Analysis
-
max time kernel
359s -
max time network
363s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
25-02-2022 03:09
Static task
static1
Behavioral task
behavioral1
Sample
a.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
a.exe
Resource
win10v2004-en-20220113
General
-
Target
a.exe
-
Size
1.5MB
-
MD5
7264b8eb7076a2b78617e0e38058d0f3
-
SHA1
03cd675e664f434773d9c069c0a59b428cd1bedc
-
SHA256
728418b13e48aacdb925ae8b891e0f0a35ec8482c92f65fefe8bd4ab890224d2
-
SHA512
47f1d0fef411ab7fcc587b1fad1b143c69dc0723ff58f7d0d8f9d29efe2bcc8ca016b6536996a2a3bc7af2b49a378c68d03876962d5a84eea01c0f119a0643e1
Malware Config
Extracted
darkcomet
Sazan
akordion.duckdns.org:1604
DC_MUTEX-CADHQZA
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
344KSen6NjLL
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" vbc.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 1304 msdcsc.exe -
Loads dropped DLL 1 IoCs
Processes:
vbc.exepid process 1588 vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
a.exevbc.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\DelhiBrosBP = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a.exe" a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" vbc.exe -
Drops file in System32 directory 1 IoCs
Processes:
taskmgr.exedescription ioc process File opened for modification C:\Windows\SysWOW64\cmd.exe taskmgr.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a.exedescription pid process target process PID 1636 set thread context of 1588 1636 a.exe vbc.exe -
Drops file in Windows directory 2 IoCs
Processes:
attrib.exeattrib.exedescription ioc process File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe attrib.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319 attrib.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid process 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 452 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
Processes:
vbc.exetaskmgr.exedescription pid process Token: SeIncreaseQuotaPrivilege 1588 vbc.exe Token: SeSecurityPrivilege 1588 vbc.exe Token: SeTakeOwnershipPrivilege 1588 vbc.exe Token: SeLoadDriverPrivilege 1588 vbc.exe Token: SeSystemProfilePrivilege 1588 vbc.exe Token: SeSystemtimePrivilege 1588 vbc.exe Token: SeProfSingleProcessPrivilege 1588 vbc.exe Token: SeIncBasePriorityPrivilege 1588 vbc.exe Token: SeCreatePagefilePrivilege 1588 vbc.exe Token: SeBackupPrivilege 1588 vbc.exe Token: SeRestorePrivilege 1588 vbc.exe Token: SeShutdownPrivilege 1588 vbc.exe Token: SeDebugPrivilege 1588 vbc.exe Token: SeSystemEnvironmentPrivilege 1588 vbc.exe Token: SeChangeNotifyPrivilege 1588 vbc.exe Token: SeRemoteShutdownPrivilege 1588 vbc.exe Token: SeUndockPrivilege 1588 vbc.exe Token: SeManageVolumePrivilege 1588 vbc.exe Token: SeImpersonatePrivilege 1588 vbc.exe Token: SeCreateGlobalPrivilege 1588 vbc.exe Token: 33 1588 vbc.exe Token: 34 1588 vbc.exe Token: 35 1588 vbc.exe Token: SeDebugPrivilege 452 taskmgr.exe Token: SeShutdownPrivilege 452 taskmgr.exe Token: SeSecurityPrivilege 452 taskmgr.exe Token: SeTakeOwnershipPrivilege 452 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
a.exetaskmgr.exepid process 1636 a.exe 1636 a.exe 1636 a.exe 1636 a.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
a.exetaskmgr.exepid process 1636 a.exe 1636 a.exe 1636 a.exe 1636 a.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe 452 taskmgr.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
