Analysis
- max time kernel
148s - max time network
178s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
07/06/2022, 04:28
Static task
static1
Behavioral task
behavioral1
Sample
1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe
- Size 658KB
- Sample220607-e3x92ahae3
- SHA256 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab
- MD5 5cfcfb070400a2ff5a7ad7f10e726257
- SHA1 2a538131bfbb5caa61aaaef9ecd8a805b0c6b4cf
- SHA512 5a4ccbff9833ae5a8c1a45ca4e66e00b8d45b9c89ce09cc0acb131e6ada7268d3de182ce746bf3f94b42e5a4ff36e76387b60c253d7a3f2a51b06c8a65a260ab
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
Guest16_min
C2
-
64.85.233.8:3333
Mutex
-
DCMIN_MUTEX-BKJH8V4
Attributes
-
InstallPath
DCSCMIN\IMDCSC.exe
-
gencode
LJfJABUsUvfk
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
DarkComet RAT
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe" 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe - Executes dropped EXE 1 IoCs
pid Process 4992 IMDCSC.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DarkComet RAT = "C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe" 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3140 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeSecurityPrivilege 3140 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeTakeOwnershipPrivilege 3140 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeLoadDriverPrivilege 3140 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeSystemProfilePrivilege 3140 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeSystemtimePrivilege 3140 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeProfSingleProcessPrivilege 3140 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeIncBasePriorityPrivilege 3140 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeCreatePagefilePrivilege 3140 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeBackupPrivilege 3140 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeRestorePrivilege 3140 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeShutdownPrivilege 3140 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeDebugPrivilege 3140 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeSystemEnvironmentPrivilege 3140 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeChangeNotifyPrivilege 3140 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeRemoteShutdownPrivilege 3140 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeUndockPrivilege 3140 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeManageVolumePrivilege 3140 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeImpersonatePrivilege 3140 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeCreateGlobalPrivilege 3140 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: 33 3140 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: 34 3140 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: 35 3140 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: 36 3140 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe Token: SeIncreaseQuotaPrivilege 4992 IMDCSC.exe Token: SeSecurityPrivilege 4992 IMDCSC.exe Token: SeTakeOwnershipPrivilege 4992 IMDCSC.exe Token: SeLoadDriverPrivilege 4992 IMDCSC.exe Token: SeSystemProfilePrivilege 4992 IMDCSC.exe Token: SeSystemtimePrivilege 4992 IMDCSC.exe Token: SeProfSingleProcessPrivilege 4992 IMDCSC.exe Token: SeIncBasePriorityPrivilege 4992 IMDCSC.exe Token: SeCreatePagefilePrivilege 4992 IMDCSC.exe Token: SeBackupPrivilege 4992 IMDCSC.exe Token: SeRestorePrivilege 4992 IMDCSC.exe Token: SeShutdownPrivilege 4992 IMDCSC.exe Token: SeDebugPrivilege 4992 IMDCSC.exe Token: SeSystemEnvironmentPrivilege 4992 IMDCSC.exe Token: SeChangeNotifyPrivilege 4992 IMDCSC.exe Token: SeRemoteShutdownPrivilege 4992 IMDCSC.exe Token: SeUndockPrivilege 4992 IMDCSC.exe Token: SeManageVolumePrivilege 4992 IMDCSC.exe Token: SeImpersonatePrivilege 4992 IMDCSC.exe Token: SeCreateGlobalPrivilege 4992 IMDCSC.exe Token: 33 4992 IMDCSC.exe Token: 34 4992 IMDCSC.exe Token: 35 4992 IMDCSC.exe Token: 36 4992 IMDCSC.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4992 IMDCSC.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3140 wrote to memory of 4992 3140 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe 82 PID 3140 wrote to memory of 4992 3140 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe 82 PID 3140 wrote to memory of 4992 3140 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe"C:\Users\Admin\AppData\Local\Temp\1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4992
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
- Size 658KB
- SHA256 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab
- MD5 5cfcfb070400a2ff5a7ad7f10e726257
- SHA1 2a538131bfbb5caa61aaaef9ecd8a805b0c6b4cf
- SHA512 5a4ccbff9833ae5a8c1a45ca4e66e00b8d45b9c89ce09cc0acb131e6ada7268d3de182ce746bf3f94b42e5a4ff36e76387b60c253d7a3f2a51b06c8a65a260ab
- SSDEEP 12288:S9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hg:+Z1xuVVjfFoynPaVBUR8f+kN10EBW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
- Size 658KB
- SHA256 1d2dde8f6d961be976aede62dd895c0ac4aba336c44a0c1b385240f86a3a10ab
- MD5 5cfcfb070400a2ff5a7ad7f10e726257
- SHA1 2a538131bfbb5caa61aaaef9ecd8a805b0c6b4cf
- SHA512 5a4ccbff9833ae5a8c1a45ca4e66e00b8d45b9c89ce09cc0acb131e6ada7268d3de182ce746bf3f94b42e5a4ff36e76387b60c253d7a3f2a51b06c8a65a260ab
- SSDEEP 12288:S9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hg:+Z1xuVVjfFoynPaVBUR8f+kN10EBW
- MD5 SHA1 SHA512 SSDEEP