Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
15-05-2021 05:39
Behavioral task
behavioral1
Sample
8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe
Resource
win7v20210410
General
-
Target
8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe
-
Size
658KB
-
MD5
f979bb14551c7b5166c2564f0cb81b17
-
SHA1
8ee1be6c76d7a2a1179564bd0e12bb94a603402c
-
SHA256
8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5
-
SHA512
232f74ea88561f67e5a3095b83681e4f35e49e5c877e81c23cf9b04994a299e8fd981e2efae97297e6f4226ad7d7f49bd2ee4eb4d0d9a4162f22dd2749e8af23
Malware Config
Extracted
darkcomet
All
192.168.0.102:1604
192.168.0.102:81
DC_MUTEX-GRA2N0X
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
jqHg0YaebT2u
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe -
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 1792 msdcsc.exe -
Loads dropped DLL 2 IoCs
Processes:
8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exepid process 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 1792 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe Token: SeSecurityPrivilege 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe Token: SeTakeOwnershipPrivilege 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe Token: SeLoadDriverPrivilege 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe Token: SeSystemProfilePrivilege 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe Token: SeSystemtimePrivilege 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe Token: SeProfSingleProcessPrivilege 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe Token: SeIncBasePriorityPrivilege 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe Token: SeCreatePagefilePrivilege 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe Token: SeBackupPrivilege 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe Token: SeRestorePrivilege 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe Token: SeShutdownPrivilege 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe Token: SeDebugPrivilege 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe Token: SeSystemEnvironmentPrivilege 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe Token: SeChangeNotifyPrivilege 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe Token: SeRemoteShutdownPrivilege 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe Token: SeUndockPrivilege 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe Token: SeManageVolumePrivilege 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe Token: SeImpersonatePrivilege 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe Token: SeCreateGlobalPrivilege 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe Token: 33 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe Token: 34 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe Token: 35 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe Token: SeIncreaseQuotaPrivilege 1792 msdcsc.exe Token: SeSecurityPrivilege 1792 msdcsc.exe Token: SeTakeOwnershipPrivilege 1792 msdcsc.exe Token: SeLoadDriverPrivilege 1792 msdcsc.exe Token: SeSystemProfilePrivilege 1792 msdcsc.exe Token: SeSystemtimePrivilege 1792 msdcsc.exe Token: SeProfSingleProcessPrivilege 1792 msdcsc.exe Token: SeIncBasePriorityPrivilege 1792 msdcsc.exe Token: SeCreatePagefilePrivilege 1792 msdcsc.exe Token: SeBackupPrivilege 1792 msdcsc.exe Token: SeRestorePrivilege 1792 msdcsc.exe Token: SeShutdownPrivilege 1792 msdcsc.exe Token: SeDebugPrivilege 1792 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1792 msdcsc.exe Token: SeChangeNotifyPrivilege 1792 msdcsc.exe Token: SeRemoteShutdownPrivilege 1792 msdcsc.exe Token: SeUndockPrivilege 1792 msdcsc.exe Token: SeManageVolumePrivilege 1792 msdcsc.exe Token: SeImpersonatePrivilege 1792 msdcsc.exe Token: SeCreateGlobalPrivilege 1792 msdcsc.exe Token: 33 1792 msdcsc.exe Token: 34 1792 msdcsc.exe Token: 35 1792 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 1792 msdcsc.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.execmd.execmd.exemsdcsc.exedescription pid process target process PID 2004 wrote to memory of 1168 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe cmd.exe PID 2004 wrote to memory of 1168 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe cmd.exe PID 2004 wrote to memory of 1168 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe cmd.exe PID 2004 wrote to memory of 1168 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe cmd.exe PID 2004 wrote to memory of 1636 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe cmd.exe PID 2004 wrote to memory of 1636 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe cmd.exe PID 2004 wrote to memory of 1636 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe cmd.exe PID 