Analysis
-
max time kernel
151s -
max time network
111s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
29-09-2021 08:06
Behavioral task
behavioral1
Sample
f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe
Resource
win7v20210408
General
-
Target
f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe
-
Size
756KB
-
MD5
50b53927892abfe41b08d0c6311c1a39
-
SHA1
b43e1fec005c39a1a0b1ab31616522906fe4ba84
-
SHA256
f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda
-
SHA512
e980a91d6a91f5a20eebf0a7ba7f7e2d1fe5748f73309cd2695bceb0b92b84208667e9c842a01d0606b76c4831cae3be2e13502d7ed80ff5b910f9ec3a4b41f4
Malware Config
Extracted
darkcomet
Guest16
127.0.0.1:1604
DC_MUTEX-0UX76EM
-
InstallPath
explorer\explorer.exe
-
gencode
oxFTG57Sq0Jl
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\explorer\\explorer.exe" f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" explorer.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" explorer.exe -
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
Processes:
explorer.exepid process 1728 explorer.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 3992 notepad.exe -
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exeexplorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\explorer\\explorer.exe" f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\explorer\\explorer.exe" explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1728 explorer.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exeexplorer.exedescription pid process Token: SeIncreaseQuotaPrivilege 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe Token: SeSecurityPrivilege 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe Token: SeTakeOwnershipPrivilege 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe Token: SeLoadDriverPrivilege 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe Token: SeSystemProfilePrivilege 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe Token: SeSystemtimePrivilege 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe Token: SeProfSingleProcessPrivilege 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe Token: SeIncBasePriorityPrivilege 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe Token: SeCreatePagefilePrivilege 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe Token: SeBackupPrivilege 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe Token: SeRestorePrivilege 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe Token: SeShutdownPrivilege 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe Token: SeDebugPrivilege 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe Token: SeSystemEnvironmentPrivilege 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe Token: SeChangeNotifyPrivilege 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe Token: SeRemoteShutdownPrivilege 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe Token: SeUndockPrivilege 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe Token: SeManageVolumePrivilege 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe Token: SeImpersonatePrivilege 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe Token: SeCreateGlobalPrivilege 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe Token: 33 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe Token: 34 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe Token: 35 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe Token: 36 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe Token: SeIncreaseQuotaPrivilege 1728 explorer.exe Token: SeSecurityPrivilege 1728 explorer.exe Token: SeTakeOwnershipPrivilege 1728 explorer.exe Token: SeLoadDriverPrivilege 1728 explorer.exe Token: SeSystemProfilePrivilege 1728 explorer.exe Token: SeSystemtimePrivilege 1728 explorer.exe Token: SeProfSingleProcessPrivilege 1728 explorer.exe Token: SeIncBasePriorityPrivilege 1728 explorer.exe Token: SeCreatePagefilePrivilege 1728 explorer.exe Token: SeBackupPrivilege 1728 explorer.exe Token: SeRestorePrivilege 1728 explorer.exe Token: SeShutdownPrivilege 1728 explorer.exe Token: SeDebugPrivilege 1728 explorer.exe Token: SeSystemEnvironmentPrivilege 1728 explorer.exe Token: SeChangeNotifyPrivilege 1728 explorer.exe Token: SeRemoteShutdownPrivilege 1728 explorer.exe Token: SeUndockPrivilege 1728 explorer.exe Token: SeManageVolumePrivilege 1728 explorer.exe Token: SeImpersonatePrivilege 1728 explorer.exe Token: SeCreateGlobalPrivilege 1728 explorer.exe Token: 33 1728 explorer.exe Token: 34 1728 explorer.exe Token: 35 1728 explorer.exe Token: 36 1728 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
