Analysis
-
max time kernel
154s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
05-05-2021 11:28
Behavioral task
behavioral1
Sample
1yyoRs4y38XZvNF9YQAk.exe
Resource
win7v20210410
General
-
Target
1yyoRs4y38XZvNF9YQAk.exe
-
Size
658KB
-
MD5
db08908582b5fadec29d5ea3c91b954a
-
SHA1
fedaf416dd8019a55657d8321d70e2d09c98c595
-
SHA256
6f08293219654fea6c04ef20b911c4b3d28029ae32b9bcfaa7278df56a059ede
-
SHA512
05e99bb91df650d18da64d2133c7e289c0485d28e289aa77d1c0e0366473e33da3f0d955a29c93d88f4a47b40f766611cf3c3d07174c602cbb2bf6a76641e916
Malware Config
Extracted
darkcomet
Guest16
nanocore4459.ddns.net:5552
DC_MUTEX-WPZT55M
-
InstallPath
C:\Windows\System32\drivers\networkdrv.exe
-
gencode
CtFSuaWNSfPv
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
Network Driver
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
1yyoRs4y38XZvNF9YQAk.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\System32\\drivers\\networkdrv.exe" 1yyoRs4y38XZvNF9YQAk.exe -
Drops file in Drivers directory 3 IoCs
Processes:
1yyoRs4y38XZvNF9YQAk.exedescription ioc process File opened for modification C:\Windows\SysWOW64\drivers\ 1yyoRs4y38XZvNF9YQAk.exe File created C:\Windows\SysWOW64\drivers\networkdrv.exe 1yyoRs4y38XZvNF9YQAk.exe File opened for modification C:\Windows\SysWOW64\drivers\networkdrv.exe 1yyoRs4y38XZvNF9YQAk.exe -
Executes dropped EXE 1 IoCs
Processes:
networkdrv.exepid process 1912 networkdrv.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 1180 notepad.exe -
Loads dropped DLL 2 IoCs
Processes:
1yyoRs4y38XZvNF9YQAk.exepid process 1116 1yyoRs4y38XZvNF9YQAk.exe 1116 1yyoRs4y38XZvNF9YQAk.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
1yyoRs4y38XZvNF9YQAk.exenetworkdrv.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Network Driver = "C:\\Windows\\System32\\drivers\\networkdrv.exe" 1yyoRs4y38XZvNF9YQAk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Network Driver = "C:\\Windows\\System32\\drivers\\networkdrv.exe" networkdrv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
1yyoRs4y38XZvNF9YQAk.exenetworkdrv.exedescription pid process Token: SeIncreaseQuotaPrivilege 1116 1yyoRs4y38XZvNF9YQAk.exe Token: SeSecurityPrivilege 1116 1yyoRs4y38XZvNF9YQAk.exe Token: SeTakeOwnershipPrivilege 1116 1yyoRs4y38XZvNF9YQAk.exe Token: SeLoadDriverPrivilege 1116 1yyoRs4y38XZvNF9YQAk.exe Token: SeSystemProfilePrivilege 1116 1yyoRs4y38XZvNF9YQAk.exe Token: SeSystemtimePrivilege 1116 1yyoRs4y38XZvNF9YQAk.exe Token: SeProfSingleProcessPrivilege 1116 1yyoRs4y38XZvNF9YQAk.exe Token: SeIncBasePriorityPrivilege 1116 1yyoRs4y38XZvNF9YQAk.exe Token: SeCreatePagefilePrivilege 1116 1yyoRs4y38XZvNF9YQAk.exe Token: SeBackupPrivilege 1116 1yyoRs4y38XZvNF9YQAk.exe Token: SeRestorePrivilege 1116 1yyoRs4y38XZvNF9YQAk.exe Token: SeShutdownPrivilege 1116 1yyoRs4y38XZvNF9YQAk.exe Token: