Analysis
-
max time kernel
150s -
max time network
200s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
03-09-2021 09:07
Static task
static1
Behavioral task
behavioral1
Sample
5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a.exe
Resource
win10-en
General
-
Target
5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a.exe
-
Size
722KB
-
MD5
806b65a2f241146d01b77369371e59f6
-
SHA1
f95281954408ad3132235c0baa6f75ae00cd748a
-
SHA256
5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a
-
SHA512
5c0152ae672a9557244d960c8838e36e0ccdad7234df1076a621f07d4cea5348d6d982fe41dd1060503baa0d69969913d82119b15e8c89f6641b55d806a7946f
Malware Config
Extracted
darkcomet
Guest16
127.0.0.1:1604
DC_MUTEX-LDXAQCA
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
uT8Um6D8y43p
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Extracted
metasploit
metasploit_stager
192.168.1.10:1604
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
FB_1832.tmp.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" FB_1832.tmp.exe -
Executes dropped EXE 3 IoCs
Processes:
FB_1832.tmp.exeFB_1B20.tmp.exemsdcsc.exepid process 336 FB_1832.tmp.exe 560 FB_1B20.tmp.exe 1484 msdcsc.exe -
Loads dropped DLL 6 IoCs
Processes:
5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a.exeFB_1832.tmp.exepid process 1988 5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a.exe 1988 5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a.exe 1988 5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a.exe 1988 5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a.exe 336 FB_1832.tmp.exe 336 FB_1832.tmp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
FB_1832.tmp.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" FB_1832.tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
FB_1832.tmp.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 336 FB_1832.tmp.exe Token: SeSecurityPrivilege 336 FB_1832.tmp.exe Token: SeTakeOwnershipPrivilege 336 FB_1832.tmp.exe Token: SeLoadDriverPrivilege 336 FB_1832.tmp.exe Token: SeSystemProfilePrivilege 336 FB_1832.tmp.exe Token: SeSystemtimePrivilege 336 FB_1832.tmp.exe Token: SeProfSingleProcessPrivilege 336 FB_1832.tmp.exe Token: SeIncBasePriorityPrivilege 336 FB_1832.tmp.exe Token: SeCreatePagefilePrivilege 336 FB_1832.tmp.exe Token: SeBackupPrivilege 336 FB_1832.tmp.exe Token: SeRestorePrivilege 336 FB_1832.tmp.exe Token: SeShutdownPrivilege 336 FB_1832.tmp.exe Token: SeDebugPrivilege 336 FB_1832.tmp.exe Token: SeSystemEnvironmentPrivilege 336 FB_1832.tmp.exe Token: SeChangeNotifyPrivilege 336 FB_1832.tmp.exe Token: SeRemoteShutdownPrivilege 336 FB_1832.tmp.exe Token: SeUndockPrivilege 336 FB_1832.tmp.exe Token: SeManageVolumePrivilege 336 FB_1832.tmp.exe Token: SeImpersonatePrivilege 336 FB_1832.tmp.exe Token: SeCreateGlobalPrivilege 336 FB_1832.tmp.exe Token: 33 336 FB_1832.tmp.exe Token: 34 336 FB_1832.tmp.exe Token: 35 336 FB_1832.tmp.exe Token: SeIncreaseQuotaPrivilege 1484 msdcsc.exe Token: SeSecurityPrivilege 1484 msdcsc.exe Token: SeTakeOwnershipPrivilege 1484 msdcsc.exe Token: SeLoadDriverPrivilege 1484 msdcsc.exe Token: SeSystemProfilePrivilege 1484 msdcsc.exe Token: SeSystemtimePrivilege 1484 msdcsc.exe Token: SeProfSingleProcessPrivilege 