Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
25-02-2021 12:17
Static task
static1
Behavioral task
behavioral1
Sample
Payment 381.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Payment 381.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
Payment 381.exe
Malware Config
Extracted
Family
darkcomet
Botnet
FEBruary 2021
C2
bonding79.ddns.net:3316
goodgt79.ddns.net:3316
whatis79.ddns.net:3316
smath79.ddns.net:3316
jacknop79.ddns.net:3316
chrisle79.ddns.net:3316
Mutex
DC_MUTEX-ZKP4D0B
Attributes
-
gencode
wb6TW2qCEdyf
-
install
false
-
offline_keylogger
true
-
password
Password20$
-
persistence
false
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
Payment 381.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\BlVOMYes18rDEfDp\\pU8VXYcU6EqE.exe\",explorer.exe" Payment 381.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Payment 381.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Payment 381.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Payment 381.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
Payment 381.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Wine Payment 381.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Payment 381.exedescription pid process target process PID 1924 set thread context of 544 1924 Payment 381.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Payment 381.exepid process 1924 Payment 381.exe 1924 Payment 381.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
Payment 381.exevbc.exedescription pid process Token: SeDebugPrivilege 1924 Payment 381.exe Token: SeDebugPrivilege 1924 Payment 381.exe Token: SeIncreaseQuotaPrivilege 544 vbc.exe Token: SeSecurityPrivilege 544 vbc.exe Token: SeTakeOwnershipPrivilege 544 vbc.exe Token: SeLoadDriverPrivilege 544 vbc.exe Token: SeSystemProfilePrivilege 544 vbc.exe Token: SeSystemtimePrivilege 544 vbc.exe Token: SeProfSingleProcessPrivilege 544 vbc.exe Token: SeIncBasePriorityPrivilege 544 vbc.exe Token: SeCreatePagefilePrivilege 544 vbc.exe Token: SeBackupPrivilege 544 vbc.exe Token: SeRestorePrivilege 544 vbc.exe Token: SeShutdownPrivilege 544 vbc.exe Token: SeDebugPrivilege 544 vbc.exe Token: SeSystemEnvironmentPrivilege 544 vbc.exe Token: SeChangeNotifyPrivilege 544 vbc.exe Token: SeRemoteShutdownPrivilege 544 vbc.exe Token: SeUndockPrivilege 544 vbc.exe Token: SeManageVolumePrivilege 544 vbc.exe Token: SeImpersonatePrivilege 544 vbc.exe Token: SeCreateGlobalPrivilege 544 vbc.exe Token: 33 544 vbc.exe Token: 34 544 vbc.exe Token: 35 544 vbc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vbc.exepid process 544 vbc.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Payment 381.exedescription pid process target process PID 1924 wrote to memory of 544 1924 Payment 381.exe vbc.exe PID 1924 wrote to memory of 544 1924 Payment 381.exe vbc.exe PID 1924 wrote to memory of 544 1924 Payment 381.exe vbc.exe PID 1924 wrote to memory of 544 1924 Payment 381.exe vbc.exe PID 1924 wrote to memory of 544 1924 Payment 381.exe vbc.exe PID 1924 wrote to memory of 544 1924 Payment 381.exe vbc.exe PID 1924 wrote to memory of 544 1924 Payment 381.exe vbc.exe PID 1924 wrote to memory of 544 1924 Payment 381.exe vbc.exe PID 1924 wrote to memory of 544 1924 Payment 381.exe vbc.exe PID 1924 wrote to memory of 544 1924 Payment 381.exe vbc.exe PID 1924 wrote to memory of 544 1924 Payment 381.exe vbc.exe PID 1924 wrote to memory of 544 1924 Payment 381.exe vbc.exe PID 1924 wrote to memory of 544 1924 Payment 381.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment 381.exe"C:\Users\Admin\AppData\Local\Temp\Payment 381.exe"1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:544
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/544-5-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/544-6-0x000000000048F888-mapping.dmp
-
memory/544-9-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/544-8-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1924-2-0x0000000075AE1000-0x0000000075AE3000-memory.dmpFilesize
8KB
-
memory/1924-3-0x0000000001082000-0x0000000001118000-memory.dmpFilesize
600KB
-
memory/1924-4-0x0000000004170000-0x0000000004171000-memory.dmpFilesize
4KB