SeDebugPrivilege 1116 1yyoRs4y38XZvNF9YQAk.exe Token: SeSystemEnvironmentPrivilege 1116 1yyoRs4y38XZvNF9YQAk.exe Token: SeChangeNotifyPrivilege 1116 1yyoRs4y38XZvNF9YQAk.exe Token: SeRemoteShutdownPrivilege 1116 1yyoRs4y38XZvNF9YQAk.exe Token: SeUndockPrivilege 1116 1yyoRs4y38XZvNF9YQAk.exe Token: SeManageVolumePrivilege 1116 1yyoRs4y38XZvNF9YQAk.exe Token: SeImpersonatePrivilege 1116 1yyoRs4y38XZvNF9YQAk.exe Token: SeCreateGlobalPrivilege 1116 1yyoRs4y38XZvNF9YQAk.exe Token: 33 1116 1yyoRs4y38XZvNF9YQAk.exe Token: 34 1116 1yyoRs4y38XZvNF9YQAk.exe Token: 35 1116 1yyoRs4y38XZvNF9YQAk.exe Token: SeIncreaseQuotaPrivilege 1912 networkdrv.exe Token: SeSecurityPrivilege 1912 networkdrv.exe Token: SeTakeOwnershipPrivilege 1912 networkdrv.exe Token: SeLoadDriverPrivilege 1912 networkdrv.exe Token: SeSystemProfilePrivilege 1912 networkdrv.exe Token: SeSystemtimePrivilege 1912 networkdrv.exe Token: SeProfSingleProcessPrivilege 1912 networkdrv.exe Token: SeIncBasePriorityPrivilege 1912 networkdrv.exe Token: SeCreatePagefilePrivilege 1912 networkdrv.exe Token: SeBackupPrivilege 1912 networkdrv.exe Token: SeRestorePrivilege 1912 networkdrv.exe Token: SeShutdownPrivilege 1912 networkdrv.exe Token: SeDebugPrivilege 1912 networkdrv.exe Token: SeSystemEnvironmentPrivilege 1912 networkdrv.exe Token: SeChangeNotifyPrivilege 1912 networkdrv.exe Token: SeRemoteShutdownPrivilege 1912 networkdrv.exe Token: SeUndockPrivilege 1912 networkdrv.exe Token: SeManageVolumePrivilege 1912 networkdrv.exe Token: SeImpersonatePrivilege 1912 networkdrv.exe Token: SeCreateGlobalPrivilege 1912 networkdrv.exe Token: 33 1912 networkdrv.exe Token: 34 1912 networkdrv.exe Token: 35 1912 networkdrv.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
networkdrv.exepid process 1912 networkdrv.exe -
Suspicious use of WriteProcessMemory 61 IoCs
Processes:
1yyoRs4y38XZvNF9YQAk.execmd.exenetworkdrv.exedescription pid process target process PID 1116 wrote to memory of 2032 1116 1yyoRs4y38XZvNF9YQAk.exe cmd.exe PID 1116 wrote to memory of 2032 1116 1yyoRs4y38XZvNF9YQAk.exe cmd.exe PID 1116 wrote to memory of 2032 1116 1yyoRs4y38XZvNF9YQAk.exe cmd.exe PID 1116 wrote to memory of 2032 1116 1yyoRs4y38XZvNF9YQAk.exe cmd.exe PID 1116 wrote to memory of 1180 1116 1yyoRs4y38XZvNF9YQAk.exe notepad.exe PID 1116 wrote to memory of 1180 1116 1yyoRs4y38XZvNF9YQAk.exe notepad.exe PID 1116 wrote to memory of 1180 1116 1yyoRs4y38XZvNF9YQAk.exe notepad.exe PID 1116 wrote to memory of 1180 1116 1yyoRs4y38XZvNF9YQAk.exe notepad.exe PID 1116 wrote to memory of 1180 1116 1yyoRs4y38XZvNF9YQAk.exe notepad.exe PID 1116 wrote to memory of 1180 1116 1yyoRs4y38XZvNF9YQAk.exe notepad.exe PID 1116 wrote to memory of 1180 1116 1yyoRs4y38XZvNF9YQAk.exe notepad.exe PID 1116 wrote to memory of 1180 1116 1yyoRs4y38XZvNF9YQAk.exe notepad.exe PID 1116 wrote