Analysis
-
max time kernel
131s -
max time network
192s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
17-05-2021 05:12
Behavioral task
behavioral1
Sample
e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe
Resource
win7v20210408
General
-
Target
e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe
-
Size
744KB
-
MD5
59dbe0b0647411f9eaedf5575271faef
-
SHA1
4c9f74505f9560b36fc05a65922e67657554be48
-
SHA256
e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f
-
SHA512
eaf02e903f86c71bf3fcc3061506faa1b0157c8f7b2dd95348eb919842532e97bf94ea46ae0596ec9774e0f67247df98e0607619b6932f096d95a3ba303bd3b0
Malware Config
Extracted
darkcomet
XMRIG
182.254.195.236:10101
DCMIN_MUTEX-CD6C7CH
-
InstallPath
DCSCMIN\IMDCSC.exe
-
gencode
ReJpgGYt7ySF
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
NicoSoft
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe" e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe -
Executes dropped EXE 1 IoCs
Processes:
IMDCSC.exepid process 1304 IMDCSC.exe -
Processes:
resource yara_rule \Users\Admin\Documents\DCSCMIN\IMDCSC.exe upx \Users\Admin\Documents\DCSCMIN\IMDCSC.exe upx C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe upx C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe upx -
Loads dropped DLL 2 IoCs
Processes:
e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exepid process 2016 e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe 2016 e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\NicoSoft = "C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe" e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exeIMDCSC.exedescription pid process Token: SeIncreaseQuotaPrivilege 2016 e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe Token: SeSecurityPrivilege 2016 e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe Token: SeTakeOwnershipPrivilege 2016 e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe Token: SeLoadDriverPrivilege 2016 e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe Token: SeSystemProfilePrivilege 2016 e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe Token: SeSystemtimePrivilege 2016 e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe Token: SeProfSingleProcessPrivilege 2016 e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe Token: SeIncBasePriorityPrivilege 2016 e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe Token: SeCreatePagefilePrivilege 2016 e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe Token: SeBackupPrivilege 2016 e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe Token: SeRestorePrivilege 2016 e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe Token: SeShutdownPrivilege 2016 e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe Token: SeDebugPrivilege 2016 e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe Token: SeSystemEnvironmentPrivilege 2016 e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe Token: SeChangeNotifyPrivilege 2016 e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe Token: SeRemoteShutdownPrivilege 2016 e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe Token: SeUndockPrivilege 2016 e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe Token: SeManageVolumePrivilege 2016 e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe Token: SeImpersonatePrivilege 2016 e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe Token: SeCreateGlobalPrivilege 2016 e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe Token: 33 2016 e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe Token: 34 2016 e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe Token: 35 2016 e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe Token: SeIncreaseQuotaPrivilege 1304 IMDCSC.exe Token: SeSecurityPrivilege 1304 IMDCSC.exe Token: SeTakeOwnershipPrivilege 1304 IMDCSC.exe Token: SeLoadDriverPrivilege 1304 IMDCSC.exe Token: SeSystemProfilePrivilege 1304 IMDCSC.exe Token: SeSystemtimePrivilege 1304 IMDCSC.exe Token: SeProfSingleProcessPrivilege 1304 IMDCSC.exe Token: SeIncBasePriorityPrivilege 1304 IMDCSC.exe Token: SeCreatePagefilePrivilege 1304 IMDCSC.exe Token: SeBackupPrivilege 1304 IMDCSC.exe Token: SeRestorePrivilege 1304 IMDCSC.exe Token: SeShutdownPrivilege 1304 IMDCSC.exe Token: SeDebugPrivilege 1304 IMDCSC.exe Token: SeSystemEnvironmentPrivilege 1304 IMDCSC.exe Token: SeChangeNotifyPrivilege 1304 IMDCSC.exe Token: SeRemoteShutdownPrivilege 1304 IMDCSC.exe Token: SeUndockPrivilege 1304 IMDCSC.exe Token: SeManageVolumePrivilege 1304 IMDCSC.exe Token: SeImpersonatePrivilege 1304 IMDCSC.exe Token: SeCreateGlobalPrivilege 1304 IMDCSC.exe Token: 33 1304 IMDCSC.exe Token: 34 1304 IMDCSC.exe Token: 35 1304 IMDCSC.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
IMDCSC.exepid process 1304 IMDCSC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exedescription pid process target process PID 2016 wrote to memory of 1304 2016 e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe IMDCSC.exe PID 2016 wrote to memory of 1304 2016 e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe IMDCSC.exe PID 2016 wrote to memory of 1304 2016 e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe IMDCSC.exe PID 2016 wrote to memory of 1304 2016 e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe IMDCSC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe"C:\Users\Admin\AppData\Local\Temp\e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exeMD5
59dbe0b0647411f9eaedf5575271faef
SHA14c9f74505f9560b36fc05a65922e67657554be48
SHA256e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f
SHA512eaf02e903f86c71bf3fcc3061506faa1b0157c8f7b2dd95348eb919842532e97bf94ea46ae0596ec9774e0f67247df98e0607619b6932f096d95a3ba303bd3b0
-
C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exeMD5
59dbe0b0647411f9eaedf5575271faef
SHA14c9f74505f9560b36fc05a65922e67657554be48
SHA256e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f
SHA512eaf02e903f86c71bf3fcc3061506faa1b0157c8f7b2dd95348eb919842532e97bf94ea46ae0596ec9774e0f67247df98e0607619b6932f096d95a3ba303bd3b0
-
\Users\Admin\Documents\DCSCMIN\IMDCSC.exeMD5
59dbe0b0647411f9eaedf5575271faef
SHA14c9f74505f9560b36fc05a65922e67657554be48
SHA256e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f
SHA512eaf02e903f86c71bf3fcc3061506faa1b0157c8f7b2dd95348eb919842532e97bf94ea46ae0596ec9774e0f67247df98e0607619b6932f096d95a3ba303bd3b0
-
\Users\Admin\Documents\DCSCMIN\IMDCSC.exeMD5
59dbe0b0647411f9eaedf5575271faef
SHA14c9f74505f9560b36fc05a65922e67657554be48
SHA256e3e705a910cdde002fa583f2a48fef67ac4a035a424bc6ab0e2797c10d0bd26f
SHA512eaf02e903f86c71bf3fcc3061506faa1b0157c8f7b2dd95348eb919842532e97bf94ea46ae0596ec9774e0f67247df98e0607619b6932f096d95a3ba303bd3b0
-
memory/1304-63-0x0000000000000000-mapping.dmp
-
memory/1304-67-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2016-59-0x0000000075D11000-0x0000000075D13000-memory.dmpFilesize
8KB
-
memory/2016-60-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB