Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
04-05-2021 21:03
Static task
static1
Behavioral task
behavioral1
Sample
f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe
Resource
win7v20210410
General
-
Target
f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe
-
Size
820KB
-
MD5
80e22d59d2388f5b9d6b9560187b281e
-
SHA1
adbf2306ede7736435cdf204a64ae4748c409ba7
-
SHA256
f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888
-
SHA512
0f8485d87a8ae8685fa0393e1bd3d3e6b7bec98a9349c5e0a651deaeda5908b29865b162d0683a74d0688722f555812e9fa1f813819dc1958a709585107172e1
Malware Config
Extracted
darkcomet
Guest16
127.0.0.1:1604
DC_MUTEX-LRSU5E5
-
gencode
z1XtPDQ8LUgm
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exedescription pid process target process PID 784 set thread context of 188 784 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exedescription pid process Token: SeIncreaseQuotaPrivilege 188 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe Token: SeSecurityPrivilege 188 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe Token: SeTakeOwnershipPrivilege 188 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe Token: SeLoadDriverPrivilege 188 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe Token: SeSystemProfilePrivilege 188 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe Token: SeSystemtimePrivilege 188 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe Token: SeProfSingleProcessPrivilege 188 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe Token: SeIncBasePriorityPrivilege 188 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe Token: SeCreatePagefilePrivilege 188 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe Token: SeBackupPrivilege 188 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe Token: SeRestorePrivilege 188 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe Token: SeShutdownPrivilege 188 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe Token: SeDebugPrivilege 188 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe Token: SeSystemEnvironmentPrivilege 188 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe Token: SeChangeNotifyPrivilege 188 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe Token: SeRemoteShutdownPrivilege 188 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe Token: SeUndockPrivilege 188 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe Token: SeManageVolumePrivilege 188 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe Token: SeImpersonatePrivilege 188 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe Token: SeCreateGlobalPrivilege 188 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe Token: 33 188 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe Token: 34 188 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe Token: 35 188 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe Token: 36 188 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exepid process 188 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exedescription pid process target process PID 784 wrote to memory of 188 784 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe PID 784 wrote to memory of 188 784 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe PID 784 wrote to memory of 188 784 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe PID 784 wrote to memory of 188 784 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe PID 784 wrote to memory of 188 784 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe PID 784 wrote to memory of 188 784 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe PID 784 wrote to memory of 188 784 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe PID 784 wrote to memory of 188 784 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe PID 784 wrote to memory of 188 784 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe PID 784 wrote to memory of 188 784 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe PID 784 wrote to memory of 188 784 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe PID 784 wrote to memory of 188 784 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe PID 784 wrote to memory of 188 784 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe PID 784 wrote to memory of 188 784 f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe"C:\Users\Admin\AppData\Local\Temp\f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Users\Admin\AppData\Local\Temp\f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe"C:\Users\Admin\AppData\Local\Temp\f38e9a0aebecc8e87b93f2f8729f2bdae2594f39ce2c9dd2002168fc3b5a6888.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:188
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/188-114-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/188-115-0x000000000048F888-mapping.dmp
-
memory/188-117-0x0000000002F90000-0x0000000002F91000-memory.dmpFilesize
4KB
-
memory/188-116-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB