a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe
252KB
21-05-2022 18:35
behavioral1
532a6afb45c841f08a0ff9f104559334
2fe9463e271b50907d72174992f4adf5c5c5eace
a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62
313db495bc51449b94484e749a2bee932686fabdfcf2e1a6e2c8caa10fe034960408c2f6a9b90f31e3ae55a1881752fab4baf1bae1fc5d14cf073884c358e7a4
Filter: none
-
Darkcomet
Description
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
Tags
-
Modifies WinLogon for persistencea0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe
Tags
TTPs
Reported IOCs
description ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\proverka_stiller.exe" a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe -
Modifies firewall policy serviceproverka_stiller.exe
Tags
TTPs
Reported IOCs
description ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile proverka_stiller.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" proverka_stiller.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" proverka_stiller.exe -
Executes dropped EXEproverka_stiller.exe
Reported IOCs
pid process 924 proverka_stiller.exe -
UPX packed file
Description
Detects executables packed with UPX/modified UPX open source packer.
Tags
Reported IOCs
resource yara_rule behavioral1/files/0x00090000000132c6-55.dat upx behavioral1/files/0x00090000000132c6-56.dat upx behavioral1/files/0x00090000000132c6-58.dat upx behavioral1/files/0x00090000000132c6-60.dat upx -
Loads dropped DLLa0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe
Reported IOCs
pid process 1744 a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe 1744 a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe -
Adds Run key to start applicationa0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe
Tags
TTPs
Reported IOCs
description ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\Java = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\proverka_stiller.exe" a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe -
Enumerates physical storage devices
Description
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
TTPs
-
Suspicious use of AdjustPrivilegeTokena0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exeproverka_stiller.exe
Reported IOCs
description pid process Token: SeIncreaseQuotaPrivilege 1744 a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe Token: SeSecurityPrivilege 1744 a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe Token: SeTakeOwnershipPrivilege 1744 a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe Token: SeLoadDriverPrivilege 1744 a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe Token: SeSystemProfilePrivilege 1744 a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe Token: SeSystemtimePrivilege 1744 a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe Token: SeProfSingleProcessPrivilege 1744 a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe Token: SeIncBasePriorityPrivilege 1744 a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe Token: SeCreatePagefilePrivilege 1744 a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe Token: SeBackupPrivilege 1744 a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe Token: SeRestorePrivilege 1744 a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe Token: SeShutdownPrivilege 1744 a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe Token: SeDebugPrivilege 1744 a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe Token: SeSystemEnvironmentPrivilege 1744 a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe Token: SeChangeNotifyPrivilege 1744 a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe Token: SeRemoteShutdownPrivilege 1744 a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe Token: SeUndockPrivilege 1744 a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe Token: SeManageVolumePrivilege 1744 a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe Token: SeImpersonatePrivilege 1744 a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe Token: SeCreateGlobalPrivilege 1744 a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe Token: 33 1744 a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe Token: 34 1744 a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe Token: 35 1744 a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe Token: SeIncreaseQuotaPrivilege 924 proverka_stiller.exe Token: SeSecurityPrivilege 924 proverka_stiller.exe Token: SeTakeOwnershipPrivilege 924 proverka_stiller.exe Token: SeLoadDriverPrivilege 924 proverka_stiller.exe Token: SeSystemProfilePrivilege 924 proverka_stiller.exe Token: SeSystemtimePrivilege 924 proverka_stiller.exe Token: SeProfSingleProcessPrivilege 924 proverka_stiller.exe Token: SeIncBasePriorityPrivilege 924 proverka_stiller.exe Token: SeCreatePagefilePrivilege 924 proverka_stiller.exe Token: SeBackupPrivilege 924 proverka_stiller.exe Token: SeRestorePrivilege 924 proverka_stiller.exe Token: SeShutdownPrivilege 924 proverka_stiller.exe Token: SeDebugPrivilege 924 proverka_stiller.exe Token: SeSystemEnvironmentPrivilege 924 proverka_stiller.exe Token: SeChangeNotifyPrivilege 924 proverka_stiller.exe Token: SeRemoteShutdownPrivilege 924 proverka_stiller.exe Token: SeUndockPrivilege 924 proverka_stiller.exe Token: SeManageVolumePrivilege 924 proverka_stiller.exe Token: SeImpersonatePrivilege 924 proverka_stiller.exe Token: SeCreateGlobalPrivilege 924 proverka_stiller.exe Token: 33 924 proverka_stiller.exe Token: 34 924 proverka_stiller.exe Token: 35 924 proverka_stiller.exe -
Suspicious use of SetWindowsHookExproverka_stiller.exe
Reported IOCs
pid process 924 proverka_stiller.exe -
Suspicious use of WriteProcessMemorya0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe
Reported IOCs
description pid process target process PID 1744 wrote to memory of 924 1744 a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe proverka_stiller.exe PID 1744 wrote to memory of 924 1744 a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe proverka_stiller.exe PID 1744 wrote to memory of 924 1744 a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe proverka_stiller.exe PID 1744 wrote to memory of 924 1744 a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe proverka_stiller.exe
-
C:\Users\Admin\AppData\Local\Temp\a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exePID:1744"C:\Users\Admin\AppData\Local\Temp\a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62.exe"Modifies WinLogon for persistenceLoads dropped DLLAdds Run key to start applicationSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\MSDCSC\proverka_stiller.exePID:924"C:\Users\Admin\AppData\Roaming\MSDCSC\proverka_stiller.exe"Modifies firewall policy serviceExecutes dropped EXESuspicious use of AdjustPrivilegeTokenSuspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\MSDCSC\proverka_stiller.exe
MD5532a6afb45c841f08a0ff9f104559334
SHA12fe9463e271b50907d72174992f4adf5c5c5eace
SHA256a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62
SHA512313db495bc51449b94484e749a2bee932686fabdfcf2e1a6e2c8caa10fe034960408c2f6a9b90f31e3ae55a1881752fab4baf1bae1fc5d14cf073884c358e7a4
-
C:\Users\Admin\AppData\Roaming\MSDCSC\proverka_stiller.exe
MD5532a6afb45c841f08a0ff9f104559334
SHA12fe9463e271b50907d72174992f4adf5c5c5eace
SHA256a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62
SHA512313db495bc51449b94484e749a2bee932686fabdfcf2e1a6e2c8caa10fe034960408c2f6a9b90f31e3ae55a1881752fab4baf1bae1fc5d14cf073884c358e7a4
-
\Users\Admin\AppData\Roaming\MSDCSC\proverka_stiller.exe
MD5532a6afb45c841f08a0ff9f104559334
SHA12fe9463e271b50907d72174992f4adf5c5c5eace
SHA256a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62
SHA512313db495bc51449b94484e749a2bee932686fabdfcf2e1a6e2c8caa10fe034960408c2f6a9b90f31e3ae55a1881752fab4baf1bae1fc5d14cf073884c358e7a4
-
\Users\Admin\AppData\Roaming\MSDCSC\proverka_stiller.exe
MD5532a6afb45c841f08a0ff9f104559334
SHA12fe9463e271b50907d72174992f4adf5c5c5eace
SHA256a0f7c2f2ac9cd595abc825bbed28df20ffdbbf7664269cf3c49c106a267dba62
SHA512313db495bc51449b94484e749a2bee932686fabdfcf2e1a6e2c8caa10fe034960408c2f6a9b90f31e3ae55a1881752fab4baf1bae1fc5d14cf073884c358e7a4
-
memory/924-57-0x0000000000000000-mapping.dmp
-
memory/1744-54-0x0000000075761000-0x0000000075763000-memory.dmp