Analysis
-
max time kernel
152s -
max time network
144s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
14-08-2021 06:51
Static task
static1
Behavioral task
behavioral1
Sample
SBHJYT.exe
Resource
win7v20210410
General
-
Target
SBHJYT.exe
-
Size
13.9MB
-
MD5
20799f295c5b0e5aa27b5896b230b57a
-
SHA1
e0e72f3a636f4dcd87bb5606f24fe0ff298fbb74
-
SHA256
3d96847f7962c01a7951f95acb29dff7999b7e8d54c946b3b1ccd035cbf2bcb1
-
SHA512
70cd3984c49da18dc9aeb852f745a8324a93583ab892af7f08bf5372cdb4ffc0cb0cce4033988d9088aaf1b0c740f612690addf9598ad3349ef6ef79112b3d16
Malware Config
Extracted
darkcomet
Guest16
onlinebonjour1pt.ddns.net:1605
DC_MUTEX-K9JEE5J
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
PPlJGVizdNKt
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
Microdaptxx
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
SBHJYT.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" SBHJYT.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe -
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Executes dropped EXE 2 IoCs
Processes:
msdcsc.exemsdcsc.exepid process 1628 msdcsc.exe 1468 msdcsc.exe -
Loads dropped DLL 2 IoCs
Processes:
SBHJYT.exemsdcsc.exepid process 748 SBHJYT.exe 1628 msdcsc.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
SBHJYT.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microdaptxx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" SBHJYT.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microdaptxx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
SBHJYT.exemsdcsc.exedescription pid process target process PID 2004 set thread context of 748 2004 SBHJYT.exe SBHJYT.exe PID 1628 set thread context of 1468 1628 msdcsc.exe msdcsc.exe -
autoit_exe 5 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe autoit_exe C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe autoit_exe C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe autoit_exe \Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe autoit_exe C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 1468 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
SBHJYT.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 748 SBHJYT.exe Token: SeSecurityPrivilege 748 SBHJYT.exe Token: SeTakeOwnershipPrivilege 748 SBHJYT.exe Token: SeLoadDriverPrivilege 748 SBHJYT.exe Token: SeSystemProfilePrivilege 748 SBHJYT.exe Token: SeSystemtimePrivilege 748 SBHJYT.exe Token: SeProfSingleProcessPrivilege 748 SBHJYT.exe Token: SeIncBasePriorityPrivilege 748 SBHJYT.exe Token: SeCreatePagefilePrivilege 748 SBHJYT.exe Token: SeBackupPrivilege 748 SBHJYT.exe Token: SeRestorePrivilege 748 SBHJYT.exe Token: SeShutdownPrivilege 748 SBHJYT.exe Token: SeDebugPrivilege 748 SBHJYT.exe Token: SeSystemEnvironmentPrivilege 748 SBHJYT.exe Token: SeChangeNotifyPrivilege 748 SBHJYT.exe Token: SeRemoteShutdownPrivilege 748 SBHJYT.exe Token: SeUndockPrivilege 748 SBHJYT.exe Token: SeManageVolumePrivilege 748 SBHJYT.exe Token: SeImpersonatePrivilege 748 SBHJYT.exe Token: SeCreateGlobalPrivilege 748 SBHJYT.exe Token: 33 748 SBHJYT.exe Token: 34 748 SBHJYT.exe Token: 35 748 SBHJYT.exe Token: SeIncreaseQuotaPrivilege 1468 msdcsc.exe Token: SeSecurityPrivilege 1468 msdcsc.exe Token: SeTakeOwnershipPrivilege 1468 msdcsc.exe Token: SeLoadDriverPrivilege 1468 msdcsc.exe Token: SeSystemProfilePrivilege 1468 msdcsc.exe Token: SeSystemtimePrivilege 1468 msdcsc.exe Token: SeProfSingleProcessPrivilege 1468 msdcsc.exe Token: SeIncBasePriorityPrivilege 1468 msdcsc.exe Token: SeCreatePagefilePrivilege 1468 msdcsc.exe Token: SeBackupPrivilege 1468 