Analysis
-
max time kernel
155s -
max time network
157s -
platform
windows7_x64 -
resource
win7-en -
submitted
03-09-2021 09:07
Static task
static1
Behavioral task
behavioral1
Sample
b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6.exe
Resource
win7-en
Behavioral task
behavioral2
Sample
b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6.exe
Resource
win10-en
General
-
Target
b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6.exe
-
Size
716KB
-
MD5
0bb1cb742eaddbad11d9e96993fb23d7
-
SHA1
07437ed6538dfebb78a0367d002cd9212c68f6f0
-
SHA256
b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6
-
SHA512
fc111533d4d6d97c6466e2564c865eb8d6e839cb79f8629feed2a794dfa7c83c096a8be2879e7f8287d5719045eb0751a0776a70583ed1b5ae07f3512ba31613
Malware Config
Extracted
darkcomet
Guest16
127.0.0.1:1604
DC_MUTEX-LDXAQCA
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
uT8Um6D8y43p
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Extracted
metasploit
metasploit_stager
192.168.1.10:1604
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
FB_D3A.tmp.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" FB_D3A.tmp.exe -
Executes dropped EXE 3 IoCs
Processes:
FB_D3A.tmp.exeFB_E15.tmp.exemsdcsc.exepid process 1864 FB_D3A.tmp.exe 1648 FB_E15.tmp.exe 1396 msdcsc.exe -
Loads dropped DLL 6 IoCs
Processes:
b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6.exeFB_D3A.tmp.exepid process 736 b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6.exe 736 b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6.exe 736 b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6.exe 736 b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6.exe 1864 FB_D3A.tmp.exe 1864 FB_D3A.tmp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
FB_D3A.tmp.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" FB_D3A.tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
FB_D3A.tmp.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1864 FB_D3A.tmp.exe Token: SeSecurityPrivilege 1864 FB_D3A.tmp.exe Token: SeTakeOwnershipPrivilege 1864 FB_D3A.tmp.exe Token: SeLoadDriverPrivilege 1864 FB_D3A.tmp.exe Token: SeSystemProfilePrivilege 1864 FB_D3A.tmp.exe Token: SeSystemtimePrivilege 1864 FB_D3A.tmp.exe Token: SeProfSingleProcessPrivilege 1864 FB_D3A.tmp.exe Token: SeIncBasePriorityPrivilege 1864 FB_D3A.tmp.exe Token: SeCreatePagefilePrivilege 1864 FB_D3A.tmp.exe Token: SeBackupPrivilege 1864 FB_D3A.tmp.exe Token: SeRestorePrivilege 1864 FB_D3A.tmp.exe Token: SeShutdownPrivilege 1864 FB_D3A.tmp.exe Token: SeDebugPrivilege 1864 FB_D3A.tmp.exe Token: SeSystemEnvironmentPrivilege 1864 FB_D3A.tmp.exe Token: SeChangeNotifyPrivilege 1864 FB_D3A.tmp.exe Token: SeRemoteShutdownPrivilege 1864 FB_D3A.tmp.exe Token: SeUndockPrivilege 1864 FB_D3A.tmp.exe Token: SeManageVolumePrivilege 1864 FB_D3A.tmp.exe Token: SeImpersonatePrivilege 1864 FB_D3A.tmp.exe Token: SeCreateGlobalPrivilege 1864 FB_D3A.tmp.exe Token: 33 1864 FB_D3A.tmp.exe Token: 34 1864 FB_D3A.tmp.exe Token: 35 1864 FB_D3A.tmp.exe Token: SeIncreaseQuotaPrivilege 1396 msdcsc.exe Token: SeSecurityPrivilege 1396 msdcsc.exe Token: SeTakeOwnershipPrivilege 1396 msdcsc.exe Token: SeLoadDriverPrivilege 1396 msdcsc.exe Token: SeSystemProfilePrivilege 1396 msdcsc.exe