2004 wrote to memory of 1636 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe cmd.exe PID 1636 wrote to memory of 1596 1636 cmd.exe attrib.exe PID 1636 wrote to memory of 1596 1636 cmd.exe attrib.exe PID 1636 wrote to memory of 1596 1636 cmd.exe attrib.exe PID 1636 wrote to memory of 1596 1636 cmd.exe attrib.exe PID 1168 wrote to memory of 1740 1168 cmd.exe attrib.exe PID 1168 wrote to memory of 1740 1168 cmd.exe attrib.exe PID 1168 wrote to memory of 1740 1168 cmd.exe attrib.exe PID 1168 wrote to memory of 1740 1168 cmd.exe attrib.exe PID 2004 wrote to memory of 1792 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe msdcsc.exe PID 2004 wrote to memory of 1792 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe msdcsc.exe PID 2004 wrote to memory of 1792 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe msdcsc.exe PID 2004 wrote to memory of 1792 2004 8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe msdcsc.exe PID 1792 wrote to memory of 1692 1792 msdcsc.exe notepad.exe PID 1792 wrote to memory of 1692 1792 msdcsc.exe notepad.exe PID 1792 wrote to memory of 1692 1792 msdcsc.exe notepad.exe PID 1792 wrote to memory of 1692 1792 msdcsc.exe notepad.exe PID 1792 wrote to memory of 1692 1792 msdcsc.exe notepad.exe PID 1792 wrote to memory of 1692 1792 msdcsc.exe notepad.exe PID 1792 wrote to memory of 1692 1792 msdcsc.exe notepad.exe PID 1792 wrote to memory of 1692 1792 msdcsc.exe notepad.exe PID 1792 wrote to memory of 1692 1792 msdcsc.exe notepad.exe PID 1792 wrote to memory of 1692 1792 msdcsc.exe notepad.exe PID 1792 wrote to memory of 1692 1792 msdcsc.exe notepad.exe PID 1792 wrote to memory of 1692 1792 msdcsc.exe notepad.exe PID 1792 wrote to memory of 1692 1792 msdcsc.exe notepad.exe PID 1792 wrote to memory of 1692 1792 msdcsc.exe notepad.exe PID 1792 wrote to memory of 1692 1792 msdcsc.exe notepad.exe PID 1792 wrote to memory of 1692 1792 msdcsc.exe notepad.exe PID 1792 wrote to memory of 1692 1792 msdcsc.exe notepad.exe PID 1792 wrote to memory of 1692 1792 msdcsc.exe notepad.exe PID 1792 wrote to memory of 1692 1792 msdcsc.exe notepad.exe PID 1792 wrote to memory of 1692 1792 msdcsc.exe notepad.exe PID 1792 wrote to memory of 1692 1792 msdcsc.exe notepad.exe PID 1792 wrote to memory of 1692 1792 msdcsc.exe notepad.exe PID 1792 wrote to memory of 1692 1792 msdcsc.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1596 attrib.exe 1740 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe"C:\Users\Admin\AppData\Local\Temp\8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\8644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5.exe" +s +h3⤵
- Views/modifies file attributes
PID:1740 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Views/modifies file attributes
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:1692
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exeMD5
f979bb14551c7b5166c2564f0cb81b17
SHA18ee1be6c76d7a2a1179564bd0e12bb94a603402c
SHA2568644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5
SHA512232f74ea88561f67e5a3095b83681e4f35e49e5c877e81c23cf9b04994a299e8fd981e2efae97297e6f4226ad7d7f49bd2ee4eb4d0d9a4162f22dd2749e8af23
-
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exeMD5
f979bb14551c7b5166c2564f0cb81b17
SHA18ee1be6c76d7a2a1179564bd0e12bb94a603402c
SHA2568644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5
SHA512232f74ea88561f67e5a3095b83681e4f35e49e5c877e81c23cf9b04994a299e8fd981e2efae97297e6f4226ad7d7f49bd2ee4eb4d0d9a4162f22dd2749e8af23
-
\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exeMD5
f979bb14551c7b5166c2564f0cb81b17
SHA18ee1be6c76d7a2a1179564bd0e12bb94a603402c
SHA2568644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5
SHA512232f74ea88561f67e5a3095b83681e4f35e49e5c877e81c23cf9b04994a299e8fd981e2efae97297e6f4226ad7d7f49bd2ee4eb4d0d9a4162f22dd2749e8af23
-
\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exeMD5
f979bb14551c7b5166c2564f0cb81b17
SHA18ee1be6c76d7a2a1179564bd0e12bb94a603402c
SHA2568644f9c0bdda59237eddd3272a41a41633abaeff3668ddcd71a54610456288b5
SHA512232f74ea88561f67e5a3095b83681e4f35e49e5c877e81c23cf9b04994a299e8fd981e2efae97297e6f4226ad7d7f49bd2ee4eb4d0d9a4162f22dd2749e8af23
-
memory/1168-60-0x0000000000000000-mapping.dmp
-
memory/1596-62-0x0000000000000000-mapping.dmp
-
memory/1636-61-0x0000000000000000-mapping.dmp
-
memory/1692-71-0x0000000000000000-mapping.dmp
-
memory/1692-74-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1740-63-0x0000000000000000-mapping.dmp
-
memory/1792-67-0x0000000000000000-mapping.dmp
-
memory/1792-73-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB
-
memory/2004-64-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2004-59-0x00000000765F1000-0x00000000765F3000-memory.dmpFilesize
8KB