Analysis
- max time kernel
145s - max time network
173s - platform
windows7_x64 - resource
win7-20220414-en - submitted
07/06/2022, 04:28
Static task
static1
Behavioral task
behavioral1
Sample
1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe
- Size 658KB
- Sample220607-e3x92ahae3
- SHA256 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab
- MD5 5cfcfb070400a2ff5a7ad7f10e726257
- SHA1 2a538131bfbb5caa61aaaef9ecd8a805b0c6b4cf
- SHA512 5a4ccbff9833ae5a8c1a45ca4e66e00b8d45b9c89ce09cc0acb131e6ada7268d3de182ce746bf3f94b42e5a4ff36e76387b60c253d7a3f2a51b06c8a65a260ab
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
Guest16_min
C2
-
64.85.233.8:3333
Mutex
-
DCMIN_MUTEX-BKJH8V4
Attributes
-
InstallPath
DCSCMIN\IMDCSC.exe
-
gencode
LJfJABUsUvfk
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
DarkComet RAT
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe" 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe - Executes dropped EXE 1 IoCs
pid Process 1640 IMDCSC.exe - Loads dropped DLL 2 IoCs
pid Process 1696 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe 1696 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkComet RAT = "C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe" 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1696 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeSecurityPrivilege 1696 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeTakeOwnershipPrivilege 1696 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeLoadDriverPrivilege 1696 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeSystemProfilePrivilege 1696 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeSystemtimePrivilege 1696 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeProfSingleProcessPrivilege 1696 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeIncBasePriorityPrivilege 1696 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeCreatePagefilePrivilege 1696 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeBackupPrivilege 1696 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeRestorePrivilege 1696 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeShutdownPrivilege 1696 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeDebugPrivilege 1696 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeSystemEnvironmentPrivilege 1696 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeChangeNotifyPrivilege 1696 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeRemoteShutdownPrivilege 1696 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeUndockPrivilege 1696 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeManageVolumePrivilege 1696 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeImpersonatePrivilege 1696 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeCreateGlobalPrivilege 1696 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: 33 1696 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: 34 1696 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: 35 1696 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeIncreaseQuotaPrivilege 1640 IMDCSC.exe Token: SeSecurityPrivilege 1640 IMDCSC.exe Token: SeTakeOwnershipPrivilege 1640 IMDCSC.exe Token: SeLoadDriverPrivilege 1640 IMDCSC.exe Token: SeSystemProfilePrivilege 1640 IMDCSC.exe Token: SeSystemtimePrivilege 1640 IMDCSC.exe Token: SeProfSingleProcessPrivilege 1640 IMDCSC.exe Token: SeIncBasePriorityPrivilege 1640 IMDCSC.exe Token: SeCreatePagefilePrivilege 1640 IMDCSC.exe Token: SeBackupPrivilege 1640 IMDCSC.exe Token: SeRestorePrivilege 1640 IMDCSC.exe Token: SeShutdownPrivilege 1640 IMDCSC.exe Token: SeDebugPrivilege 1640 IMDCSC.exe Token: SeSystemEnvironmentPrivilege 1640 IMDCSC.exe Token: SeChangeNotifyPrivilege 1640 IMDCSC.exe Token: SeRemoteShutdownPrivilege 1640 IMDCSC.exe Token: SeUndockPrivilege 1640 IMDCSC.exe Token: SeManageVolumePrivilege 1640 IMDCSC.exe Token: SeImpersonatePrivilege 1640 IMDCSC.exe Token: SeCreateGlobalPrivilege 1640 IMDCSC.exe Token: 33 1640 IMDCSC.exe Token: 34 1640 IMDCSC.exe Token: 35 1640 IMDCSC.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1640 IMDCSC.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1696 wrote to memory of 1640 1696 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe 28 PID 1696 wrote to memory of 1640 1696 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe 28 PID 1696 wrote to memory of 1640 1696 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe 28 PID 1696 wrote to memory of 1640 1696 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe"C:\Users\Admin\AppData\Local\Temp\1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1640
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
- Size 658KB
- SHA256 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab
- MD5 5cfcfb070400a2ff5a7ad7f10e726257
- SHA1 2a538131bfbb5caa61aaaef9ecd8a805b0c6b4cf
- SHA512 5a4ccbff9833ae5a8c1a45ca4e66e00b8d45b9c89ce09cc0acb131e6ada7268d3de182ce746bf3f94b42e5a4ff36e76387b60c253d7a3f2a51b06c8a65a260ab
- SSDEEP 12288:S9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hg:+Z1xuVVjfFoynPaVBUR8f+kN10EBW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
- Size 658KB
- SHA256 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab
- MD5 5cfcfb070400a2ff5a7ad7f10e726257
- SHA1 2a538131bfbb5caa61aaaef9ecd8a805b0c6b4cf
- SHA512 5a4ccbff9833ae5a8c1a45ca4e66e00b8d45b9c89ce09cc0acb131e6ada7268d3de182ce746bf3f94b42e5a4ff36e76387b60c253d7a3f2a51b06c8a65a260ab
- SSDEEP 12288:S9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hg:+Z1xuVVjfFoynPaVBUR8f+kN10EBW
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\Documents\DCSCMIN\IMDCSC.exe
- Size 658KB
- SHA256 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab
- MD5 5cfcfb070400a2ff5a7ad7f10e726257
- SHA1 2a538131bfbb5caa61aaaef9ecd8a805b0c6b4cf
- SHA512 5a4ccbff9833ae5a8c1a45ca4e66e00b8d45b9c89ce09cc0acb131e6ada7268d3de182ce746bf3f94b42e5a4ff36e76387b60c253d7a3f2a51b06c8a65a260ab
- SSDEEP 12288:S9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hg:+Z1xuVVjfFoynPaVBUR8f+kN10EBW
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\Documents\DCSCMIN\IMDCSC.exe
- Size 658KB
- SHA256 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab
- MD5 5cfcfb070400a2ff5a7ad7f10e726257
- SHA1 2a538131bfbb5caa61aaaef9ecd8a805b0c6b4cf
- SHA512 5a4ccbff9833ae5a8c1a45ca4e66e00b8d45b9c89ce09cc0acb131e6ada7268d3de182ce746bf3f94b42e5a4ff36e76387b60c253d7a3f2a51b06c8a65a260ab
- SSDEEP 12288:S9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hg:+Z1xuVVjfFoynPaVBUR8f+kN10EBW
- MD5 SHA1 SHA512 SSDEEP