1484 msdcsc.exe Token: SeIncBasePriorityPrivilege 1484 msdcsc.exe Token: SeCreatePagefilePrivilege 1484 msdcsc.exe Token: SeBackupPrivilege 1484 msdcsc.exe Token: SeRestorePrivilege 1484 msdcsc.exe Token: SeShutdownPrivilege 1484 msdcsc.exe Token: SeDebugPrivilege 1484 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1484 msdcsc.exe Token: SeChangeNotifyPrivilege 1484 msdcsc.exe Token: SeRemoteShutdownPrivilege 1484 msdcsc.exe Token: SeUndockPrivilege 1484 msdcsc.exe Token: SeManageVolumePrivilege 1484 msdcsc.exe Token: SeImpersonatePrivilege 1484 msdcsc.exe Token: SeCreateGlobalPrivilege 1484 msdcsc.exe Token: 33 1484 msdcsc.exe Token: 34 1484 msdcsc.exe Token: 35 1484 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 1484 msdcsc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a.exeFB_1832.tmp.exedescription pid process target process PID 1988 wrote to memory of 336 1988 5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a.exe FB_1832.tmp.exe PID 1988 wrote to memory of 336 1988 5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a.exe FB_1832.tmp.exe PID 1988 wrote to memory of 336 1988 5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a.exe FB_1832.tmp.exe PID 1988 wrote to memory of 336 1988 5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a.exe FB_1832.tmp.exe PID 1988 wrote to memory of 560 1988 5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a.exe FB_1B20.tmp.exe PID 1988 wrote to memory of 560 1988 5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a.exe FB_1B20.tmp.exe PID 1988 wrote to memory of 560 1988 5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a.exe FB_1B20.tmp.exe PID 1988 wrote to memory of 560 1988 5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a.exe FB_1B20.tmp.exe PID 336 wrote to memory of 1484 336 FB_1832.tmp.exe msdcsc.exe PID 336 wrote to memory of 1484 336 FB_1832.tmp.exe msdcsc.exe PID 336 wrote to memory of 1484 336 FB_1832.tmp.exe msdcsc.exe PID 336 wrote to memory of 1484 336 FB_1832.tmp.exe msdcsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a.exe"C:\Users\Admin\AppData\Local\Temp\5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FB_1832.tmp.exe"C:\Users\Admin\AppData\Local\Temp\FB_1832.tmp.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\FB_1B20.tmp.exe"C:\Users\Admin\AppData\Local\Temp\FB_1B20.tmp.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\FB_1832.tmp.exeMD5
151f621261af67737f4cfabb696a673e
SHA11fdc0f34d3a7705fbdd4051c2dc62d998b09a025
SHA2560c726c89560400633fedbcde61d95d17206b386ec69f6b838dd0ae11338b464d
SHA512bcab3d1c2fd4400d5c6cb92f999ca93cc024a04c99fd2d3cd52a5b4aeaa49e17da6e21e225109965d70112fa584737087249d5b60629354276944c7768d25ccc
-
C:\Users\Admin\AppData\Local\Temp\FB_1832.tmp.exeMD5
151f621261af67737f4cfabb696a673e
SHA11fdc0f34d3a7705fbdd4051c2dc62d998b09a025
SHA2560c726c89560400633fedbcde61d95d17206b386ec69f6b838dd0ae11338b464d
SHA512bcab3d1c2fd4400d5c6cb92f999ca93cc024a04c99fd2d3cd52a5b4aeaa49e17da6e21e225109965d70112fa584737087249d5b60629354276944c7768d25ccc
-
C:\Users\Admin\AppData\Local\Temp\FB_1B20.tmp.exeMD5
67298c76c8f12a8c64c6e5c33787f325
SHA120333c497bea58883bf94d7957196e10247f88a7
SHA256ff27dc917763064fe06aa594829d2693a0d0211eeb0a743b2ea195f68962762a
