Analysis
- max time kernel
116s - max time network
145s - platform
windows7_x64 - resource
win7-20220414-en - submitted
18/06/2022, 17:06
Static task
static1
Behavioral task
behavioral1
Sample
xrangerwh.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
xrangerwh.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target xrangerwh.exe
- Size 658KB
- Sample220618-vmd48aabbq
- SHA256 99870955e988faaf5dd449b8470ff7bfb8ac7aa4819df8843d4778ae8a59d034
- MD5 6e8192c0bad137cfd8e0a7279570aa10
- SHA1 50412e7b7b23f08802c4a8ca433cec5fbc15abd3
- SHA512 bf77b143a20986209639eea8baa89c13ccf084bf20577d0c0a1f78fe3c961b685da84d3af568f14843e2d4693e2c758cccf59900ea27dba902e76f0292736f7a
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
taahasazann
C2
-
4.tcp.ngrok.io:14402
Mutex
-
DCMIN_MUTEX-CH1LKS9
Attributes
-
InstallPath
DCSCMIN\IMDCSC.exe
-
gencode
Vmt38iubzRZu
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
Windows Defender
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe" xrangerwh.exe - Executes dropped EXE 1 IoCs
pid Process 1892 IMDCSC.exe - Loads dropped DLL 2 IoCs
pid Process 948 xrangerwh.exe 948 xrangerwh.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe" xrangerwh.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 948 xrangerwh.exe Token: SeSecurityPrivilege 948 xrangerwh.exe Token: SeTakeOwnershipPrivilege 948 xrangerwh.exe Token: SeLoadDriverPrivilege 948 xrangerwh.exe Token: SeSystemProfilePrivilege 948 xrangerwh.exe Token: SeSystemtimePrivilege 948 xrangerwh.exe Token: SeProfSingleProcessPrivilege 948 xrangerwh.exe Token: SeIncBasePriorityPrivilege 948 xrangerwh.exe Token: SeCreatePagefilePrivilege 948 xrangerwh.exe Token: SeBackupPrivilege 948 xrangerwh.exe Token: SeRestorePrivilege 948 xrangerwh.exe Token: SeShutdownPrivilege 948 xrangerwh.exe Token: SeDebugPrivilege 948 xrangerwh.exe Token: SeSystemEnvironmentPrivilege 948 xrangerwh.exe Token: SeChangeNotifyPrivilege 948 xrangerwh.exe Token: SeRemoteShutdownPrivilege 948 xrangerwh.exe Token: SeUndockPrivilege 948 xrangerwh.exe Token: SeManageVolumePrivilege 948 xrangerwh.exe Token: SeImpersonatePrivilege 948 xrangerwh.exe Token: SeCreateGlobalPrivilege 948 xrangerwh.exe Token: 33 948 xrangerwh.exe Token: 34 948 xrangerwh.exe Token: 35 948 xrangerwh.exe Token: SeIncreaseQuotaPrivilege 1892 IMDCSC.exe Token: SeSecurityPrivilege 1892 IMDCSC.exe Token: SeTakeOwnershipPrivilege 1892 IMDCSC.exe Token: SeLoadDriverPrivilege 1892 IMDCSC.exe Token: SeSystemProfilePrivilege 1892 IMDCSC.exe Token: SeSystemtimePrivilege 1892 IMDCSC.exe Token: SeProfSingleProcessPrivilege 1892 IMDCSC.exe Token: SeIncBasePriorityPrivilege 1892 IMDCSC.exe Token: SeCreatePagefilePrivilege 1892 IMDCSC.exe Token: SeBackupPrivilege 1892 IMDCSC.exe Token: SeRestorePrivilege 1892 IMDCSC.exe Token: SeShutdownPrivilege 1892 IMDCSC.exe Token: SeDebugPrivilege 1892 IMDCSC.exe Token: SeSystemEnvironmentPrivilege 1892 IMDCSC.exe Token: SeChangeNotifyPrivilege 1892 IMDCSC.exe Token: SeRemoteShutdownPrivilege 1892 IMDCSC.exe Token: SeUndockPrivilege 1892 IMDCSC.exe Token: SeManageVolumePrivilege 1892 IMDCSC.exe Token: SeImpersonatePrivilege 1892 IMDCSC.exe Token: SeCreateGlobalPrivilege 1892 IMDCSC.exe Token: 33 1892 IMDCSC.exe Token: 34 1892 IMDCSC.exe Token: 35 1892 IMDCSC.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1892 IMDCSC.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 948 wrote to memory of 1892 948 xrangerwh.exe 27 PID 948 wrote to memory of 1892 948 xrangerwh.exe 27 PID 948 wrote to memory of 1892 948 xrangerwh.exe 27 PID 948 wrote to memory of 1892 948 xrangerwh.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\xrangerwh.exe"C:\Users\Admin\AppData\Local\Temp\xrangerwh.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1892
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
- Size 658KB
- SHA256 99870955e988faaf5dd449b8470ff7bfb8ac7aa4819df8843d4778ae8a59d034
- MD5 6e8192c0bad137cfd8e0a7279570aa10
- SHA1 50412e7b7b23f08802c4a8ca433cec5fbc15abd3
- SHA512 bf77b143a20986209639eea8baa89c13ccf084bf20577d0c0a1f78fe3c961b685da84d3af568f14843e2d4693e2c758cccf59900ea27dba902e76f0292736f7a
- SSDEEP 12288:S9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/he:+Z1xuVVjfFoynPaVBUR8f+kN10EBQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
- Size 658KB
- SHA256 99870955e988faaf5dd449b8470ff7bfb8ac7aa4819df8843d4778ae8a59d034
- MD5 6e8192c0bad137cfd8e0a7279570aa10
- SHA1 50412e7b7b23f08802c4a8ca433cec5fbc15abd3
- SHA512 bf77b143a20986209639eea8baa89c13ccf084bf20577d0c0a1f78fe3c961b685da84d3af568f14843e2d4693e2c758cccf59900ea27dba902e76f0292736f7a
- SSDEEP 12288:S9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/he:+Z1xuVVjfFoynPaVBUR8f+kN10EBQ
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\Documents\DCSCMIN\IMDCSC.exe
- Size 658KB
- SHA256 99870955e988faaf5dd449b8470ff7bfb8ac7aa4819df8843d4778ae8a59d034
- MD5 6e8192c0bad137cfd8e0a7279570aa10
- SHA1 50412e7b7b23f08802c4a8ca433cec5fbc15abd3
- SHA512 bf77b143a20986209639eea8baa89c13ccf084bf20577d0c0a1f78fe3c961b685da84d3af568f14843e2d4693e2c758cccf59900ea27dba902e76f0292736f7a
- SSDEEP 12288:S9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/he:+Z1xuVVjfFoynPaVBUR8f+kN10EBQ
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\Documents\DCSCMIN\IMDCSC.exe
- Size 658KB
- SHA256 99870955e988faaf5dd449b8470ff7bfb8ac7aa4819df8843d4778ae8a59d034
- MD5 6e8192c0bad137cfd8e0a7279570aa10
- SHA1 50412e7b7b23f08802c4a8ca433cec5fbc15abd3
- SHA512 bf77b143a20986209639eea8baa89c13ccf084bf20577d0c0a1f78fe3c961b685da84d3af568f14843e2d4693e2c758cccf59900ea27dba902e76f0292736f7a
- SSDEEP 12288:S9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/he:+Z1xuVVjfFoynPaVBUR8f+kN10EBQ
- MD5 SHA1 SHA512 SSDEEP