Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
02-05-2022 03:43
Static task
static1
Behavioral task
behavioral1
Sample
9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe
Resource
win10v2004-20220414-en
General
-
Target
9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe
-
Size
1.5MB
-
MD5
01f1ae0432dc9cef9393df121d512502
-
SHA1
b1ee440d433494c89ca3a6cb6a4326f02af6c734
-
SHA256
9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a
-
SHA512
8670a8fd8b0ea6468bf34bdbe9da07d5b5036f2530fb74ab447c4277caf2b1feb086a076f92749f5fad36d2b76991bd6de2f541d75dbddc0492ff656fbeeaeeb
Malware Config
Extracted
darkcomet
1
anthraxgold.no-ip.info:666
DC_MUTEX-169BEXQ
-
gencode
M6QvjZgri1v2
-
install
false
-
offline_keylogger
false
-
persistence
false
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
test.exetest.exetest.exepid process 760 test.exe 940 test.exe 1320 test.exe -
Processes:
resource yara_rule behavioral1/memory/872-66-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/872-68-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/872-69-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/872-72-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/872-73-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/872-76-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1320-109-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1320-113-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1320-114-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1320-117-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1320-120-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1320-121-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1320-122-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Loads dropped DLL 5 IoCs
Processes:
9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exepid process 872 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe 872 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe 872 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe 872 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe 872 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\test\\test.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exetest.exedescription pid process target process PID 1260 set thread context of 872 1260 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe PID 760 set thread context of 940 760 test.exe test.exe PID 760 set thread context of 1320 760 test.exe test.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
test.exedescription pid process Token: SeIncreaseQuotaPrivilege 1320 test.exe Token: SeSecurityPrivilege 1320 test.exe Token: SeTakeOwnershipPrivilege 1320 test.exe Token: SeLoadDriverPrivilege 1320 test.exe Token: SeSystemProfilePrivilege 1320 test.exe Token: SeSystemtimePrivilege 1320 test.exe Token: SeProfSingleProcessPrivilege 1320 test.exe Token: SeIncBasePriorityPrivilege 1320 test.exe Token: SeCreatePagefilePrivilege 1320 test.exe Token: SeBackupPrivilege 1320 test.exe Token: SeRestorePrivilege 1320 test.exe Token: SeShutdownPrivilege 1320 test.exe Token: SeDebugPrivilege 1320 test.exe Token: SeSystemEnvironmentPrivilege 1320 test.exe Token: SeChangeNotifyPrivilege 1320 test.exe Token: SeRemoteShutdownPrivilege 1320 test.exe Token: SeUndockPrivilege 1320 test.exe Token: SeManageVolumePrivilege 1320 test.exe Token: SeImpersonatePrivilege 1320 test.exe Token: SeCreateGlobalPrivilege 1320 test.exe Token: 33 1320 test.exe Token: 34 1320 test.exe Token: 35 1320 test.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exetest.exepid process 1260 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe 872 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe 760 test.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.execmd.exetest.exedescription pid process target process PID 1260 wrote to memory of 872 1260 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe PID 1260 wrote to memory of 872 1260 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe PID 1260 wrote to memory of 872 1260 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe PID 1260 wrote to memory of 872 1260 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe PID 1260 wrote to memory of 872 1260 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe PID 1260 wrote to memory of 872 1260 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe PID 1260 wrote to memory of 872 1260 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe PID 1260 wrote to memory of 872 1260 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe PID 872 wrote to memory of 2004 872 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe cmd.exe PID 872 wrote to memory of 2004 872 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe cmd.exe PID 872 wrote to memory of 2004 872 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe cmd.exe PID 872 wrote to memory of 2004 872 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe cmd.exe PID 2004 wrote to memory of 1948 2004 cmd.exe reg.exe PID 2004 wrote to memory of 1948 2004 cmd.exe reg.exe PID 2004 wrote to memory of 1948 2004 cmd.exe reg.exe PID 2004 wrote to memory of 1948 2004 cmd.exe reg.exe PID 872 wrote to memory of 760 872 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe test.exe PID 872 wrote to memory of 760 872 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe test.exe PID 872 wrote to memory of 760 872 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe test.exe PID 872 wrote to memory of 760 872 9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe test.exe PID 760 wrote to memory of 940 760 test.exe test.exe PID 760 wrote to memory of 940 760 test.exe test.exe PID 760 wrote to memory of 940 760 test.exe test.exe PID 760 wrote to memory of 940 760 test.exe test.exe PID 760 wrote to memory of 940 760 test.exe test.exe PID 760 wrote to memory of 940 760 test.exe test.exe PID 760 wrote to memory of 940 760 test.exe test.exe PID 760 wrote to memory of 940 760 test.exe test.exe PID 760 wrote to memory of 1320 760 test.exe test.exe PID 760 wrote to memory of 1320 760 test.exe test.exe PID 760 wrote to memory of 1320 760 test.exe test.exe PID 760 wrote to memory of 1320 760 test.exe test.exe PID 760 wrote to memory of 1320 760 test.exe test.exe PID 760 wrote to memory of 1320 760 test.exe test.exe PID 760 wrote to memory of 1320 760 test.exe test.exe PID 760 wrote to memory of 1320 760 test.exe test.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe"C:\Users\Admin\AppData\Local\Temp\9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe"C:\Users\Admin\AppData\Local\Temp\9d455a303a7e616dd2a20a9f3ff2b406862c24701977e35fe87cb5e061dbb23a.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\XNOMU.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svchost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\test\test.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\test\test.exe"C:\Users\Admin\AppData\Roaming\test\test.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\XNOMU.batFilesize
138B
MD5527683c48cc4c7190219814c77b72fe0
SHA1d995878a8f4b9824a0508039eeada5376be9a52d
SHA256bbebf3e66136e700d8e3e2e0c8f461cdd9d7e68fe5a18a235afe86344932fb4b
SHA512408a53b240c23fa34153ccc2b2315f28a9741121ecc9b76d50267ee62d78230e65574327369f83c779c781802c0c28f6c578703c01a67de46c3d44f71b814fa6
-
C:\Users\Admin\AppData\Roaming\test\test.exeFilesize
1.5MB
MD5b3f203a866605026b31927a449bd358d
SHA1e7b76fb5329fd32f2a4c9ba7a967e0546b1a230f
SHA256d9588f45156dda00608b8ca4bb1b6bdc270acce6ea58f63c0e3482aee8fff4d0
SHA512108a820203ca697592dd63bf0570a06718e93d78b32f467978ba8b5850f4a1eded62d3047d2d6287f3591b88722a6439f405b47aabbd1a56c82e6d2c76d57c3e
-
C:\Users\Admin\AppData\Roaming\test\test.exeFilesize
1.5MB
MD5b3f203a866605026b31927a449bd358d
SHA1e7b76fb5329fd32f2a4c9ba7a967e0546b1a230f
SHA256d9588f45156dda00608b8ca4bb1b6bdc270acce6ea58f63c0e3482aee8fff4d0
SHA512108a820203ca697592dd63bf0570a06718e93d78b32f467978ba8b5850f4a1eded62d3047d2d6287f3591b88722a6439f405b47aabbd1a56c82e6d2c76d57c3e
-
C:\Users\Admin\AppData\Roaming\test\test.exeFilesize
1.5MB
MD5b3f203a866605026b31927a449bd358d
SHA1e7b76fb5329fd32f2a4c9ba7a967e0546b1a230f
SHA256d9588f45156dda00608b8ca4bb1b6bdc270acce6ea58f63c0e3482aee8fff4d0
SHA512108a820203ca697592dd63bf0570a06718e93d78b32f467978ba8b5850f4a1eded62d3047d2d6287f3591b88722a6439f405b47aabbd1a56c82e6d2c76d57c3e
-
C:\Users\Admin\AppData\Roaming\test\test.exeFilesize
1.5MB
MD5b3f203a866605026b31927a449bd358d
SHA1e7b76fb5329fd32f2a4c9ba7a967e0546b1a230f
SHA256d9588f45156dda00608b8ca4bb1b6bdc270acce6ea58f63c0e3482aee8fff4d0
SHA512108a820203ca697592dd63bf0570a06718e93d78b32f467978ba8b5850f4a1eded62d3047d2d6287f3591b88722a6439f405b47aabbd1a56c82e6d2c76d57c3e
-
\Users\Admin\AppData\Roaming\test\test.exeFilesize
1.5MB
MD5b3f203a866605026b31927a449bd358d
SHA1e7b76fb5329fd32f2a4c9ba7a967e0546b1a230f
SHA256d9588f45156dda00608b8ca4bb1b6bdc270acce6ea58f63c0e3482aee8fff4d0
SHA512108a820203ca697592dd63bf0570a06718e93d78b32f467978ba8b5850f4a1eded62d3047d2d6287f3591b88722a6439f405b47aabbd1a56c82e6d2c76d57c3e
-
\Users\Admin\AppData\Roaming\test\test.exeFilesize
1.5MB
MD5b3f203a866605026b31927a449bd358d
SHA1e7b76fb5329fd32f2a4c9ba7a967e0546b1a230f
SHA256d9588f45156dda00608b8ca4bb1b6bdc270acce6ea58f63c0e3482aee8fff4d0
SHA512108a820203ca697592dd63bf0570a06718e93d78b32f467978ba8b5850f4a1eded62d3047d2d6287f3591b88722a6439f405b47aabbd1a56c82e6d2c76d57c3e
-
\Users\Admin\AppData\Roaming\test\test.exeFilesize
1.5MB
MD5b3f203a866605026b31927a449bd358d
SHA1e7b76fb5329fd32f2a4c9ba7a967e0546b1a230f
SHA256d9588f45156dda00608b8ca4bb1b6bdc270acce6ea58f63c0e3482aee8fff4d0
SHA512108a820203ca697592dd63bf0570a06718e93d78b32f467978ba8b5850f4a1eded62d3047d2d6287f3591b88722a6439f405b47aabbd1a56c82e6d2c76d57c3e
-
\Users\Admin\AppData\Roaming\test\test.exeFilesize
1.5MB
MD5b3f203a866605026b31927a449bd358d
SHA1e7b76fb5329fd32f2a4c9ba7a967e0546b1a230f
SHA256d9588f45156dda00608b8ca4bb1b6bdc270acce6ea58f63c0e3482aee8fff4d0
SHA512108a820203ca697592dd63bf0570a06718e93d78b32f467978ba8b5850f4a1eded62d3047d2d6287f3591b88722a6439f405b47aabbd1a56c82e6d2c76d57c3e
-
\Users\Admin\AppData\Roaming\test\test.exeFilesize
1.5MB
MD5b3f203a866605026b31927a449bd358d
SHA1e7b76fb5329fd32f2a4c9ba7a967e0546b1a230f
SHA256d9588f45156dda00608b8ca4bb1b6bdc270acce6ea58f63c0e3482aee8fff4d0
SHA512108a820203ca697592dd63bf0570a06718e93d78b32f467978ba8b5850f4a1eded62d3047d2d6287f3591b88722a6439f405b47aabbd1a56c82e6d2c76d57c3e
-
memory/760-86-0x0000000000000000-mapping.dmp
-
memory/872-73-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/872-65-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/872-72-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/872-66-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/872-76-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/872-77-0x0000000075CE1000-0x0000000075CE3000-memory.dmpFilesize
8KB
-
memory/872-68-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/872-69-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/872-70-0x00000000004085D0-mapping.dmp
-
memory/940-105-0x00000000004085D0-mapping.dmp
-
memory/1260-54-0x0000000000400000-0x000000000054B000-memory.dmpFilesize
1.3MB
-
memory/1260-62-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1260-57-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1260-63-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1260-58-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1260-64-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1260-61-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1260-60-0x0000000000401000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/1320-114-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1320-107-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1320-109-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1320-113-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1320-117-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1320-115-0x00000000004B5640-mapping.dmp
-
memory/1320-120-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1320-121-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1320-122-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1948-80-0x0000000000000000-mapping.dmp
-
memory/2004-78-0x0000000000000000-mapping.dmp