msdcsc.exe Token: SeRestorePrivilege 1468 msdcsc.exe Token: SeShutdownPrivilege 1468 msdcsc.exe Token: SeDebugPrivilege 1468 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1468 msdcsc.exe Token: SeChangeNotifyPrivilege 1468 msdcsc.exe Token: SeRemoteShutdownPrivilege 1468 msdcsc.exe Token: SeUndockPrivilege 1468 msdcsc.exe Token: SeManageVolumePrivilege 1468 msdcsc.exe Token: SeImpersonatePrivilege 1468 msdcsc.exe Token: SeCreateGlobalPrivilege 1468 msdcsc.exe Token: 33 1468 msdcsc.exe Token: 34 1468 msdcsc.exe Token: 35 1468 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 1468 msdcsc.exe -
Suspicious use of WriteProcessMemory 55 IoCs
Processes:
SBHJYT.exeSBHJYT.execmd.execmd.exemsdcsc.exemsdcsc.exedescription pid process target process PID 2004 wrote to memory of 748 2004 SBHJYT.exe SBHJYT.exe PID 2004 wrote to memory of 748 2004 SBHJYT.exe SBHJYT.exe PID 2004 wrote to memory of 748 2004 SBHJYT.exe SBHJYT.exe PID 2004 wrote to memory of 748 2004 SBHJYT.exe SBHJYT.exe PID 2004 wrote to memory of 748 2004 SBHJYT.exe SBHJYT.exe PID 2004 wrote to memory of 748 2004 SBHJYT.exe SBHJYT.exe PID 748 wrote to memory of 1900 748 SBHJYT.exe cmd.exe PID 748 wrote to memory of 1900 748 SBHJYT.exe cmd.exe PID 748 wrote to memory of 1900 748 SBHJYT.exe cmd.exe PID 748 wrote to memory of 1900 748 SBHJYT.exe cmd.exe PID 748 wrote to memory of 1932 748 SBHJYT.exe cmd.exe PID 748 wrote to memory of 1932 748 SBHJYT.exe cmd.exe PID 748 wrote to memory of 1932 748 SBHJYT.exe cmd.exe PID 748 wrote to memory of 1932 748 SBHJYT.exe cmd.exe PID 1900 wrote to memory of 808 1900 cmd.exe attrib.exe PID 1900 wrote to memory of 808 1900 cmd.exe attrib.exe PID 1900 wrote to memory of 808 1900 cmd.exe attrib.exe PID 1900 wrote to memory of 808 1900 cmd.exe attrib.exe PID 1932 wrote to memory of 384 1932 cmd.exe attrib.exe PID 1932 wrote to memory of 384 1932 cmd.exe attrib.exe PID 1932 wrote to memory of 384 1932 cmd.exe attrib.exe PID 1932 wrote to memory of 384 1932 cmd.exe attrib.exe PID 748 wrote to memory of 1628 748 SBHJYT.exe msdcsc.exe PID 748 wrote to memory of 1628 748 SBHJYT.exe msdcsc.exe PID 748 wrote to memory of 1628 748 SBHJYT.exe msdcsc.exe PID 748 wrote to memory of 1628 748 SBHJYT.exe msdcsc.exe PID 1628 wrote to memory of 1468 1628 msdcsc.exe msdcsc.exe PID 1628 wrote to memory of 1468 1628 msdcsc.exe msdcsc.exe PID 1628 wrote to memory of 1468 1628 msdcsc.exe msdcsc.exe PID 1628 wrote to memory of 1468 1628 msdcsc.exe msdcsc.exe PID 1628 wrote to memory of 1468 1628 msdcsc.exe msdcsc.exe PID 1628 wrote to memory of 1468 1628 msdcsc.exe msdcsc.exe PID 1468 wrote to memory of 1672 1468 msdcsc.exe notepad.exe PID 1468 wrote to memory of 1672 1468 msdcsc.exe notepad.exe PID 1468 wrote to memory of 1672 1468 msdcsc.exe notepad.exe PID 1468 wrote to memory of 1672 1468 msdcsc.exe notepad.exe PID 1468 wrote to memory of 1672 1468 msdcsc.exe notepad.exe PID 1468 wrote to memory of 1672 1468 msdcsc.exe notepad.exe PID 1468 wrote to memory of 1672 1468 msdcsc.exe notepad.exe PID 1468 wrote to memory of 1672 1468 msdcsc.exe notepad.exe PID 1468 wrote to memory of 1672 1468 msdcsc.exe notepad.exe PID 1468 wrote to memory of 1672 1468 msdcsc.exe notepad.exe PID 1468 wrote to memory of 1672 1468 msdcsc.exe notepad.exe PID 1468 wrote to memory of 1672 1468 msdcsc.exe notepad.exe PID 1468 wrote to memory of 1672 1468 msdcsc.exe notepad.exe PID 1468 wrote to memory of 1672 1468 msdcsc.exe notepad.exe PID 1468 wrote to memory of 1672 1468 msdcsc.exe notepad.exe PID 1468 wrote to memory of 1672 1468 msdcsc.exe notepad.exe PID 1468 wrote to memory of 1672 1468 msdcsc.exe notepad.exe PID 1468 wrote to memory of 1672 1468 msdcsc.exe notepad.exe PID 1468 wrote to memory of 1672 1468 msdcsc.exe notepad.exe PID 1468 wrote to memory of 1672 1468 msdcsc.exe notepad.exe PID 1468 wrote to memory of 1672 1468 msdcsc.exe notepad.exe PID 1468 wrote to memory of 1672 1468 msdcsc.exe notepad.exe PID 1468 wrote to memory of 1672 1468 msdcsc.