngmpwequb.pif 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\72263cf2067ce1601a07f821b1b84755.exe"C:\Users\Admin\AppData\Local\Temp\72263cf2067ce1601a07f821b1b84755.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\33725277\kngmpwequb.pif"C:\33725277\kngmpwequb.pif" xpomrfvel.rqn2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"4⤵
- Executes dropped EXE
PID:268
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\33725277\run.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:436 -
C:\33725277\kngmpwequb.pif"C:\33725277\kngmpwequb.pif" xpomrfvel.rqn4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:776
-
-
-
-