Analysis
-
max time kernel
151s -
max time network
159s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
05-05-2021 02:26
Static task
static1
Behavioral task
behavioral1
Sample
647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe
Resource
win7v20210408
General
-
Target
647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe
-
Size
974KB
-
MD5
c8cd16823264b18fa58a2eece64ca233
-
SHA1
79e17e8812c5eca9ca7d460c6c340b72175226d2
-
SHA256
647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49
-
SHA512
af2e74d4b24d0e52bdcd8e26615fb56802df28385363bca3b8eb4c3d349bd15e83b1612e5a895221c3fcfeee1c5522d441e925731673058e4fe8df6a34129cda
Malware Config
Extracted
darkcomet
Sazan
0.tcp.ngrok.io:15969
DC_MUTEX-YMVEUJL
-
gencode
RKM4mzJrG4PA
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Drops startup file 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exedescription pid process target process PID 1820 set thread context of 1168 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exepid process 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exedescription pid process Token: SeIncreaseQuotaPrivilege 1168 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeSecurityPrivilege 1168 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeTakeOwnershipPrivilege 1168 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeLoadDriverPrivilege 1168 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeSystemProfilePrivilege 1168 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeSystemtimePrivilege 1168 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeProfSingleProcessPrivilege 1168 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeIncBasePriorityPrivilege 1168 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeCreatePagefilePrivilege 1168 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeBackupPrivilege 1168 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeRestorePrivilege 1168 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeShutdownPrivilege 1168 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeDebugPrivilege 1168 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeSystemEnvironmentPrivilege 1168 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeChangeNotifyPrivilege 1168 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeRemoteShutdownPrivilege 1168 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeUndockPrivilege 1168 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeManageVolumePrivilege 1168 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeImpersonatePrivilege 1168 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeCreateGlobalPrivilege 1168 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: 33 1168 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: 34 1168 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: 35 1168 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exepid process 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 1168 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exedescription pid process target process PID 1820 wrote to memory of 2020 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe cmd.exe PID 1820 wrote to memory of 2020 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe cmd.exe PID 1820 wrote to memory of 2020 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe cmd.exe PID 1820 wrote to memory of 2020 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe cmd.exe PID 1820 wrote to memory of 1168 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 1820 wrote to memory of 1168 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 1820 wrote to memory of 1168 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 1820 wrote to memory of 1168 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 1820 wrote to memory of 1168 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 1820 wrote to memory of 1168 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 1820 wrote to memory of 1168 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 1820 wrote to memory of 1168 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 1820 wrote to memory of 1168 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 1820 wrote to memory of 1168 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 1820 wrote to memory of 1168 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 1820 wrote to memory of 1168 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 1820 wrote to memory of 1168 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 1820 wrote to memory of 1168 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 1820 wrote to memory of 1168 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 1820 wrote to memory of 1168 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 1820 wrote to memory of 1168 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 1820 wrote to memory of 1168 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 1820 wrote to memory of 1168 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 1820 wrote to memory of 1168 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 1820 wrote to memory of 1168 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 1820 wrote to memory of 1168 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 1820 wrote to memory of 1168 1820 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe"C:\Users\Admin\AppData\Local\Temp\647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
-
C:\Users\Admin\AppData\Local\Temp\647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exeC:\Users\Admin\AppData\Local\Temp\647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1168-62-0x0000000000400000-0x0000000004988000-memory.dmpFilesize
69.5MB
-
memory/1168-63-0x000000000048F888-mapping.dmp
-
memory/1168-65-0x0000000000400000-0x0000000000564000-memory.dmpFilesize
1.4MB
-
memory/1168-66-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1820-60-0x0000000076641000-0x0000000076643000-memory.dmpFilesize
8KB
-
memory/2020-61-0x0000000000000000-mapping.dmp