Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
30-06-2022 17:01
Behavioral task
behavioral1
Sample
13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe
Resource
win10v2004-20220414-en
General
-
Target
13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe
-
Size
658KB
-
MD5
c46b0c1ead56ed1933dd375b6b22e1f2
-
SHA1
97f05c8a9847e8e396d5916deb831466111ae2a4
-
SHA256
13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3
-
SHA512
83cbc641d4a32cb2e8a92c5bb8a7e57e024be7ce977896997cff70e9cb307f7038a40085192d0160058fb195e49e817dcf2cc19286773121a4ec9b2a1e41681c
Malware Config
Extracted
darkcomet
Sazan
85.98.17.207:1604
DC_MUTEX-T147BU8
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
LMpE3BXrLHns
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
JokerRinaHack
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 1172 msdcsc.exe -
Loads dropped DLL 2 IoCs
Processes:
13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exepid process 1492 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe 1492 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msdcsc.exe13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\JokerRinaHack = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\JokerRinaHack = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1492 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe Token: SeSecurityPrivilege 1492 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe Token: SeTakeOwnershipPrivilege 1492 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe Token: SeLoadDriverPrivilege 1492 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe Token: SeSystemProfilePrivilege 1492 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe Token: SeSystemtimePrivilege 1492 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe Token: SeProfSingleProcessPrivilege 1492 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe Token: SeIncBasePriorityPrivilege 1492 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe Token: SeCreatePagefilePrivilege 1492 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe Token: SeBackupPrivilege 1492 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe Token: SeRestorePrivilege 1492 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe Token: SeShutdownPrivilege 1492 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe Token: SeDebugPrivilege 1492 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe Token: SeSystemEnvironmentPrivilege 1492 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe Token: SeChangeNotifyPrivilege 1492 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe Token: SeRemoteShutdownPrivilege 1492 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe Token: SeUndockPrivilege 1492 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe Token: SeManageVolumePrivilege 1492 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe Token: SeImpersonatePrivilege 1492 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe Token: SeCreateGlobalPrivilege 1492 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe Token: 33 1492 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe Token: 34 1492 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe Token: 35 1492 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe Token: SeIncreaseQuotaPrivilege 1172 msdcsc.exe Token: SeSecurityPrivilege 1172 msdcsc.exe Token: SeTakeOwnershipPrivilege 1172 msdcsc.exe Token: SeLoadDriverPrivilege 1172 msdcsc.exe Token: SeSystemProfilePrivilege 1172 msdcsc.exe Token: SeSystemtimePrivilege 1172 msdcsc.exe Token: SeProfSingleProcessPrivilege 1172 msdcsc.exe Token: SeIncBasePriorityPrivilege 1172 msdcsc.exe Token: SeCreatePagefilePrivilege 1172 msdcsc.exe Token: SeBackupPrivilege 1172 msdcsc.exe Token: SeRestorePrivilege 1172 msdcsc.exe Token: SeShutdownPrivilege 1172 msdcsc.exe Token: SeDebugPrivilege 1172 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1172 msdcsc.exe Token: SeChangeNotifyPrivilege 1172 msdcsc.exe Token: SeRemoteShutdownPrivilege 1172 msdcsc.exe Token: SeUndockPrivilege 1172 msdcsc.exe Token: SeManageVolumePrivilege 1172 msdcsc.exe Token: SeImpersonatePrivilege 1172 msdcsc.exe Token: SeCreateGlobalPrivilege 1172 msdcsc.exe Token: 33 1172 msdcsc.exe Token: 34 1172 msdcsc.exe Token: 35 1172 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 1172 msdcsc.