Analysis
- max time kernel
160s - max time network
161s - platform
windows10_x64 - resource
win10v20210408 - submitted
31/08/2021, 06:50
Static task
static1
Behavioral task
behavioral1
Sample
c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe
- Size 658KB
- Sample210831-kfpr7yvc66
- SHA256 c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30
- MD5 fbec7cabbdc37ab96d398f3bab2e143d
- SHA1 58b14d00f2c0437d658e8c9e29d11e619eb18738
- SHA512 cdf3f9a4478a93c5a1c3952fb35640b9e53638ecbd732beb1c47d4a80cae18850a8d1fde36f62bd8163fb9b33ec5de19ba8670fb7b174625a39b60fb6a1b7dd0
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
VITIMA
C2
-
glock15.ddns.net:5000
Mutex
-
DC_MUTEX-VVVKDJP
Attributes
-
InstallPath
windows32\System.exe
-
gencode
w2qwQ6TxgE4M
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
System
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\windows32\\System.exe" c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe - Executes dropped EXE 1 IoCs
pid Process 3908 System.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Windows\\system32\\windows32\\System.exe" System.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Windows\\system32\\windows32\\System.exe" c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\windows32\System.exe c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe File opened for modification C:\Windows\SysWOW64\windows32\System.exe c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe File opened for modification C:\Windows\SysWOW64\windows32\ c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 528 c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe Token: SeSecurityPrivilege 528 c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe Token: SeTakeOwnershipPrivilege 528 c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe Token: SeLoadDriverPrivilege 528 c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe Token: SeSystemProfilePrivilege 528 c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe Token: SeSystemtimePrivilege 528 c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe Token: SeProfSingleProcessPrivilege 528 c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe Token: SeIncBasePriorityPrivilege 528 c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe Token: SeCreatePagefilePrivilege 528 c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe Token: SeBackupPrivilege 528 c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe Token: SeRestorePrivilege 528 c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe Token: SeShutdownPrivilege 528 c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe Token: SeDebugPrivilege 528 c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe Token: SeSystemEnvironmentPrivilege 528 c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe Token: SeChangeNotifyPrivilege 528 c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe Token: SeRemoteShutdownPrivilege 528 c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe Token: SeUndockPrivilege 528 c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe Token: SeManageVolumePrivilege 528 c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe Token: SeImpersonatePrivilege 528 c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe Token: SeCreateGlobalPrivilege 528 c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe Token: 33 528 c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe Token: 34 528 c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe Token: 35 528 c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe Token: 36 528 c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe Token: SeIncreaseQuotaPrivilege 3908 System.exe Token: SeSecurityPrivilege 3908 System.exe Token: SeTakeOwnershipPrivilege 3908 System.exe Token: SeLoadDriverPrivilege 3908 System.exe Token: SeSystemProfilePrivilege 3908 System.exe Token: SeSystemtimePrivilege 3908 System.exe Token: SeProfSingleProcessPrivilege 3908 System.exe Token: SeIncBasePriorityPrivilege 3908 System.exe Token: SeCreatePagefilePrivilege 3908 System.exe Token: SeBackupPrivilege 3908 System.exe Token: SeRestorePrivilege 3908 System.exe Token: SeShutdownPrivilege 3908 System.exe Token: SeDebugPrivilege 3908 System.exe Token: SeSystemEnvironmentPrivilege 3908 System.exe Token: SeChangeNotifyPrivilege 3908 System.exe Token: SeRemoteShutdownPrivilege 3908 System.exe Token: SeUndockPrivilege 3908 System.exe Token: SeManageVolumePrivilege 3908 System.exe Token: SeImpersonatePrivilege 3908 System.exe Token: SeCreateGlobalPrivilege 3908 System.exe Token: 33 3908 System.exe Token: 34 3908 System.exe Token: 35 3908 System.exe Token: 36 3908 System.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3908 System.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 528 wrote to memory of 3908 528 c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe 75 PID 528 wrote to memory of 3908 528 c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe 75 PID 528 wrote to memory of 3908 528 c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe"C:\Users\Admin\AppData\Local\Temp\c29d545bd166e0fc8f641c4ba229bfe991bb35b66a87e41122af702007eb6e30.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Windows\SysWOW64\windows32\System.exe"C:\Windows\system32\windows32\System.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3908
-