Token: SeSystemtimePrivilege 1396 msdcsc.exe Token: SeProfSingleProcessPrivilege 1396 msdcsc.exe Token: SeIncBasePriorityPrivilege 1396 msdcsc.exe Token: SeCreatePagefilePrivilege 1396 msdcsc.exe Token: SeBackupPrivilege 1396 msdcsc.exe Token: SeRestorePrivilege 1396 msdcsc.exe Token: SeShutdownPrivilege 1396 msdcsc.exe Token: SeDebugPrivilege 1396 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1396 msdcsc.exe Token: SeChangeNotifyPrivilege 1396 msdcsc.exe Token: SeRemoteShutdownPrivilege 1396 msdcsc.exe Token: SeUndockPrivilege 1396 msdcsc.exe Token: SeManageVolumePrivilege 1396 msdcsc.exe Token: SeImpersonatePrivilege 1396 msdcsc.exe Token: SeCreateGlobalPrivilege 1396 msdcsc.exe Token: 33 1396 msdcsc.exe Token: 34 1396 msdcsc.exe Token: 35 1396 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 1396 msdcsc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6.exeFB_D3A.tmp.exedescription pid process target process PID 736 wrote to memory of 1864 736 b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6.exe FB_D3A.tmp.exe PID 736 wrote to memory of 1864 736 b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6.exe FB_D3A.tmp.exe PID 736 wrote to memory of 1864 736 b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6.exe FB_D3A.tmp.exe PID 736 wrote to memory of 1864 736 b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6.exe FB_D3A.tmp.exe PID 736 wrote to memory of 1648 736 b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6.exe FB_E15.tmp.exe PID 736 wrote to memory of 1648 736 b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6.exe FB_E15.tmp.exe PID 736 wrote to memory of 1648 736 b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6.exe FB_E15.tmp.exe PID 736 wrote to memory of 1648 736 b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6.exe FB_E15.tmp.exe PID 1864 wrote to memory of 1396 1864 FB_D3A.tmp.exe msdcsc.exe PID 1864 wrote to memory of 1396 1864 FB_D3A.tmp.exe msdcsc.exe PID 1864 wrote to memory of 1396 1864 FB_D3A.tmp.exe msdcsc.exe PID 1864 wrote to memory of 1396 1864 FB_D3A.tmp.exe msdcsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6.exe"C:\Users\Admin\AppData\Local\Temp\b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FB_D3A.tmp.exe"C:\Users\Admin\AppData\Local\Temp\FB_D3A.tmp.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\FB_E15.tmp.exe"C:\Users\Admin\AppData\Local\Temp\FB_E15.tmp.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\FB_D3A.tmp.exeMD5
151f621261af67737f4cfabb696a673e
SHA11fdc0f34d3a7705fbdd4051c2dc62d998b09a025
SHA2560c726c89560400633fedbcde61d95d17206b386ec69f6b838dd0ae11338b464d
SHA512bcab3d1c2fd4400d5c6cb92f999ca93cc024a04c99fd2d3cd52a5b4aeaa49e17da6e21e225109965d70112fa584737087249d5b60629354276944c7768d25ccc
-
C:\Users\Admin\AppData\Local\Temp\FB_D3A.tmp.exeMD5
151f621261af67737f4cfabb696a673e
SHA11fdc0f34d3a7705fbdd4051c2dc62d998b09a025
SHA2560c726c89560400633fedbcde61d95d17206b386ec69f6b838dd0ae11338b464d
SHA512bcab3d1c2fd4400d5c6cb92f999ca93cc024a04c99fd2d3cd52a5b4aeaa49e17da6e21e225109965d70112fa584737087249d5b60629354276944c7768d25ccc
-
C:\Users\Admin\AppData\Local\Temp\FB_E15.tmp.exeMD5
67298c76c8f12a8c64c6e5c33787f325
SHA120333c497bea58883bf94d7957196e10247f88a7