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exemsdcsc.exedescription pid process target process PID 1492 wrote to memory of 1172 1492 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe msdcsc.exe PID 1492 wrote to memory of 1172 1492 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe msdcsc.exe PID 1492 wrote to memory of 1172 1492 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe msdcsc.exe PID 1492 wrote to memory of 1172 1492 13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe msdcsc.exe PID 1172 wrote to memory of 844 1172 msdcsc.exe notepad.exe PID 1172 wrote to memory of 844 1172 msdcsc.exe notepad.exe PID 1172 wrote to memory of 844 1172 msdcsc.exe notepad.exe PID 1172 wrote to memory of 844 1172 msdcsc.exe notepad.exe PID 1172 wrote to memory of 844 1172 msdcsc.exe notepad.exe PID 1172 wrote to memory of 844 1172 msdcsc.exe notepad.exe PID 1172 wrote to memory of 844 1172 msdcsc.exe notepad.exe PID 1172 wrote to memory of 844 1172 msdcsc.exe notepad.exe PID 1172 wrote to memory of 844 1172 msdcsc.exe notepad.exe PID 1172 wrote to memory of 844 1172 msdcsc.exe notepad.exe PID 1172 wrote to memory of 844 1172 msdcsc.exe notepad.exe PID 1172 wrote to memory of 844 1172 msdcsc.exe notepad.exe PID 1172 wrote to memory of 844 1172 msdcsc.exe notepad.exe PID 1172 wrote to memory of 844 1172 msdcsc.exe notepad.exe PID 1172 wrote to memory of 844 1172 msdcsc.exe notepad.exe PID 1172 wrote to memory of 844 1172 msdcsc.exe notepad.exe PID 1172 wrote to memory of 844 1172 msdcsc.exe notepad.exe PID 1172 wrote to memory of 844 1172 msdcsc.exe notepad.exe PID 1172 wrote to memory of 844 1172 msdcsc.exe notepad.exe PID 1172 wrote to memory of 844 1172 msdcsc.exe notepad.exe PID 1172 wrote to memory of 844 1172 msdcsc.exe notepad.exe PID 1172 wrote to memory of 844 1172 msdcsc.exe notepad.exe PID 1172 wrote to memory of 844 1172 msdcsc.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe"C:\Users\Admin\AppData\Local\Temp\13a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
658KB
MD5c46b0c1ead56ed1933dd375b6b22e1f2
SHA197f05c8a9847e8e396d5916deb831466111ae2a4
SHA25613a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3
SHA51283cbc641d4a32cb2e8a92c5bb8a7e57e024be7ce977896997cff70e9cb307f7038a40085192d0160058fb195e49e817dcf2cc19286773121a4ec9b2a1e41681c
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
658KB
MD5c46b0c1ead56ed1933dd375b6b22e1f2
SHA197f05c8a9847e8e396d5916deb831466111ae2a4
SHA25613a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3
SHA51283cbc641d4a32cb2e8a92c5bb8a7e57e024be7ce977896997cff70e9cb307f7038a40085192d0160058fb195e49e817dcf2cc19286773121a4ec9b2a1e41681c
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
658KB
MD5c46b0c1ead56ed1933dd375b6b22e1f2
SHA197f05c8a9847e8e396d5916deb831466111ae2a4
SHA25613a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3
SHA51283cbc641d4a32cb2e8a92c5bb8a7e57e024be7ce977896997cff70e9cb307f7038a40085192d0160058fb195e49e817dcf2cc19286773121a4ec9b2a1e41681c
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
658KB
MD5c46b0c1ead56ed1933dd375b6b22e1f2
SHA197f05c8a9847e8e396d5916deb831466111ae2a4
SHA25613a9b67591848e9500b93b7e22a11e0adaee46774b55f6a3c1e543b4d7cc3fd3
SHA51283cbc641d4a32cb2e8a92c5bb8a7e57e024be7ce977896997cff70e9cb307f7038a40085192d0160058fb195e49e817dcf2cc19286773121a4ec9b2a1e41681c
-
memory/844-61-0x0000000000000000-mapping.dmp
-
memory/1172-57-0x0000000000000000-mapping.dmp
-
memory/1492-54-0x0000000074C81000-0x0000000074C83000-memory.dmpFilesize
8KB