Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
05-05-2021 02:26
Static task
static1
Behavioral task
behavioral1
Sample
647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe
Resource
win7v20210408
General
-
Target
647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe
-
Size
974KB
-
MD5
c8cd16823264b18fa58a2eece64ca233
-
SHA1
79e17e8812c5eca9ca7d460c6c340b72175226d2
-
SHA256
647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49
-
SHA512
af2e74d4b24d0e52bdcd8e26615fb56802df28385363bca3b8eb4c3d349bd15e83b1612e5a895221c3fcfeee1c5522d441e925731673058e4fe8df6a34129cda
Malware Config
Extracted
darkcomet
Sazan
0.tcp.ngrok.io:15969
DC_MUTEX-YMVEUJL
-
gencode
RKM4mzJrG4PA
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Drops startup file 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exedescription pid process target process PID 2204 set thread context of 2472 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exepid process 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exedescription pid process Token: SeIncreaseQuotaPrivilege 2472 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeSecurityPrivilege 2472 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeTakeOwnershipPrivilege 2472 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeLoadDriverPrivilege 2472 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeSystemProfilePrivilege 2472 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeSystemtimePrivilege 2472 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeProfSingleProcessPrivilege 2472 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeIncBasePriorityPrivilege 2472 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeCreatePagefilePrivilege 2472 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeBackupPrivilege 2472 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeRestorePrivilege 2472 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeShutdownPrivilege 2472 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeDebugPrivilege 2472 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeSystemEnvironmentPrivilege 2472 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeChangeNotifyPrivilege 2472 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeRemoteShutdownPrivilege 2472 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeUndockPrivilege 2472 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeManageVolumePrivilege 2472 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeImpersonatePrivilege 2472 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: SeCreateGlobalPrivilege 2472 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: 33 2472 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: 34 2472 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: 35 2472 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe Token: 36 2472 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exepid process 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 2472 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exedescription pid process target process PID 2204 wrote to memory of 2720 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe cmd.exe PID 2204 wrote to memory of 2720 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe cmd.exe PID 2204 wrote to memory of 2720 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe cmd.exe PID 2204 wrote to memory of 2472 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 2204 wrote to memory of 2472 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 2204 wrote to memory of 2472 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 2204 wrote to memory of 2472 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 2204 wrote to memory of 2472 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 2204 wrote to memory of 2472 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 2204 wrote to memory of 2472 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 2204 wrote to memory of 2472 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 2204 wrote to memory of 2472 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 2204 wrote to memory of 2472 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 2204 wrote to memory of 2472 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 2204 wrote to memory of 2472 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 2204 wrote to memory of 2472 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 2204 wrote to memory of 2472 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 2204 wrote to memory of 2472 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 2204 wrote to memory of 2472 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 2204 wrote to memory of 2472 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 2204 wrote to memory of 2472 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 2204 wrote to memory of 2472 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 2204 wrote to memory of 2472 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 2204 wrote to memory of 2472 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 2204 wrote to memory of 2472 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 2204 wrote to memory of 2472 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 2204 wrote to memory of 2472 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe PID 2204 wrote to memory of 2472 2204 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe 647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe"C:\Users\Admin\AppData\Local\Temp\647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
-
C:\Users\Admin\AppData\Local\Temp\647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exeC:\Users\Admin\AppData\Local\Temp\647d85e63f398b6ed2cda3d3d4fbdd8d3babb248eb30f0c098e93f28f4d3cf49.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2472-116-0x000000000048F888-mapping.dmp
-
memory/2472-115-0x0000000000400000-0x0000000004988000-memory.dmpFilesize
69.5MB
-
memory/2472-117-0x0000000000400000-0x00000000011E8000-memory.dmpFilesize
13.9MB
-
memory/2472-118-0x00000000066F0000-0x00000000066F1000-memory.dmpFilesize
4KB
-
memory/2720-114-0x0000000000000000-mapping.dmp