to memory of 1180 1116 1yyoRs4y38XZvNF9YQAk.exe notepad.exe PID 1116 wrote to memory of 1180 1116 1yyoRs4y38XZvNF9YQAk.exe notepad.exe PID 1116 wrote to memory of 1180 1116 1yyoRs4y38XZvNF9YQAk.exe notepad.exe PID 1116 wrote to memory of 1180 1116 1yyoRs4y38XZvNF9YQAk.exe notepad.exe PID 1116 wrote to memory of 1180 1116 1yyoRs4y38XZvNF9YQAk.exe notepad.exe PID 1116 wrote to memory of 1180 1116 1yyoRs4y38XZvNF9YQAk.exe notepad.exe PID 1116 wrote to memory of 1180 1116 1yyoRs4y38XZvNF9YQAk.exe notepad.exe PID 1116 wrote to memory of 1180 1116 1yyoRs4y38XZvNF9YQAk.exe notepad.exe PID 1116 wrote to memory of 1180 1116 1yyoRs4y38XZvNF9YQAk.exe notepad.exe PID 1116 wrote to memory of 1180 1116 1yyoRs4y38XZvNF9YQAk.exe notepad.exe PID 2032 wrote to memory of 1932 2032 cmd.exe attrib.exe PID 2032 wrote to memory of 1932 2032 cmd.exe attrib.exe PID 2032 wrote to memory of 1932 2032 cmd.exe attrib.exe PID 2032 wrote to memory of 1932 2032 cmd.exe attrib.exe PID 1116 wrote to memory of 1912 1116 1yyoRs4y38XZvNF9YQAk.exe networkdrv.exe PID 1116 wrote to memory of 1912 1116 1yyoRs4y38XZvNF9YQAk.exe networkdrv.exe PID 1116 wrote to memory of 1912 1116 1yyoRs4y38XZvNF9YQAk.exe networkdrv.exe PID 1116 wrote to memory of 1912 1116 1yyoRs4y38XZvNF9YQAk.exe networkdrv.exe PID 1912 wrote to memory of 1796 1912 networkdrv.exe iexplore.exe PID 1912 wrote to memory of 1796 1912 networkdrv.exe iexplore.exe PID 1912 wrote to memory of 1796 1912 networkdrv.exe iexplore.exe PID 1912 wrote to memory of 1796 1912 networkdrv.exe iexplore.exe PID 1912 wrote to memory of 1820 1912 networkdrv.exe explorer.exe PID 1912 wrote to memory of 1820 1912 networkdrv.exe explorer.exe PID 1912 wrote to memory of 1820 1912 networkdrv.exe explorer.exe PID 1912 wrote to memory of 1820 1912 networkdrv.exe explorer.exe PID 1912 wrote to memory of 1732 1912 networkdrv.exe notepad.exe PID 1912 wrote to memory of 1732 1912 networkdrv.exe notepad.exe PID 1912 wrote to memory of 1732 1912 networkdrv.exe notepad.exe PID 1912 wrote to memory of 1732 1912 networkdrv.exe notepad.exe PID 1912 wrote to memory of 1732 1912 networkdrv.exe notepad.exe PID 1912 wrote to memory of 1732 1912 networkdrv.exe notepad.exe PID 1912 wrote to memory of 1732 1912 networkdrv.exe notepad.exe PID 1912 wrote to memory of 1732 1912 networkdrv.exe notepad.exe PID 1912 wrote to memory of 1732 1912 networkdrv.exe notepad.exe PID 1912 wrote to memory of 1732 1912 networkdrv.exe notepad.exe PID 1912 wrote to memory of 1732 1912 networkdrv.exe notepad.exe PID 1912 wrote to memory of 1732 1912 networkdrv.exe notepad.exe PID 1912 wrote to memory of 1732 1912 networkdrv.exe notepad.exe PID 1912 wrote to memory of 1732 1912 networkdrv.exe notepad.exe PID 1912 wrote to memory of 1732 1912 networkdrv.exe notepad.exe PID 1912 wrote to memory of 1732 1912 