Analysis
- max time kernel
151s - max time network
144s - platform
windows10_x64 - resource
win10v20201028 - submitted
17/11/2020, 12:29
Static task
static1
Behavioral task
behavioral1
Sample
72263cf2067ce1601a07f821b1b84755.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target 72263cf2067ce1601a07f821b1b84755.exe
- Size 1.8MB
- Sample201117-bnqaevy14e
- SHA256 52d5e596c1da82e5895bcd485a98989ff1b81ab3ee5baa13a41ff1c2808493eb
- MD5 739ca775c833ba8c469ee2a53e1db2b5
- SHA1 60fcb08996081e8ea4c7fee17a2861ee56c62a5d
- SHA512 4e36ed5e3359c21648290843d4607e64b2229399c1919438d2301c17b3cac010062dee23037cc9fd8d7311764ee832659c71c6f6b2612a3922d331de22941fb2
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
vbsted
C2
-
forshared.ddns.net:6722
Mutex
-
DC_MUTEX-6UPV0L8
Attributes
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
kWdnrSvNCdV5
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe" RegSvcs.exe - Executes dropped EXE 5 IoCs
pid Process 2700 kngmpwequb.pif 2864 RegSvcs.exe 1240 msdcsc.exe 1912 kngmpwequb.pif 2480 RegSvcs.exe - Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run kngmpwequb.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vbsted = "c:\\33725277\\KNGMPW~1.PIF c:\\33725277\\XPOMRF~1.RQN" kngmpwequb.pif Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe" RegSvcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run kngmpwequb.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vbsted = "c:\\33725277\\KNGMPW~1.PIF c:\\33725277\\XPOMRF~1.RQN" kngmpwequb.pif -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA kngmpwequb.pif Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA kngmpwequb.pif - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2700 set thread context of 2864 2700 kngmpwequb.pif 77 PID 1912 set thread context of 2480 1912 kngmpwequb.pif 85 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings kngmpwequb.pif - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 2700 kngmpwequb.pif 1912 kngmpwequb.pif 1912 kngmpwequb.pif 1912 kngmpwequb.pif 1912 kngmpwequb.pif 1912 kngmpwequb.pif 1912 kngmpwequb.pif 1912 kngmpwequb.pif 1912 kngmpwequb.pif 1912 kngmpwequb.pif 1912 kngmpwequb.pif 1912 kngmpwequb.pif 1912 kngmpwequb.pif 1912 kngmpwequb.pif 1912 kngmpwequb.pif 1912 kngmpwequb.pif 1912 kngmpwequb.pif 1912 kngmpwequb.pif 1912 kngmpwequb.pif 1912 kngmpwequb.pif 1912 kngmpwequb.pif 1912 kngmpwequb.pif 1912 kngmpwequb.pif 1912 kngmpwequb.pif 1912 kngmpwequb.pif 1912 kngmpwequb.pif 1912 kngmpwequb.pif 1912 kngmpwequb.pif 1912 kngmpwequb.pif 1912 kngmpwequb.pif 1912 kngmpwequb.pif - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2864 RegSvcs.exe Token: SeSecurityPrivilege 2864 RegSvcs.exe Token: SeTakeOwnershipPrivilege 2864 RegSvcs.exe Token: SeLoadDriverPrivilege 2864 RegSvcs.exe Token: SeSystemProfilePrivilege 2864 RegSvcs.exe Token: SeSystemtimePrivilege 2864 RegSvcs.exe Token: SeProfSingleProcessPrivilege 2864 RegSvcs.exe Token: SeIncBasePriorityPrivilege 2864 RegSvcs.exe Token: SeCreatePagefilePrivilege 2864 RegSvcs.exe Token: SeBackupPrivilege 2864 RegSvcs.exe Token: SeRestorePrivilege 2864 RegSvcs.exe Token: SeShutdownPrivilege 2864 RegSvcs.exe Token: SeDebugPrivilege 2864 RegSvcs.exe Token: SeSystemEnvironmentPrivilege 2864 RegSvcs.exe Token: SeChangeNotifyPrivilege 2864 RegSvcs.exe Token: SeRemoteShutdownPrivilege 2864 RegSvcs.exe