Analysis
-
max time kernel
153s -
max time network
164s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
31-08-2021 10:24
Static task
static1
Behavioral task
behavioral1
Sample
802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe
Resource
win10v20210408
General
-
Target
802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe
-
Size
797KB
-
MD5
2ca8be7c1b7b9d4addcdd8643b37faf8
-
SHA1
4282592b2dda12b1385575b7686e741e5af9e178
-
SHA256
802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94
-
SHA512
b81531ded14a93fa7a6136ce721bc79cc113b4745d226acddb73067d5f628469820eb40b233b0de2fe5526c413914b51f24ec4533710b19d37842d307a754f93
Malware Config
Extracted
darkcomet
enayi avc�s�
8.tcp.ngrok.io:18922
8.tcp.ngrok.io:11390
DC_MUTEX-JJADN00
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
LHGZ2Ktc5bFu
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
Owo Para
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\MSDCSC\\msdcsc.exe" 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe -
Modifies security service 2 TTPs 2 IoCs
Processes:
msdcsc.exeiexplore.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" iexplore.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 2760 msdcsc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exemsdcsc.exeiexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Owo Para = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\MSDCSC\\msdcsc.exe" 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Owo Para = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Owo Para = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\MSDCSC\\msdcsc.exe" iexplore.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
msdcsc.exedescription pid process target process PID 2760 set thread context of 3500 2760 msdcsc.exe iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exemsdcsc.exeiexplore.exedescription pid process Token: SeIncreaseQuotaPrivilege 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe Token: SeSecurityPrivilege 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe Token: SeTakeOwnershipPrivilege 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe Token: SeLoadDriverPrivilege 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe Token: SeSystemProfilePrivilege 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe Token: SeSystemtimePrivilege 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe Token: SeProfSingleProcessPrivilege 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe Token: SeIncBasePriorityPrivilege 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe Token: SeCreatePagefilePrivilege 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe Token: SeBackupPrivilege 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe Token: SeRestorePrivilege 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe Token: SeShutdownPrivilege 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe Token: SeDebugPrivilege 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe Token: SeSystemEnvironmentPrivilege 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe Token: SeChangeNotifyPrivilege 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe Token: SeRemoteShutdownPrivilege 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe Token: SeUndockPrivilege 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe Token: SeManageVolumePrivilege 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe Token: SeImpersonatePrivilege 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe Token: SeCreateGlobalPrivilege 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe Token: 33 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe Token: 34 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe Token: 35 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe Token: 36 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe Token: SeIncreaseQuotaPrivilege 2760 msdcsc.exe Token: SeSecurityPrivilege 2760 msdcsc.exe Token: SeTakeOwnershipPrivilege 2760 msdcsc.exe Token: SeLoadDriverPrivilege 2760 msdcsc.exe Token: SeSystemProfilePrivilege 2760 msdcsc.exe Token: SeSystemtimePrivilege 2760 msdcsc.exe Token: SeProfSingleProcessPrivilege 2760 msdcsc.exe Token: SeIncBasePriorityPrivilege 2760 msdcsc.exe Token: SeCreatePagefilePrivilege 2760 msdcsc.exe Token: SeBackupPrivilege 2760 msdcsc.exe Token: SeRestorePrivilege 2760 msdcsc.exe Token: SeShutdownPrivilege 2760 msdcsc.exe Token: SeDebugPrivilege 2760 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2760 msdcsc.exe Token: SeChangeNotifyPrivilege 2760 msdcsc.exe Token: SeRemoteShutdownPrivilege 2760 msdcsc.exe Token: SeUndockPrivilege 2760 msdcsc.exe Token: SeManageVolumePrivilege 2760 msdcsc.exe Token: SeImpersonatePrivilege 2760 msdcsc.exe Token: SeCreateGlobalPrivilege 2760 msdcsc.exe Token: 33 2760 msdcsc.exe Token: 34 2760 msdcsc.exe Token: 35 2760 msdcsc.exe Token: 36 2760 msdcsc.exe Token: SeIncreaseQuotaPrivilege 3500 iexplore.exe Token: SeSecurityPrivilege 3500 iexplore.exe Token: SeTakeOwnershipPrivilege 3500 iexplore.exe Token: SeLoadDriverPrivilege 3500 iexplore.exe Token: SeSystemProfilePrivilege 3500 iexplore.exe Token: SeSystemtimePrivilege 3500 iexplore.exe Token: SeProfSingleProcessPrivilege 3500 iexplore.exe Token: SeIncBasePriorityPrivilege 3500 iexplore.exe Token: SeCreatePagefilePrivilege 3500 iexplore.exe Token: SeBackupPrivilege 3500 iexplore.exe Token: SeRestorePrivilege 3500 iexplore.exe Token: SeShutdownPrivilege 3500 iexplore.exe Token: SeDebugPrivilege 3500 iexplore.exe Token: SeSystemEnvironmentPrivilege 3500 iexplore.exe Token: SeChangeNotifyPrivilege 3500 iexplore.exe Token: SeRemoteShutdownPrivilege 3500 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
