Analysis
- max time kernel
90s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
18/06/2022, 17:06
Static task
static1
Behavioral task
behavioral1
Sample
xrangerwh.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
xrangerwh.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target xrangerwh.exe
- Size 658KB
- Sample220618-vmd48aabbq
- SHA256 99870955e988faaf5dd449b8470ff7bfb8ac7aa4819df8843d4778ae8a59d034
- MD5 6e8192c0bad137cfd8e0a7279570aa10
- SHA1 50412e7b7b23f08802c4a8ca433cec5fbc15abd3
- SHA512 bf77b143a20986209639eea8baa89c13ccf084bf20577d0c0a1f78fe3c961b685da84d3af568f14843e2d4693e2c758cccf59900ea27dba902e76f0292736f7a
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
taahasazann
C2
-
4.tcp.ngrok.io:14402
Mutex
-
DCMIN_MUTEX-CH1LKS9
Attributes
-
InstallPath
DCSCMIN\IMDCSC.exe
-
gencode
Vmt38iubzRZu
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
Windows Defender
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe" xrangerwh.exe - Executes dropped EXE 1 IoCs
pid Process 2000 IMDCSC.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation xrangerwh.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe" xrangerwh.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1792 xrangerwh.exe Token: SeSecurityPrivilege 1792 xrangerwh.exe Token: SeTakeOwnershipPrivilege 1792 xrangerwh.exe Token: SeLoadDriverPrivilege 1792 xrangerwh.exe Token: SeSystemProfilePrivilege 1792 xrangerwh.exe Token: SeSystemtimePrivilege 1792 xrangerwh.exe Token: SeProfSingleProcessPrivilege 1792 xrangerwh.exe Token: SeIncBasePriorityPrivilege 1792 xrangerwh.exe Token: SeCreatePagefilePrivilege 1792 xrangerwh.exe Token: SeBackupPrivilege 1792 xrangerwh.exe Token: SeRestorePrivilege 1792 xrangerwh.exe Token: SeShutdownPrivilege 1792 xrangerwh.exe Token: SeDebugPrivilege 1792 xrangerwh.exe Token: SeSystemEnvironmentPrivilege 1792 xrangerwh.exe Token: SeChangeNotifyPrivilege 1792 xrangerwh.exe Token: SeRemoteShutdownPrivilege 1792 xrangerwh.exe Token: SeUndockPrivilege 1792 xrangerwh.exe Token: SeManageVolumePrivilege 1792 xrangerwh.exe Token: SeImpersonatePrivilege 1792 xrangerwh.exe Token: SeCreateGlobalPrivilege 1792 xrangerwh.exe Token: 33 1792 xrangerwh.exe Token: 34 1792 xrangerwh.exe Token: 35 1792 xrangerwh.exe Token: 36 1792 xrangerwh.exe Token: SeIncreaseQuotaPrivilege 2000 IMDCSC.exe Token: SeSecurityPrivilege 2000 IMDCSC.exe Token: SeTakeOwnershipPrivilege 2000 IMDCSC.exe Token: SeLoadDriverPrivilege 2000 IMDCSC.exe Token: SeSystemProfilePrivilege 2000 IMDCSC.exe Token: SeSystemtimePrivilege 2000 IMDCSC.exe Token: SeProfSingleProcessPrivilege 2000 IMDCSC.exe Token: SeIncBasePriorityPrivilege 2000 IMDCSC.exe Token: SeCreatePagefilePrivilege 2000 IMDCSC.exe Token: SeBackupPrivilege 2000 IMDCSC.exe Token: SeRestorePrivilege 2000 IMDCSC.exe Token: SeShutdownPrivilege 2000 IMDCSC.exe Token: SeDebugPrivilege 2000 IMDCSC.exe Token: SeSystemEnvironmentPrivilege 2000 IMDCSC.exe Token: SeChangeNotifyPrivilege 2000 IMDCSC.exe Token: SeRemoteShutdownPrivilege 2000 IMDCSC.exe Token: SeUndockPrivilege 2000 IMDCSC.exe Token: SeManageVolumePrivilege 2000 IMDCSC.exe Token: SeImpersonatePrivilege 2000 IMDCSC.exe Token: SeCreateGlobalPrivilege 2000 IMDCSC.exe Token: 33 2000 IMDCSC.exe Token: 34 2000 IMDCSC.exe Token: 35 2000 IMDCSC.exe Token: 36 2000 IMDCSC.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2000 IMDCSC.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1792 wrote to memory of 2000 1792 xrangerwh.exe 79 PID 1792 wrote to memory of 2000 1792 xrangerwh.exe 79 PID 1792 wrote to memory of 2000 1792 xrangerwh.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\xrangerwh.exe"C:\Users\Admin\AppData\Local\Temp\xrangerwh.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2000
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
- Size 658KB
- SHA256 99870955e988faaf5dd449b8470ff7bfb8ac7aa4819df8843d4778ae8a59d034
- MD5 6e8192c0bad137cfd8e0a7279570aa10
- SHA1 50412e7b7b23f08802c4a8ca433cec5fbc15abd3
- SHA512 bf77b143a20986209639eea8baa89c13ccf084bf20577d0c0a1f78fe3c961b685da84d3af568f14843e2d4693e2c758cccf59900ea27dba902e76f0292736f7a
- SSDEEP 12288:S9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/he:+Z1xuVVjfFoynPaVBUR8f+kN10EBQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
- Size 658KB
- SHA256 99870955e988faaf5dd449b8470ff7bfb8ac7aa4819df8843d4778ae8a59d034
- MD5 6e8192c0bad137cfd8e0a7279570aa10
- SHA1 50412e7b7b23f08802c4a8ca433cec5fbc15abd3
- SHA512 bf77b143a20986209639eea8baa89c13ccf084bf20577d0c0a1f78fe3c961b685da84d3af568f14843e2d4693e2c758cccf59900ea27dba902e76f0292736f7a
- SSDEEP 12288:S9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/he:+Z1xuVVjfFoynPaVBUR8f+kN10EBQ
- MD5 SHA1 SHA512 SSDEEP