Token: SeUndockPrivilege 2864 RegSvcs.exe Token: SeManageVolumePrivilege 2864 RegSvcs.exe Token: SeImpersonatePrivilege 2864 RegSvcs.exe Token: SeCreateGlobalPrivilege 2864 RegSvcs.exe Token: 33 2864 RegSvcs.exe Token: 34 2864 RegSvcs.exe Token: 35 2864 RegSvcs.exe Token: 36 2864 RegSvcs.exe Token: SeIncreaseQuotaPrivilege 2480 RegSvcs.exe Token: SeSecurityPrivilege 2480 RegSvcs.exe Token: SeTakeOwnershipPrivilege 2480 RegSvcs.exe Token: SeLoadDriverPrivilege 2480 RegSvcs.exe Token: SeSystemProfilePrivilege 2480 RegSvcs.exe Token: SeSystemtimePrivilege 2480 RegSvcs.exe Token: SeProfSingleProcessPrivilege 2480 RegSvcs.exe Token: SeIncBasePriorityPrivilege 2480 RegSvcs.exe Token: SeCreatePagefilePrivilege 2480 RegSvcs.exe Token: SeBackupPrivilege 2480 RegSvcs.exe Token: SeRestorePrivilege 2480 RegSvcs.exe Token: SeShutdownPrivilege 2480 RegSvcs.exe Token: SeDebugPrivilege 2480 RegSvcs.exe Token: SeSystemEnvironmentPrivilege 2480 RegSvcs.exe Token: SeChangeNotifyPrivilege 2480 RegSvcs.exe Token: SeRemoteShutdownPrivilege 2480 RegSvcs.exe Token: SeUndockPrivilege 2480 RegSvcs.exe Token: SeManageVolumePrivilege 2480 RegSvcs.exe Token: SeImpersonatePrivilege 2480 RegSvcs.exe Token: SeCreateGlobalPrivilege 2480 RegSvcs.exe Token: 33 2480 RegSvcs.exe Token: 34 2480 RegSvcs.exe Token: 35 2480 RegSvcs.exe Token: 36 2480 RegSvcs.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2480 RegSvcs.exe - Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 540 wrote to memory of 2700 540 72263cf2067ce1601a07f821b1b84755.exe 75 PID 540 wrote to memory of 2700 540 72263cf2067ce1601a07f821b1b84755.exe 75 PID 540 wrote to memory of 2700 540 72263cf2067ce1601a07f821b1b84755.exe 75 PID 2700 wrote to memory of 2864 2700 kngmpwequb.pif 77 PID 2700 wrote to memory of 2864 2700 kngmpwequb.pif 77 PID 2700 wrote to memory of 2864 2700 kngmpwequb.pif 77 PID 2700 wrote to memory of 2864 2700 kngmpwequb.pif 77 PID 2700 wrote to memory of 2864 2700 kngmpwequb.pif 77 PID 2864 wrote to memory of 1240 2864 RegSvcs.exe 80 PID 2864 wrote to memory of 1240 2864 RegSvcs.exe 80 PID 2864 wrote to memory of 1240 2864 RegSvcs.exe 80 PID 2700 wrote to memory of 2156 2700 kngmpwequb.pif 82 PID 2700 wrote to memory of 2156 2700 kngmpwequb.pif 82 PID 2700 wrote to memory of 2156 2700 kngmpwequb.pif 82 PID 2156 wrote to memory of 1912 2156 WScript.exe 84 PID 2156 wrote to memory of 1912 2156 WScript.exe 84 PID 2156 wrote to memory of 1912 2156 WScript.exe 84 PID 1912 wrote to memory of 2480 1912 kngmpwequb.pif 85 PID 1912 wrote to memory of 2480 1912 kngmpwequb.pif 85 PID 1912 wrote to memory of 2480 1912 kngmpwequb.pif 85 PID 1912 wrote to memory of 2480 1912 kngmpwequb.pif 85 PID 1912 wrote to memory of 2480 1912 kngmpwequb.pif 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\72263cf2067ce1601a07f821b1b84755.exe"C:\Users\Admin\AppData\Local\Temp\72263cf2067ce1601a07f821b1b84755.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:540 -
C:\33725277\kngmpwequb.pif"C:\33725277\kngmpwequb.pif" xpomrfvel.rqn2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"4⤵
- Executes dropped EXE
PID:1240
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\33725277\run.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\33725277\kngmpwequb.pif"C:\33725277\kngmpwequb.pif" xpomrfvel.rqn4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2480
-
-
-
-