SHA256ff27dc917763064fe06aa594829d2693a0d0211eeb0a743b2ea195f68962762a
SHA512b4b0e6275ce115a122f52a8eb59c21328b937f2a9bcaf2212f7b7008d75753e5bd57027a570577199a1759eb58cf4db4f3f9da8a04e785376eaafab5b25b329d
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
151f621261af67737f4cfabb696a673e
SHA11fdc0f34d3a7705fbdd4051c2dc62d998b09a025
SHA2560c726c89560400633fedbcde61d95d17206b386ec69f6b838dd0ae11338b464d
SHA512bcab3d1c2fd4400d5c6cb92f999ca93cc024a04c99fd2d3cd52a5b4aeaa49e17da6e21e225109965d70112fa584737087249d5b60629354276944c7768d25ccc
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
151f621261af67737f4cfabb696a673e
SHA11fdc0f34d3a7705fbdd4051c2dc62d998b09a025
SHA2560c726c89560400633fedbcde61d95d17206b386ec69f6b838dd0ae11338b464d
SHA512bcab3d1c2fd4400d5c6cb92f999ca93cc024a04c99fd2d3cd52a5b4aeaa49e17da6e21e225109965d70112fa584737087249d5b60629354276944c7768d25ccc
-
\Users\Admin\AppData\Local\Temp\FB_D3A.tmp.exeMD5
151f621261af67737f4cfabb696a673e
SHA11fdc0f34d3a7705fbdd4051c2dc62d998b09a025
SHA2560c726c89560400633fedbcde61d95d17206b386ec69f6b838dd0ae11338b464d
SHA512bcab3d1c2fd4400d5c6cb92f999ca93cc024a04c99fd2d3cd52a5b4aeaa49e17da6e21e225109965d70112fa584737087249d5b60629354276944c7768d25ccc
-
\Users\Admin\AppData\Local\Temp\FB_D3A.tmp.exeMD5
151f621261af67737f4cfabb696a673e
SHA11fdc0f34d3a7705fbdd4051c2dc62d998b09a025
SHA2560c726c89560400633fedbcde61d95d17206b386ec69f6b838dd0ae11338b464d
SHA512bcab3d1c2fd4400d5c6cb92f999ca93cc024a04c99fd2d3cd52a5b4aeaa49e17da6e21e225109965d70112fa584737087249d5b60629354276944c7768d25ccc
-
\Users\Admin\AppData\Local\Temp\FB_E15.tmp.exeMD5
67298c76c8f12a8c64c6e5c33787f325
SHA120333c497bea58883bf94d7957196e10247f88a7
SHA256ff27dc917763064fe06aa594829d2693a0d0211eeb0a743b2ea195f68962762a
SHA512b4b0e6275ce115a122f52a8eb59c21328b937f2a9bcaf2212f7b7008d75753e5bd57027a570577199a1759eb58cf4db4f3f9da8a04e785376eaafab5b25b329d
-
\Users\Admin\AppData\Local\Temp\FB_E15.tmp.exeMD5
67298c76c8f12a8c64c6e5c33787f325
SHA120333c497bea58883bf94d7957196e10247f88a7
SHA256ff27dc917763064fe06aa594829d2693a0d0211eeb0a743b2ea195f68962762a
SHA512b4b0e6275ce115a122f52a8eb59c21328b937f2a9bcaf2212f7b7008d75753e5bd57027a570577199a1759eb58cf4db4f3f9da8a04e785376eaafab5b25b329d
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
151f621261af67737f4cfabb696a673e
SHA11fdc0f34d3a7705fbdd4051c2dc62d998b09a025
SHA2560c726c89560400633fedbcde61d95d17206b386ec69f6b838dd0ae11338b464d
SHA512bcab3d1c2fd4400d5c6cb92f999ca93cc024a04c99fd2d3cd52a5b4aeaa49e17da6e21e225109965d70112fa584737087249d5b60629354276944c7768d25ccc
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
151f621261af67737f4cfabb696a673e
SHA11fdc0f34d3a7705fbdd4051c2dc62d998b09a025
SHA2560c726c89560400633fedbcde61d95d17206b386ec69f6b838dd0ae11338b464d
SHA512bcab3d1c2fd4400d5c6cb92f999ca93cc024a04c99fd2d3cd52a5b4aeaa49e17da6e21e225109965d70112fa584737087249d5b60629354276944c7768d25ccc
-
memory/736-53-0x0000000075E51000-0x0000000075E53000-memory.dmpFilesize
8KB
-
memory/1396-67-0x0000000000000000-mapping.dmp
-
memory/1396-71-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1648-61-0x0000000000000000-mapping.dmp
-
memory/1864-64-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/1864-56-0x0000000000000000-mapping.dmp