SHA512b4b0e6275ce115a122f52a8eb59c21328b937f2a9bcaf2212f7b7008d75753e5bd57027a570577199a1759eb58cf4db4f3f9da8a04e785376eaafab5b25b329d
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
151f621261af67737f4cfabb696a673e
SHA11fdc0f34d3a7705fbdd4051c2dc62d998b09a025
SHA2560c726c89560400633fedbcde61d95d17206b386ec69f6b838dd0ae11338b464d
SHA512bcab3d1c2fd4400d5c6cb92f999ca93cc024a04c99fd2d3cd52a5b4aeaa49e17da6e21e225109965d70112fa584737087249d5b60629354276944c7768d25ccc
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
151f621261af67737f4cfabb696a673e
SHA11fdc0f34d3a7705fbdd4051c2dc62d998b09a025
SHA2560c726c89560400633fedbcde61d95d17206b386ec69f6b838dd0ae11338b464d
SHA512bcab3d1c2fd4400d5c6cb92f999ca93cc024a04c99fd2d3cd52a5b4aeaa49e17da6e21e225109965d70112fa584737087249d5b60629354276944c7768d25ccc
-
\Users\Admin\AppData\Local\Temp\FB_1832.tmp.exeMD5
151f621261af67737f4cfabb696a673e
SHA11fdc0f34d3a7705fbdd4051c2dc62d998b09a025
SHA2560c726c89560400633fedbcde61d95d17206b386ec69f6b838dd0ae11338b464d
SHA512bcab3d1c2fd4400d5c6cb92f999ca93cc024a04c99fd2d3cd52a5b4aeaa49e17da6e21e225109965d70112fa584737087249d5b60629354276944c7768d25ccc
-
\Users\Admin\AppData\Local\Temp\FB_1832.tmp.exeMD5
151f621261af67737f4cfabb696a673e
SHA11fdc0f34d3a7705fbdd4051c2dc62d998b09a025
SHA2560c726c89560400633fedbcde61d95d17206b386ec69f6b838dd0ae11338b464d
SHA512bcab3d1c2fd4400d5c6cb92f999ca93cc024a04c99fd2d3cd52a5b4aeaa49e17da6e21e225109965d70112fa584737087249d5b60629354276944c7768d25ccc
-
\Users\Admin\AppData\Local\Temp\FB_1B20.tmp.exeMD5
67298c76c8f12a8c64c6e5c33787f325
SHA120333c497bea58883bf94d7957196e10247f88a7
SHA256ff27dc917763064fe06aa594829d2693a0d0211eeb0a743b2ea195f68962762a
SHA512b4b0e6275ce115a122f52a8eb59c21328b937f2a9bcaf2212f7b7008d75753e5bd57027a570577199a1759eb58cf4db4f3f9da8a04e785376eaafab5b25b329d
-
\Users\Admin\AppData\Local\Temp\FB_1B20.tmp.exeMD5
67298c76c8f12a8c64c6e5c33787f325
SHA120333c497bea58883bf94d7957196e10247f88a7
SHA256ff27dc917763064fe06aa594829d2693a0d0211eeb0a743b2ea195f68962762a
SHA512b4b0e6275ce115a122f52a8eb59c21328b937f2a9bcaf2212f7b7008d75753e5bd57027a570577199a1759eb58cf4db4f3f9da8a04e785376eaafab5b25b329d
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
151f621261af67737f4cfabb696a673e
SHA11fdc0f34d3a7705fbdd4051c2dc62d998b09a025
SHA2560c726c89560400633fedbcde61d95d17206b386ec69f6b838dd0ae11338b464d
SHA512bcab3d1c2fd4400d5c6cb92f999ca93cc024a04c99fd2d3cd52a5b4aeaa49e17da6e21e225109965d70112fa584737087249d5b60629354276944c7768d25ccc
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
151f621261af67737f4cfabb696a673e
SHA11fdc0f34d3a7705fbdd4051c2dc62d998b09a025
SHA2560c726c89560400633fedbcde61d95d17206b386ec69f6b838dd0ae11338b464d
SHA512bcab3d1c2fd4400d5c6cb92f999ca93cc024a04c99fd2d3cd52a5b4aeaa49e17da6e21e225109965d70112fa584737087249d5b60629354276944c7768d25ccc
-
memory/336-70-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/336-62-0x0000000000000000-mapping.dmp
-
memory/560-67-0x0000000000000000-mapping.dmp
-
memory/1484-73-0x0000000000000000-mapping.dmp
-
memory/1484-77-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/1988-59-0x0000000075AD1000-0x0000000075AD3000-memory.dmpFilesize
8KB