iexplore.exepid process 3500 iexplore.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.execmd.execmd.exemsdcsc.exeiexplore.exedescription pid process target process PID 2840 wrote to memory of 3908 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe cmd.exe PID 2840 wrote to memory of 3908 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe cmd.exe PID 2840 wrote to memory of 3908 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe cmd.exe PID 2840 wrote to memory of 4040 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe cmd.exe PID 2840 wrote to memory of 4040 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe cmd.exe PID 2840 wrote to memory of 4040 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe cmd.exe PID 3908 wrote to memory of 2952 3908 cmd.exe attrib.exe PID 3908 wrote to memory of 2952 3908 cmd.exe attrib.exe PID 3908 wrote to memory of 2952 3908 cmd.exe attrib.exe PID 4040 wrote to memory of 1124 4040 cmd.exe attrib.exe PID 4040 wrote to memory of 1124 4040 cmd.exe attrib.exe PID 4040 wrote to memory of 1124 4040 cmd.exe attrib.exe PID 2840 wrote to memory of 2760 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe msdcsc.exe PID 2840 wrote to memory of 2760 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe msdcsc.exe PID 2840 wrote to memory of 2760 2840 802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe msdcsc.exe PID 2760 wrote to memory of 3500 2760 msdcsc.exe iexplore.exe PID 2760 wrote to memory of 3500 2760 msdcsc.exe iexplore.exe PID 2760 wrote to memory of 3500 2760 msdcsc.exe iexplore.exe PID 2760 wrote to memory of 3500 2760 msdcsc.exe iexplore.exe PID 2760 wrote to memory of 3500 2760 msdcsc.exe iexplore.exe PID 3500 wrote to memory of 1740 3500 iexplore.exe notepad.exe PID 3500 wrote to memory of 1740 3500 iexplore.exe notepad.exe PID 3500 wrote to memory of 1740 3500 iexplore.exe notepad.exe PID 3500 wrote to memory of 1740 3500 iexplore.exe notepad.exe PID 3500 wrote to memory of 1740 3500 iexplore.exe notepad.exe PID 3500 wrote to memory of 1740 3500 iexplore.exe notepad.exe PID 3500 wrote to memory of 1740 3500 iexplore.exe notepad.exe PID 3500 wrote to memory of 1740 3500 iexplore.exe notepad.exe PID 3500 wrote to memory of 1740 3500 iexplore.exe notepad.exe PID 3500 wrote to memory of 1740 3500 iexplore.exe notepad.exe PID 3500 wrote to memory of 1740 3500 iexplore.exe notepad.exe PID 3500 wrote to memory of 1740 3500 iexplore.exe notepad.exe PID 3500 wrote to memory of 1740 3500 iexplore.exe notepad.exe PID 3500 wrote to memory of 1740 3500 iexplore.exe notepad.exe PID 3500 wrote to memory of 1740 3500 iexplore.exe notepad.exe PID 3500 wrote to memory of 1740 3500 iexplore.exe notepad.exe PID 3500 wrote to memory of 1740 3500 iexplore.exe notepad.exe PID 3500 wrote to memory of 1740 3500 iexplore.exe notepad.exe PID 3500 wrote to memory of 1740 3500 iexplore.exe notepad.exe PID 3500 wrote to memory of 1740 3500 iexplore.exe notepad.exe PID 3500 wrote to memory of 1740 3500 iexplore.exe notepad.exe PID 3500 wrote to memory of 1740 3500 iexplore.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2952 attrib.exe 1124 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe"C:\Users\Admin\AppData\Local\Temp\802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94.exe" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\MSDCSC\msdcsc.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\MSDCSC\msdcsc.exe"2⤵
- Modifies security service
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Modifies security service
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\MSDCSC\msdcsc.exeMD5
2ca8be7c1b7b9d4addcdd8643b37faf8
SHA14282592b2dda12b1385575b7686e741e5af9e178
SHA256802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94
SHA512b81531ded14a93fa7a6136ce721bc79cc113b4745d226acddb73067d5f628469820eb40b233b0de2fe5526c413914b51f24ec4533710b19d37842d307a754f93
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\MSDCSC\msdcsc.exeMD5
2ca8be7c1b7b9d4addcdd8643b37faf8
SHA14282592b2dda12b1385575b7686e741e5af9e178
SHA256802b67f035f6b75aa99b4c04c7701ca80f132ec5007d066f04c174e304423f94
SHA512b81531ded14a93fa7a6136ce721bc79cc113b4745d226acddb73067d5f628469820eb40b233b0de2fe5526c413914b51f24ec4533710b19d37842d307a754f93
-
memory/1124-118-0x0000000000000000-mapping.dmp
-
memory/1740-126-0x0000000000000000-mapping.dmp
-
memory/1740-128-0x0000000002F80000-0x0000000002F81000-memory.dmpFilesize
4KB
-
memory/2760-127-0x0000000000610000-0x000000000075A000-memory.dmpFilesize
1.3MB
-
memory/2760-119-0x0000000000000000-mapping.dmp
-
memory/2840-114-0x0000000002250000-0x0000000002251000-memory.dmpFilesize
4KB
-
memory/2952-117-0x0000000000000000-mapping.dmp
-
memory/3500-123-0x000000000048F888-mapping.dmp
-
memory/3500-122-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/3908-115-0x0000000000000000-mapping.dmp
-
memory/4040-116-0x0000000000000000-mapping.dmp