networkdrv.exe notepad.exe PID 1912 wrote to memory of 1732 1912 networkdrv.exe notepad.exe PID 1912 wrote to memory of 1732 1912 networkdrv.exe notepad.exe PID 1912 wrote to memory of 1732 1912 networkdrv.exe notepad.exe PID 1912 wrote to memory of 1732 1912 networkdrv.exe notepad.exe PID 1912 wrote to memory of 1732 1912 networkdrv.exe notepad.exe PID 1912 wrote to memory of 1732 1912 networkdrv.exe notepad.exe PID 1912 wrote to memory of 1732 1912 networkdrv.exe notepad.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1yyoRs4y38XZvNF9YQAk.exe"C:\Users\Admin\AppData\Local\Temp\1yyoRs4y38XZvNF9YQAk.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\1yyoRs4y38XZvNF9YQAk.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\1yyoRs4y38XZvNF9YQAk.exe" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\Windows\SysWOW64\drivers\networkdrv.exe"C:\Windows\System32\drivers\networkdrv.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\drivers\networkdrv.exeMD5
db08908582b5fadec29d5ea3c91b954a
SHA1fedaf416dd8019a55657d8321d70e2d09c98c595
SHA2566f08293219654fea6c04ef20b911c4b3d28029ae32b9bcfaa7278df56a059ede
SHA51205e99bb91df650d18da64d2133c7e289c0485d28e289aa77d1c0e0366473e33da3f0d955a29c93d88f4a47b40f766611cf3c3d07174c602cbb2bf6a76641e916
-
C:\Windows\SysWOW64\drivers\networkdrv.exeMD5
db08908582b5fadec29d5ea3c91b954a
SHA1fedaf416dd8019a55657d8321d70e2d09c98c595
SHA2566f08293219654fea6c04ef20b911c4b3d28029ae32b9bcfaa7278df56a059ede
SHA51205e99bb91df650d18da64d2133c7e289c0485d28e289aa77d1c0e0366473e33da3f0d955a29c93d88f4a47b40f766611cf3c3d07174c602cbb2bf6a76641e916
-
\Windows\SysWOW64\drivers\networkdrv.exeMD5
db08908582b5fadec29d5ea3c91b954a
SHA1fedaf416dd8019a55657d8321d70e2d09c98c595
SHA2566f08293219654fea6c04ef20b911c4b3d28029ae32b9bcfaa7278df56a059ede
SHA51205e99bb91df650d18da64d2133c7e289c0485d28e289aa77d1c0e0366473e33da3f0d955a29c93d88f4a47b40f766611cf3c3d07174c602cbb2bf6a76641e916
-
\Windows\SysWOW64\drivers\networkdrv.exeMD5
db08908582b5fadec29d5ea3c91b954a
SHA1fedaf416dd8019a55657d8321d70e2d09c98c595
SHA2566f08293219654fea6c04ef20b911c4b3d28029ae32b9bcfaa7278df56a059ede
SHA51205e99bb91df650d18da64d2133c7e289c0485d28e289aa77d1c0e0366473e33da3f0d955a29c93d88f4a47b40f766611cf3c3d07174c602cbb2bf6a76641e916
-
memory/1116-60-0x00000000767B1000-0x00000000767B3000-memory.dmpFilesize
8KB
-
memory/1116-61-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/1180-63-0x0000000000000000-mapping.dmp
-
memory/1180-74-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/1732-72-0x0000000000000000-mapping.dmp
-
memory/1732-76-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1912-68-0x0000000000000000-mapping.dmp
-
memory/1912-75-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/1932-65-0x0000000000000000-mapping.dmp
-
memory/2032-62-0x0000000000000000-mapping.dmp