explorer.exepid process 1728 explorer.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.execmd.execmd.exeexplorer.exedescription pid process target process PID 652 wrote to memory of 1164 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe cmd.exe PID 652 wrote to memory of 1164 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe cmd.exe PID 652 wrote to memory of 1164 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe cmd.exe PID 652 wrote to memory of 508 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe cmd.exe PID 652 wrote to memory of 508 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe cmd.exe PID 652 wrote to memory of 508 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe cmd.exe PID 652 wrote to memory of 3992 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe notepad.exe PID 652 wrote to memory of 3992 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe notepad.exe PID 652 wrote to memory of 3992 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe notepad.exe PID 652 wrote to memory of 3992 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe notepad.exe PID 652 wrote to memory of 3992 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe notepad.exe PID 652 wrote to memory of 3992 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe notepad.exe PID 652 wrote to memory of 3992 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe notepad.exe PID 652 wrote to memory of 3992 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe notepad.exe PID 652 wrote to memory of 3992 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe notepad.exe PID 652 wrote to memory of 3992 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe notepad.exe PID 652 wrote to memory of 3992 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe notepad.exe PID 652 wrote to memory of 3992 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe notepad.exe PID 652 wrote to memory of 3992 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe notepad.exe PID 652 wrote to memory of 3992 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe notepad.exe PID 652 wrote to memory of 3992 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe notepad.exe PID 652 wrote to memory of 3992 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe notepad.exe PID 652 wrote to memory of 3992 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe notepad.exe PID 1164 wrote to memory of 696 1164 cmd.exe attrib.exe PID 1164 wrote to memory of 696 1164 cmd.exe attrib.exe PID 1164 wrote to memory of 696 1164 cmd.exe attrib.exe PID 508 wrote to memory of 960 508 cmd.exe attrib.exe PID 508 wrote to memory of 960 508 cmd.exe attrib.exe PID 508 wrote to memory of 960 508 cmd.exe attrib.exe PID 652 wrote to memory of 1728 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe explorer.exe PID 652 wrote to memory of 1728 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe explorer.exe PID 652 wrote to memory of 1728 652 f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe explorer.exe PID 1728 wrote to memory of 3004 1728 explorer.exe notepad.exe PID 1728 wrote to memory of 3004 1728 explorer.exe notepad.exe PID 1728 wrote to memory of 3004 1728 explorer.exe notepad.exe PID 1728 wrote to memory of 3004 1728 explorer.exe notepad.exe PID 1728 wrote to memory of 3004 1728 explorer.exe notepad.exe PID 1728 wrote to memory of 3004 1728 explorer.exe notepad.exe PID 1728 wrote to memory of 3004 1728 explorer.exe notepad.exe PID 1728 wrote to memory of 3004 1728 explorer.exe notepad.exe PID 1728 wrote to memory of 3004 1728 explorer.exe notepad.exe PID 1728 wrote to memory of 3004 1728 explorer.exe notepad.exe PID 1728 wrote to memory of 3004 1728 explorer.exe notepad.exe PID 1728 wrote to memory of 3004 1728 explorer.exe notepad.exe PID 1728 wrote to memory of 3004 1728 explorer.exe notepad.exe PID 1728 wrote to memory of 3004 1728 explorer.exe notepad.exe PID 1728 wrote to memory of 3004 1728 explorer.exe notepad.exe PID 1728 wrote to memory of 3004 1728 explorer.exe notepad.exe PID 1728 wrote to memory of 3004 1728 explorer.exe notepad.exe PID 1728 wrote to memory of 3004 1728 explorer.exe notepad.exe PID 1728 wrote to memory of 3004 1728 explorer.exe notepad.exe PID 1728 wrote to memory of 3004 1728 explorer.exe notepad.exe PID 1728 wrote to memory of 3004 1728 explorer.exe notepad.exe PID 1728 wrote to memory of 3004 1728 explorer.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern explorer.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 696 attrib.exe 960 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe"C:\Users\Admin\AppData\Local\Temp\f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda.exe" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\Users\Admin\Documents\explorer\explorer.exe"C:\Users\Admin\Documents\explorer\explorer.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\explorer\explorer.exeMD5
50b53927892abfe41b08d0c6311c1a39
SHA1b43e1fec005c39a1a0b1ab31616522906fe4ba84
SHA256f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda
SHA512e980a91d6a91f5a20eebf0a7ba7f7e2d1fe5748f73309cd2695bceb0b92b84208667e9c842a01d0606b76c4831cae3be2e13502d7ed80ff5b910f9ec3a4b41f4
-
C:\Users\Admin\Documents\explorer\explorer.exeMD5
50b53927892abfe41b08d0c6311c1a39
SHA1b43e1fec005c39a1a0b1ab31616522906fe4ba84
SHA256f20bcc23430a216c14e45207e84ca8cd819049af8d427e6a3ab38255c1fa8dda
SHA512e980a91d6a91f5a20eebf0a7ba7f7e2d1fe5748f73309cd2695bceb0b92b84208667e9c842a01d0606b76c4831cae3be2e13502d7ed80ff5b910f9ec3a4b41f4
-
memory/508-116-0x0000000000000000-mapping.dmp
-
memory/652-114-0x0000000002230000-0x0000000002231000-memory.dmpFilesize
4KB
-
memory/696-118-0x0000000000000000-mapping.dmp
-
memory/960-119-0x0000000000000000-mapping.dmp
-
memory/1164-115-0x0000000000000000-mapping.dmp
-
memory/1728-125-0x0000000002110000-0x0000000002111000-memory.dmpFilesize
4KB
-
memory/1728-121-0x0000000000000000-mapping.dmp
-
memory/3004-126-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/3004-124-0x0000000000000000-mapping.dmp
-
memory/3992-117-0x0000000000000000-mapping.dmp
-
memory/3992-120-0x0000000002E20000-0x0000000002E21000-memory.dmpFilesize
4KB