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 808 attrib.exe 384 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SBHJYT.exe"C:\Users\Admin\AppData\Local\Temp\SBHJYT.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SBHJYT.exe"C:\Users\Admin\AppData\Local\Temp\SBHJYT.exe"2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\SBHJYT.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\SBHJYT.exe" +s +h4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"4⤵
- Modifies firewall policy service
- Modifies security service
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exeMD5
20799f295c5b0e5aa27b5896b230b57a
SHA1e0e72f3a636f4dcd87bb5606f24fe0ff298fbb74
SHA2563d96847f7962c01a7951f95acb29dff7999b7e8d54c946b3b1ccd035cbf2bcb1
SHA51270cd3984c49da18dc9aeb852f745a8324a93583ab892af7f08bf5372cdb4ffc0cb0cce4033988d9088aaf1b0c740f612690addf9598ad3349ef6ef79112b3d16
-
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exeMD5
20799f295c5b0e5aa27b5896b230b57a
SHA1e0e72f3a636f4dcd87bb5606f24fe0ff298fbb74
SHA2563d96847f7962c01a7951f95acb29dff7999b7e8d54c946b3b1ccd035cbf2bcb1
SHA51270cd3984c49da18dc9aeb852f745a8324a93583ab892af7f08bf5372cdb4ffc0cb0cce4033988d9088aaf1b0c740f612690addf9598ad3349ef6ef79112b3d16
-
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exeMD5
20799f295c5b0e5aa27b5896b230b57a
SHA1e0e72f3a636f4dcd87bb5606f24fe0ff298fbb74
SHA2563d96847f7962c01a7951f95acb29dff7999b7e8d54c946b3b1ccd035cbf2bcb1
SHA51270cd3984c49da18dc9aeb852f745a8324a93583ab892af7f08bf5372cdb4ffc0cb0cce4033988d9088aaf1b0c740f612690addf9598ad3349ef6ef79112b3d16
-
\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exeMD5
20799f295c5b0e5aa27b5896b230b57a
SHA1e0e72f3a636f4dcd87bb5606f24fe0ff298fbb74
SHA2563d96847f7962c01a7951f95acb29dff7999b7e8d54c946b3b1ccd035cbf2bcb1
SHA51270cd3984c49da18dc9aeb852f745a8324a93583ab892af7f08bf5372cdb4ffc0cb0cce4033988d9088aaf1b0c740f612690addf9598ad3349ef6ef79112b3d16
-
\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exeMD5
20799f295c5b0e5aa27b5896b230b57a
SHA1e0e72f3a636f4dcd87bb5606f24fe0ff298fbb74
SHA2563d96847f7962c01a7951f95acb29dff7999b7e8d54c946b3b1ccd035cbf2bcb1
SHA51270cd3984c49da18dc9aeb852f745a8324a93583ab892af7f08bf5372cdb4ffc0cb0cce4033988d9088aaf1b0c740f612690addf9598ad3349ef6ef79112b3d16
-
memory/384-69-0x0000000000000000-mapping.dmp
-
memory/748-64-0x00000000000C0000-0x0000000000176000-memory.dmpFilesize
728KB
-
memory/748-65-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/748-62-0x000000000014F888-mapping.dmp
-
memory/748-61-0x00000000000C0000-0x0000000000176000-memory.dmpFilesize
728KB
-
memory/808-68-0x0000000000000000-mapping.dmp
-
memory/1468-83-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1468-82-0x00000000000C0000-0x0000000000176000-memory.dmpFilesize
728KB
-
memory/1468-77-0x000000000014F888-mapping.dmp
-
memory/1628-71-0x0000000000000000-mapping.dmp
-
memory/1672-80-0x0000000000000000-mapping.dmp
-
memory/1672-84-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1900-66-0x0000000000000000-mapping.dmp
-
memory/1932-67-0x0000000000000000-mapping.dmp
-
memory/2004-60-0x00000000765F1000-0x00000000765F3000-memory.dmpFilesize
8KB