Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
17-09-2021 13:32
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order 461.exe
Resource
win7-en-20210916
Behavioral task
behavioral2
Sample
Purchase Order 461.exe
Resource
win10v20210408
General
-
Target
Purchase Order 461.exe
-
Size
2.0MB
-
MD5
f88cdbcb740a75972cfef27692239991
-
SHA1
fcdaed8c771069c111afb78bd1d2ebaeb28a6688
-
SHA256
b6191c6a038f6d49e6941f00ded6a45cf3050ff0a2ecea3a3b3b462dc580f352
-
SHA512
44265899cd6915a0c637496598b1110f81a3a1a42d5c2c77137bb7745663335f0dc48fa184632226d18294da23a354780009386d6dd6613ad605b5021ff1d8b3
Malware Config
Extracted
darkcomet
SeptemBER 2021
bonding79.ddns.net:3316
goodgt79.ddns.net:3316
whatis79.ddns.net:3316
smath79.ddns.net:3316
jacknop79.ddns.net:3316
chrisle79.ddns.net:3316
DC_MUTEX-6JQTXC0
-
gencode
cVaduGzs7zFu
-
install
false
-
offline_keylogger
true
-
password
Password20$
-
persistence
false
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
Purchase Order 461.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\yISM0wdU8nvQZS6R\\CqJusqyiQLsJ.exe\",explorer.exe" Purchase Order 461.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Purchase Order 461.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Purchase Order 461.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Purchase Order 461.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
Purchase Order 461.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Wine Purchase Order 461.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Purchase Order 461.exedescription pid process target process PID 632 set thread context of 1296 632 Purchase Order 461.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Purchase Order 461.exepid process 632 Purchase Order 461.exe 632 Purchase Order 461.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
Processes:
Purchase Order 461.exevbc.exedescription pid process Token: SeDebugPrivilege 632 Purchase Order 461.exe Token: SeDebugPrivilege 632 Purchase Order 461.exe Token: SeIncreaseQuotaPrivilege 1296 vbc.exe Token: SeSecurityPrivilege 1296 vbc.exe Token: SeTakeOwnershipPrivilege 1296 vbc.exe Token: SeLoadDriverPrivilege 1296 vbc.exe Token: SeSystemProfilePrivilege 1296 vbc.exe Token: SeSystemtimePrivilege 1296 vbc.exe Token: SeProfSingleProcessPrivilege 1296 vbc.exe Token: SeIncBasePriorityPrivilege 1296 vbc.exe Token: SeCreatePagefilePrivilege 1296 vbc.exe Token: SeBackupPrivilege 1296 vbc.exe Token: SeRestorePrivilege 1296 vbc.exe Token: SeShutdownPrivilege 1296 vbc.exe Token: SeDebugPrivilege 1296 vbc.exe Token: SeSystemEnvironmentPrivilege 1296 vbc.exe Token: SeChangeNotifyPrivilege 1296 vbc.exe Token: SeRemoteShutdownPrivilege 1296 vbc.exe Token: SeUndockPrivilege 1296 vbc.exe Token: SeManageVolumePrivilege 1296 vbc.exe Token: SeImpersonatePrivilege 1296 vbc.exe Token: SeCreateGlobalPrivilege 1296 vbc.exe Token: 33 1296 vbc.exe Token: 34 1296 vbc.exe Token: 35 1296 vbc.exe Token: 36 1296 vbc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vbc.exepid process 1296 vbc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Purchase Order 461.exedescription pid process target process PID 632 wrote to memory of 1296 632 Purchase Order 461.exe vbc.exe PID 632 wrote to memory of 1296 632 Purchase Order 461.exe vbc.exe PID 632 wrote to memory of 1296 632 Purchase Order 461.exe vbc.exe PID 632 wrote to memory of 1296 632 Purchase Order 461.exe vbc.exe PID 632 wrote to memory of 1296 632 Purchase Order 461.exe vbc.exe PID 632 wrote to memory of 1296 632 Purchase Order 461.exe vbc.exe PID 632 wrote to memory of 1296 632 Purchase Order 461.exe vbc.exe PID 632 wrote to memory of 1296 632 Purchase Order 461.exe vbc.exe PID 632 wrote to memory of 1296 632 Purchase Order 461.exe vbc.exe PID 632 wrote to memory of 1296 632 Purchase Order 461.exe vbc.exe PID 632 wrote to memory of 1296 632 Purchase Order 461.exe vbc.exe PID 632 wrote to memory of 1296 632 Purchase Order 461.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order 461.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order 461.exe"1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/632-114-0x0000000000990000-0x0000000000DE0000-memory.dmpFilesize
4.3MB
-
memory/632-115-0x00000000051E0000-0x00000000051E1000-memory.dmpFilesize
4KB
-
memory/1296-116-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1296-117-0x000000000048F888-mapping.dmp
-
memory/1296-118-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1296-119-0x0000000000790000-0x0000000000791000-memory.dmpFilesize
4KB