a.exevbc.execmd.execmd.exedescription pid process target process PID 1636 wrote to memory of 1588 1636 a.exe vbc.exe PID 1636 wrote to memory of 1588 1636 a.exe vbc.exe PID 1636 wrote to memory of 1588 1636 a.exe vbc.exe PID 1636 wrote to memory of 1588 1636 a.exe vbc.exe PID 1636 wrote to memory of 1588 1636 a.exe vbc.exe PID 1636 wrote to memory of 1588 1636 a.exe vbc.exe PID 1636 wrote to memory of 1588 1636 a.exe vbc.exe PID 1636 wrote to memory of 1588 1636 a.exe vbc.exe PID 1636 wrote to memory of 1588 1636 a.exe vbc.exe PID 1636 wrote to memory of 1588 1636 a.exe vbc.exe PID 1636 wrote to memory of 1588 1636 a.exe vbc.exe PID 1636 wrote to memory of 1588 1636 a.exe vbc.exe PID 1636 wrote to memory of 1588 1636 a.exe vbc.exe PID 1588 wrote to memory of 1720 1588 vbc.exe cmd.exe PID 1588 wrote to memory of 1720 1588 vbc.exe cmd.exe PID 1588 wrote to memory of 1720 1588 vbc.exe cmd.exe PID 1588 wrote to memory of 1720 1588 vbc.exe cmd.exe PID 1588 wrote to memory of 1884 1588 vbc.exe cmd.exe PID 1588 wrote to memory of 1884 1588 vbc.exe cmd.exe PID 1588 wrote to memory of 1884 1588 vbc.exe cmd.exe PID 1588 wrote to memory of 1884 1588 vbc.exe cmd.exe PID 1720 wrote to memory of 1920 1720 cmd.exe attrib.exe PID 1720 wrote to memory of 1920 1720 cmd.exe attrib.exe PID 1720 wrote to memory of 1920 1720 cmd.exe attrib.exe PID 1720 wrote to memory of 1920 1720 cmd.exe attrib.exe PID 1884 wrote to memory of 1740 1884 cmd.exe attrib.exe PID 1884 wrote to memory of 1740 1884 cmd.exe attrib.exe PID 1884 wrote to memory of 1740 1884 cmd.exe attrib.exe PID 1884 wrote to memory of 1740 1884 cmd.exe attrib.exe PID 1588 wrote to memory of 1304 1588 vbc.exe msdcsc.exe PID 1588 wrote to memory of 1304 1588 vbc.exe msdcsc.exe PID 1588 wrote to memory of 1304 1588 vbc.exe msdcsc.exe PID 1588 wrote to memory of 1304 1588 vbc.exe msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1920 attrib.exe 1740 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a.exe"C:\Users\Admin\AppData\Local\Temp\a.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" +s +h4⤵
- Drops file in Windows directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v4.0.30319" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v4.0.30319" +s +h4⤵
- Drops file in Windows directory
- Views/modifies file attributes
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
1f7bccc57d21a4bfeddaafe514cfd74d
SHA14dab09179a12468cb1757cb7ca26e06d616b0a8d
SHA256d4cb7377e8275ed47e499ab0d7ee47167829a5931ba41aa5790593595a7e1061
SHA5129e639c777dc2d456f038c14efb7cbc871ceb1d7380a74d18fb722a28901357ccb1166c0d883562280e030f0252004ca13a1371ea480d0523c435cd0a6d9f43d8
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
1f7bccc57d21a4bfeddaafe514cfd74d
SHA14dab09179a12468cb1757cb7ca26e06d616b0a8d
SHA256d4cb7377e8275ed47e499ab0d7ee47167829a5931ba41aa5790593595a7e1061
SHA5129e639c777dc2d456f038c14efb7cbc871ceb1d7380a74d18fb722a28901357ccb1166c0d883562280e030f0252004ca13a1371ea480d0523c435cd0a6d9f43d8
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeMD5
1f7bccc57d21a4bfeddaafe514cfd74d
SHA14dab09179a12468cb1757cb7ca26e06d616b0a8d
SHA256d4cb7377e8275ed47e499ab0d7ee47167829a5931ba41aa5790593595a7e1061
SHA5129e639c777dc2d456f038c14efb7cbc871ceb1d7380a74d18fb722a28901357ccb1166c0d883562280e030f0252004ca13a1371ea480d0523c435cd0a6d9f43d8
-
memory/452-68-0x000007FEFC2D1000-0x000007FEFC2D3000-memory.dmpFilesize
8KB
-
memory/1588-59-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1588-60-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1588-61-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1588-62-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1588-63-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1588-64-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1588-66-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1588-67-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/1588-58-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1588-57-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1588-56-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1636-55-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB