Analysis
-
max time kernel
150s -
max time network
171s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 22:36
Behavioral task
behavioral1
Sample
4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe
Resource
win7-20220414-en
General
-
Target
4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe
-
Size
756KB
-
MD5
86498e5016ff2cb3f0a84f0e03612858
-
SHA1
4f35692e54c22730b0601a9c3048c7baadf57939
-
SHA256
4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481
-
SHA512
fbe48fb5e8d351a80363dc0de57d970cabed1228e20560df4cd02d75c42b219a70d46057af9c581fcb364751cca315d866b8fcfe46630be72c49e8aecf46453f
Malware Config
Extracted
darkcomet
TacticG
192.168.1.113:1604
DC_MUTEX-H293GMA
-
InstallPath
windows\RealBoss.exe
-
gencode
kYG8AAeQRp04
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
RealBoss.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\windows\\RealBoss.exe" 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
Processes:
RealBoss.exepid process 1844 RealBoss.exe -
Loads dropped DLL 2 IoCs
Processes:
4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exepid process 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\RealBoss.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\windows\\RealBoss.exe" 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exeRealBoss.exedescription pid process Token: SeIncreaseQuotaPrivilege 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe Token: SeSecurityPrivilege 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe Token: SeTakeOwnershipPrivilege 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe Token: SeLoadDriverPrivilege 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe Token: SeSystemProfilePrivilege 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe Token: SeSystemtimePrivilege 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe Token: SeProfSingleProcessPrivilege 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe Token: SeIncBasePriorityPrivilege 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe Token: SeCreatePagefilePrivilege 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe Token: SeBackupPrivilege 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe Token: SeRestorePrivilege 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe Token: SeShutdownPrivilege 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe Token: SeDebugPrivilege 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe Token: SeSystemEnvironmentPrivilege 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe Token: SeChangeNotifyPrivilege 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe Token: SeRemoteShutdownPrivilege 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe Token: SeUndockPrivilege 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe Token: SeManageVolumePrivilege 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe Token: SeImpersonatePrivilege 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe Token: SeCreateGlobalPrivilege 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe Token: 33 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe Token: 34 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe Token: 35 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe Token: SeIncreaseQuotaPrivilege 1844 RealBoss.exe Token: SeSecurityPrivilege 1844 RealBoss.exe Token: SeTakeOwnershipPrivilege 1844 RealBoss.exe Token: SeLoadDriverPrivilege 1844 RealBoss.exe Token: SeSystemProfilePrivilege 1844 RealBoss.exe Token: SeSystemtimePrivilege 1844 RealBoss.exe Token: SeProfSingleProcessPrivilege 1844 RealBoss.exe Token: SeIncBasePriorityPrivilege 1844 RealBoss.exe Token: SeCreatePagefilePrivilege 1844 RealBoss.exe Token: SeBackupPrivilege 1844 RealBoss.exe Token: SeRestorePrivilege 1844 RealBoss.exe Token: SeShutdownPrivilege 1844 RealBoss.exe Token: SeDebugPrivilege 1844 RealBoss.exe Token: SeSystemEnvironmentPrivilege 1844 RealBoss.exe Token: SeChangeNotifyPrivilege 1844 RealBoss.exe Token: SeRemoteShutdownPrivilege 1844 RealBoss.exe Token: SeUndockPrivilege 1844 RealBoss.exe Token: SeManageVolumePrivilege 1844 RealBoss.exe Token: SeImpersonatePrivilege 1844 RealBoss.exe Token: SeCreateGlobalPrivilege 1844 RealBoss.exe Token: 33 1844 RealBoss.exe Token: 34 1844 RealBoss.exe Token: 35 1844 RealBoss.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RealBoss.exepid process 1844 RealBoss.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.execmd.execmd.exeRealBoss.exedescription pid process target process PID 1480 wrote to memory of 1584 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe cmd.exe PID 1480 wrote to memory of 1584 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe cmd.exe PID 1480 wrote to memory of 1584 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe cmd.exe PID 1480 wrote to memory of 1584 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe cmd.exe PID 1480 wrote to memory of 1608 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe cmd.exe PID 1480 wrote to memory of 1608 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe cmd.exe PID 1480 wrote to memory of 1608 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe cmd.exe PID 1480 wrote to memory of 1608 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe cmd.exe PID 1608 wrote to memory of 1392 1608 cmd.exe attrib.exe PID 1608 wrote to memory of 1392 1608 cmd.exe attrib.exe PID 1608 wrote to memory of 1392 1608 cmd.exe attrib.exe PID 1608 wrote to memory of 1392 1608 cmd.exe attrib.exe PID 1584 wrote to memory of 320 1584 cmd.exe attrib.exe PID 1584 wrote to memory of 320 1584 cmd.exe attrib.exe PID 1584 wrote to memory of 320 1584 cmd.exe attrib.exe PID 1584 wrote to memory of 320 1584 cmd.exe attrib.exe PID 1480 wrote to memory of 1844 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe RealBoss.exe PID 1480 wrote to memory of 1844 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe RealBoss.exe PID 1480 wrote to memory of 1844 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe RealBoss.exe PID 1480 wrote to memory of 1844 1480 4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe RealBoss.exe PID 1844 wrote to memory of 880 1844 RealBoss.exe notepad.exe PID 1844 wrote to memory of 880 1844 RealBoss.exe notepad.exe PID 1844 wrote to memory of 880 1844 RealBoss.exe notepad.exe PID 1844 wrote to memory of 880 1844 RealBoss.exe notepad.exe PID 1844 wrote to memory of 880 1844 RealBoss.exe notepad.exe PID 1844 wrote to memory of 880 1844 RealBoss.exe notepad.exe PID 1844 wrote to memory of 880 1844 RealBoss.exe notepad.exe PID 1844 wrote to memory of 880 1844 RealBoss.exe notepad.exe PID 1844 wrote to memory of 880 1844 RealBoss.exe notepad.exe PID 1844 wrote to memory of 880 1844 RealBoss.exe notepad.exe PID 1844 wrote to memory of 880 1844 RealBoss.exe notepad.exe PID 1844 wrote to memory of 880 1844 RealBoss.exe notepad.exe PID 1844 wrote to memory of 880 1844 RealBoss.exe notepad.exe PID 1844 wrote to memory of 880 1844 RealBoss.exe notepad.exe PID 1844 wrote to memory of 880 1844 RealBoss.exe notepad.exe PID 1844 wrote to memory of 880 1844 RealBoss.exe notepad.exe PID 1844 wrote to memory of 880 1844 RealBoss.exe notepad.exe PID 1844 wrote to memory of 880 1844 RealBoss.exe notepad.exe PID 1844 wrote to memory of 880 1844 RealBoss.exe notepad.exe PID 1844 wrote to memory of 880 1844 RealBoss.exe notepad.exe PID 1844 wrote to memory of 880 1844 RealBoss.exe notepad.exe PID 1844 wrote to memory of 880 1844 RealBoss.exe notepad.exe PID 1844 wrote to memory of 880 1844 RealBoss.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1392 attrib.exe 320 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe"C:\Users\Admin\AppData\Local\Temp\4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\4873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481.exe" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\windows\RealBoss.exe"C:\Users\Admin\AppData\Local\Temp\windows\RealBoss.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\windows\RealBoss.exeFilesize
756KB
MD586498e5016ff2cb3f0a84f0e03612858
SHA14f35692e54c22730b0601a9c3048c7baadf57939
SHA2564873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481
SHA512fbe48fb5e8d351a80363dc0de57d970cabed1228e20560df4cd02d75c42b219a70d46057af9c581fcb364751cca315d866b8fcfe46630be72c49e8aecf46453f
-
C:\Users\Admin\AppData\Local\Temp\windows\RealBoss.exeFilesize
756KB
MD586498e5016ff2cb3f0a84f0e03612858
SHA14f35692e54c22730b0601a9c3048c7baadf57939
SHA2564873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481
SHA512fbe48fb5e8d351a80363dc0de57d970cabed1228e20560df4cd02d75c42b219a70d46057af9c581fcb364751cca315d866b8fcfe46630be72c49e8aecf46453f
-
\Users\Admin\AppData\Local\Temp\windows\RealBoss.exeFilesize
756KB
MD586498e5016ff2cb3f0a84f0e03612858
SHA14f35692e54c22730b0601a9c3048c7baadf57939
SHA2564873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481
SHA512fbe48fb5e8d351a80363dc0de57d970cabed1228e20560df4cd02d75c42b219a70d46057af9c581fcb364751cca315d866b8fcfe46630be72c49e8aecf46453f
-
\Users\Admin\AppData\Local\Temp\windows\RealBoss.exeFilesize
756KB
MD586498e5016ff2cb3f0a84f0e03612858
SHA14f35692e54c22730b0601a9c3048c7baadf57939
SHA2564873d23065574c318aa28955737d7d0a74372453ffa950f97da3acc8a2d60481
SHA512fbe48fb5e8d351a80363dc0de57d970cabed1228e20560df4cd02d75c42b219a70d46057af9c581fcb364751cca315d866b8fcfe46630be72c49e8aecf46453f
-
memory/320-58-0x0000000000000000-mapping.dmp
-
memory/880-65-0x0000000000000000-mapping.dmp
-
memory/1392-57-0x0000000000000000-mapping.dmp
-
memory/1480-54-0x0000000074F91000-0x0000000074F93000-memory.dmpFilesize
8KB
-
memory/1584-55-0x0000000000000000-mapping.dmp
-
memory/1608-56-0x0000000000000000-mapping.dmp
-
memory/1844-61-0x0000000000000000-mapping.dmp