Analysis
-
max time kernel
151s -
max time network
103s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
21-09-2021 08:37
Behavioral task
behavioral1
Sample
5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe
Resource
win7-en-20210920
General
-
Target
5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe
-
Size
659KB
-
MD5
1d9b720db2f4e23c3502f1456f09b927
-
SHA1
a68034b6084112066cc02565dd519a23757c1b15
-
SHA256
5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1
-
SHA512
39cf1a7b5d12dfb19439676e9d692cc4536cd04c22872ef67370759e34dfba805e52c38ee0a58420b265aa29d8c91c563936e9be90fd578fe2418cb3c389c3d1
Malware Config
Extracted
darkcomet
Sazan
8.tcp.ngrok.io:13738
DC_MUTEX-RYGMJ3G
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
1rG7r70RosbW
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\MSDCSC\\msdcsc.exe" 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" msdcsc.exe -
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 4976 msdcsc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\MSDCSC\\msdcsc.exe" 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe -
Drops file in Windows directory 3 IoCs
Processes:
5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exedescription ioc process File created C:\Windows\MSDCSC\msdcsc.exe 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe File opened for modification C:\Windows\MSDCSC\msdcsc.exe 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe File opened for modification C:\Windows\MSDCSC\ 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe Token: SeSecurityPrivilege 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe Token: SeTakeOwnershipPrivilege 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe Token: SeLoadDriverPrivilege 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe Token: SeSystemProfilePrivilege 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe Token: SeSystemtimePrivilege 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe Token: SeProfSingleProcessPrivilege 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe Token: SeIncBasePriorityPrivilege 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe Token: SeCreatePagefilePrivilege 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe Token: SeBackupPrivilege 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe Token: SeRestorePrivilege 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe Token: SeShutdownPrivilege 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe Token: SeDebugPrivilege 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe Token: SeSystemEnvironmentPrivilege 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe Token: SeChangeNotifyPrivilege 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe Token: SeRemoteShutdownPrivilege 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe Token: SeUndockPrivilege 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe Token: SeManageVolumePrivilege 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe Token: SeImpersonatePrivilege 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe Token: SeCreateGlobalPrivilege 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe Token: 33 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe Token: 34 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe Token: 35 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe Token: 36 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe Token: SeIncreaseQuotaPrivilege 4976 msdcsc.exe Token: SeSecurityPrivilege 4976 msdcsc.exe Token: SeTakeOwnershipPrivilege 4976 msdcsc.exe Token: SeLoadDriverPrivilege 4976 msdcsc.exe Token: SeSystemProfilePrivilege 4976 msdcsc.exe Token: SeSystemtimePrivilege 4976 msdcsc.exe Token: SeProfSingleProcessPrivilege 4976 msdcsc.exe Token: SeIncBasePriorityPrivilege 4976 msdcsc.exe Token: SeCreatePagefilePrivilege 4976 msdcsc.exe Token: SeBackupPrivilege 4976 msdcsc.exe Token: SeRestorePrivilege 4976 msdcsc.exe Token: SeShutdownPrivilege 4976 msdcsc.exe Token: SeDebugPrivilege 4976 msdcsc.exe Token: SeSystemEnvironmentPrivilege 4976 msdcsc.exe Token: SeChangeNotifyPrivilege 4976 msdcsc.exe Token: SeRemoteShutdownPrivilege 4976 msdcsc.exe Token: SeUndockPrivilege 4976 msdcsc.exe Token: SeManageVolumePrivilege 4976 msdcsc.exe Token: SeImpersonatePrivilege 4976 msdcsc.exe Token: SeCreateGlobalPrivilege 4976 msdcsc.exe Token: 33 4976 msdcsc.exe Token: 34 4976 msdcsc.exe Token: 35 4976 msdcsc.exe Token: 36 4976 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 4976 msdcsc.