Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-01-2021 06:41
Static task
static1
Behavioral task
behavioral1
Sample
Order Requirement 341.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Order Requirement 341.exe
Resource
win10v20201028
General
-
Target
Order Requirement 341.exe
-
Size
3.1MB
-
MD5
f0706cd83ed4da6d24a71767ccfd5741
-
SHA1
d76adb5de515fbcedb4cae93cf77951c33505a1f
-
SHA256
2d631fe6c1c02c67198648c5f7ae1891262bf277721f664bd6c8ffb0e7d6a681
-
SHA512
087dd99254f5a11c2df615c99e161f849d86eb8dcdb4bf242b756c20a369aad1355ef9a2f451f682d2a674a69d25f5c0ba1fdb3642587be2862cb284d17a2b2d
Malware Config
Extracted
darkcomet
JANuary 2021
chrisle79.ddns.net:3317
jacknop79.ddns.net:3317
smath79.ddns.net:3317
whatis79.ddns.net:3317
goodgt79.ddns.net:3317
bonding79.ddns.net:3317
DC_MUTEX-X1VW1F7
-
gencode
U35l73tWGu8y
-
install
false
-
offline_keylogger
true
-
password
Password20$
-
persistence
false
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
Order Requirement 341.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\dWZXvMes6eRk2d5b\\pACjU5g0bKQH.exe\",explorer.exe" Order Requirement 341.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Order Requirement 341.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Order Requirement 341.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Order Requirement 341.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
Order Requirement 341.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Wine Order Requirement 341.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Order Requirement 341.exedescription pid process target process PID 4768 set thread context of 836 4768 Order Requirement 341.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Order Requirement 341.exepid process 4768 Order Requirement 341.exe 4768 Order Requirement 341.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
Processes:
Order Requirement 341.exevbc.exedescription pid process Token: SeDebugPrivilege 4768 Order Requirement 341.exe Token: SeDebugPrivilege 4768 Order Requirement 341.exe Token: SeIncreaseQuotaPrivilege 836 vbc.exe Token: SeSecurityPrivilege 836 vbc.exe Token: SeTakeOwnershipPrivilege 836 vbc.exe Token: SeLoadDriverPrivilege 836 vbc.exe Token: SeSystemProfilePrivilege 836 vbc.exe Token: SeSystemtimePrivilege 836 vbc.exe Token: SeProfSingleProcessPrivilege 836 vbc.exe Token: SeIncBasePriorityPrivilege 836 vbc.exe Token: SeCreatePagefilePrivilege 836 vbc.exe Token: SeBackupPrivilege 836 vbc.exe Token: SeRestorePrivilege 836 vbc.exe Token: SeShutdownPrivilege 836 vbc.exe Token: SeDebugPrivilege 836 vbc.exe Token: SeSystemEnvironmentPrivilege 836 vbc.exe Token: SeChangeNotifyPrivilege 836 vbc.exe Token: SeRemoteShutdownPrivilege 836 vbc.exe Token: SeUndockPrivilege 836 vbc.exe Token: SeManageVolumePrivilege 836 vbc.exe Token: SeImpersonatePrivilege 836 vbc.exe Token: SeCreateGlobalPrivilege 836 vbc.exe Token: 33 836 vbc.exe Token: 34 836 vbc.exe Token: 35 836 vbc.exe Token: 36 836 vbc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vbc.exepid process 836 vbc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Order Requirement 341.exedescription pid process target process PID 4768 wrote to memory of 836 4768 Order Requirement 341.exe vbc.exe PID 4768 wrote to memory of 836 4768 Order Requirement 341.exe vbc.exe PID 4768 wrote to memory of 836 4768 Order Requirement 341.exe vbc.exe PID 4768 wrote to memory of 836 4768 Order Requirement 341.exe vbc.exe PID 4768 wrote to memory of 836 4768 Order Requirement 341.exe vbc.exe PID 4768 wrote to memory of 836 4768 Order Requirement 341.exe vbc.exe PID 4768 wrote to memory of 836 4768 Order Requirement 341.exe vbc.exe PID 4768 wrote to memory of 836 4768 Order Requirement 341.exe vbc.exe PID 4768 wrote to memory of 836 4768 Order Requirement 341.exe vbc.exe PID 4768 wrote to memory of 836 4768 Order Requirement 341.exe vbc.exe PID 4768 wrote to memory of 836 4768 Order Requirement 341.exe vbc.exe PID 4768 wrote to memory of 836 4768 Order Requirement 341.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order Requirement 341.exe"C:\Users\Admin\AppData\Local\Temp\Order Requirement 341.exe"1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/836-4-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/836-5-0x000000000048F888-mapping.dmp
-
memory/836-6-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/836-7-0x0000000000570000-0x0000000000571000-memory.dmpFilesize
4KB
-
memory/4768-3-0x0000000005110000-0x0000000005111000-memory.dmpFilesize
4KB
-
memory/4768-2-0x00000000001B2000-0x0000000000242000-memory.dmpFilesize
576KB