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.execmd.execmd.exemsdcsc.exedescription pid process target process PID 4796 wrote to memory of 4844 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe cmd.exe PID 4796 wrote to memory of 4844 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe cmd.exe PID 4796 wrote to memory of 4844 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe cmd.exe PID 4796 wrote to memory of 4856 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe cmd.exe PID 4796 wrote to memory of 4856 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe cmd.exe PID 4796 wrote to memory of 4856 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe cmd.exe PID 4844 wrote to memory of 4932 4844 cmd.exe attrib.exe PID 4844 wrote to memory of 4932 4844 cmd.exe attrib.exe PID 4844 wrote to memory of 4932 4844 cmd.exe attrib.exe PID 4856 wrote to memory of 4944 4856 cmd.exe attrib.exe PID 4856 wrote to memory of 4944 4856 cmd.exe attrib.exe PID 4856 wrote to memory of 4944 4856 cmd.exe attrib.exe PID 4796 wrote to memory of 4976 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe msdcsc.exe PID 4796 wrote to memory of 4976 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe msdcsc.exe PID 4796 wrote to memory of 4976 4796 5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe msdcsc.exe PID 4976 wrote to memory of 5012 4976 msdcsc.exe notepad.exe PID 4976 wrote to memory of 5012 4976 msdcsc.exe notepad.exe PID 4976 wrote to memory of 5012 4976 msdcsc.exe notepad.exe PID 4976 wrote to memory of 5012 4976 msdcsc.exe notepad.exe PID 4976 wrote to memory of 5012 4976 msdcsc.exe notepad.exe PID 4976 wrote to memory of 5012 4976 msdcsc.exe notepad.exe PID 4976 wrote to memory of 5012 4976 msdcsc.exe notepad.exe PID 4976 wrote to memory of 5012 4976 msdcsc.exe notepad.exe PID 4976 wrote to memory of 5012 4976 msdcsc.exe notepad.exe PID 4976 wrote to memory of 5012 4976 msdcsc.exe notepad.exe PID 4976 wrote to memory of 5012 4976 msdcsc.exe notepad.exe PID 4976 wrote to memory of 5012 4976 msdcsc.exe notepad.exe PID 4976 wrote to memory of 5012 4976 msdcsc.exe notepad.exe PID 4976 wrote to memory of 5012 4976 msdcsc.exe notepad.exe PID 4976 wrote to memory of 5012 4976 msdcsc.exe notepad.exe PID 4976 wrote to memory of 5012 4976 msdcsc.exe notepad.exe PID 4976 wrote to memory of 5012 4976 msdcsc.exe notepad.exe PID 4976 wrote to memory of 5012 4976 msdcsc.exe notepad.exe PID 4976 wrote to memory of 5012 4976 msdcsc.exe notepad.exe PID 4976 wrote to memory of 5012 4976 msdcsc.exe notepad.exe PID 4976 wrote to memory of 5012 4976 msdcsc.exe notepad.exe PID 4976 wrote to memory of 5012 4976 msdcsc.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 4932 attrib.exe 4944 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe"C:\Users\Admin\AppData\Local\Temp\5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\5a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1.exe" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\MSDCSC\msdcsc.exe"C:\Windows\MSDCSC\msdcsc.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\MSDCSC\msdcsc.exeMD5
1d9b720db2f4e23c3502f1456f09b927
SHA1a68034b6084112066cc02565dd519a23757c1b15
SHA2565a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1
SHA51239cf1a7b5d12dfb19439676e9d692cc4536cd04c22872ef67370759e34dfba805e52c38ee0a58420b265aa29d8c91c563936e9be90fd578fe2418cb3c389c3d1
-
C:\Windows\MSDCSC\msdcsc.exeMD5
1d9b720db2f4e23c3502f1456f09b927
SHA1a68034b6084112066cc02565dd519a23757c1b15
SHA2565a1c8ef15cccd50082c6862f1df8fccc40cfa7b94e7710caaf60751c714c6cb1
SHA51239cf1a7b5d12dfb19439676e9d692cc4536cd04c22872ef67370759e34dfba805e52c38ee0a58420b265aa29d8c91c563936e9be90fd578fe2418cb3c389c3d1
-
memory/4796-114-0x0000000000750000-0x0000000000751000-memory.dmpFilesize
4KB
-
memory/4844-115-0x0000000000000000-mapping.dmp
-
memory/4856-116-0x0000000000000000-mapping.dmp
-
memory/4932-117-0x0000000000000000-mapping.dmp
-
memory/4944-118-0x0000000000000000-mapping.dmp
-
memory/4976-119-0x0000000000000000-mapping.dmp
-
memory/4976-122-0x0000000002230000-0x0000000002231000-memory.dmpFilesize
4KB
-
memory/5012-123-0x0000000000000000-mapping.dmp
-
memory/5012-124-0x0000000000980000-0x0000000000981000-memory.dmpFilesize
4KB