Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01-07-2022 05:17
Behavioral task
behavioral1
Sample
fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe
Resource
win10v2004-20220414-en
General
-
Target
fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe
-
Size
690KB
-
MD5
8c3d9ce08799aa0c07ceb6b50f626d28
-
SHA1
3d82bce6926365c9c19cb5bad5a2c8e155b6a171
-
SHA256
fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8
-
SHA512
5e39cb5728c39930871cef521c7656ee491f26e60cc8243b7665da501dd2a8a1e40245198011a23daacefa771e51e1f99d6914e60564fdec488483ebbb6acf21
Malware Config
Extracted
darkcomet
Sazan
seximamun.duckdns.org:1604
DC_MUTEX-CGHFZD9
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
PaiZlau2UT6i
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 3488 msdcsc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exemsdcsc.exeiexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" iexplore.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
msdcsc.exedescription pid process target process PID 3488 set thread context of 3220 3488 msdcsc.exe iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exemsdcsc.exeiexplore.exedescription pid process Token: SeIncreaseQuotaPrivilege 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe Token: SeSecurityPrivilege 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe Token: SeTakeOwnershipPrivilege 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe Token: SeLoadDriverPrivilege 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe Token: SeSystemProfilePrivilege 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe Token: SeSystemtimePrivilege 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe Token: SeProfSingleProcessPrivilege 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe Token: SeIncBasePriorityPrivilege 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe Token: SeCreatePagefilePrivilege 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe Token: SeBackupPrivilege 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe Token: SeRestorePrivilege 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe Token: SeShutdownPrivilege 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe Token: SeDebugPrivilege 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe Token: SeSystemEnvironmentPrivilege 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe Token: SeChangeNotifyPrivilege 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe Token: SeRemoteShutdownPrivilege 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe Token: SeUndockPrivilege 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe Token: SeManageVolumePrivilege 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe Token: SeImpersonatePrivilege 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe Token: SeCreateGlobalPrivilege 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe Token: 33 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe Token: 34 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe Token: 35 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe Token: 36 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe Token: SeIncreaseQuotaPrivilege 3488 msdcsc.exe Token: SeSecurityPrivilege 3488 msdcsc.exe Token: SeTakeOwnershipPrivilege 3488 msdcsc.exe Token: SeLoadDriverPrivilege 3488 msdcsc.exe Token: SeSystemProfilePrivilege 3488 msdcsc.exe Token: SeSystemtimePrivilege 3488 msdcsc.exe Token: SeProfSingleProcessPrivilege 3488 msdcsc.exe Token: SeIncBasePriorityPrivilege 3488 msdcsc.exe Token: SeCreatePagefilePrivilege 3488 msdcsc.exe Token: SeBackupPrivilege 3488 msdcsc.exe Token: SeRestorePrivilege 3488 msdcsc.exe Token: SeShutdownPrivilege 3488 msdcsc.exe Token: SeDebugPrivilege 3488 msdcsc.exe Token: SeSystemEnvironmentPrivilege 3488 msdcsc.exe Token: SeChangeNotifyPrivilege 3488 msdcsc.exe Token: SeRemoteShutdownPrivilege 3488 msdcsc.exe Token: SeUndockPrivilege 3488 msdcsc.exe Token: SeManageVolumePrivilege 3488 msdcsc.exe Token: SeImpersonatePrivilege 3488 msdcsc.exe Token: SeCreateGlobalPrivilege 3488 msdcsc.exe Token: 33 3488 msdcsc.exe Token: 34 3488 msdcsc.exe Token: 35 3488 msdcsc.exe Token: 36 3488 msdcsc.exe Token: SeIncreaseQuotaPrivilege 3220 iexplore.exe Token: SeSecurityPrivilege 3220 iexplore.exe Token: SeTakeOwnershipPrivilege 3220 iexplore.exe Token: SeLoadDriverPrivilege 3220 iexplore.exe Token: SeSystemProfilePrivilege 3220 iexplore.exe Token: SeSystemtimePrivilege 3220 iexplore.exe Token: SeProfSingleProcessPrivilege 3220 iexplore.exe Token: SeIncBasePriorityPrivilege 3220 iexplore.exe Token: SeCreatePagefilePrivilege 3220 iexplore.exe Token: SeBackupPrivilege 3220 iexplore.exe Token: SeRestorePrivilege 3220 iexplore.exe Token: SeShutdownPrivilege 3220 iexplore.exe Token: SeDebugPrivilege 3220 iexplore.exe Token: SeSystemEnvironmentPrivilege 3220 iexplore.exe Token: SeChangeNotifyPrivilege 3220 iexplore.exe Token: SeRemoteShutdownPrivilege 3220 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
iexplore.exepid process 3220 iexplore.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exemsdcsc.exedescription pid process target process PID 4848 wrote to memory of 3036 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe notepad.exe PID 4848 wrote to memory of 3036 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe notepad.exe PID 4848 wrote to memory of 3036 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe notepad.exe PID 4848 wrote to memory of 3036 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe notepad.exe PID 4848 wrote to memory of 3036 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe notepad.exe PID 4848 wrote to memory of 3036 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe notepad.exe PID 4848 wrote to memory of 3036 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe notepad.exe PID 4848 wrote to memory of 3036 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe notepad.exe PID 4848 wrote to memory of 3036 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe notepad.exe PID 4848 wrote to memory of 3036 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe notepad.exe PID 4848 wrote to memory of 3036 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe notepad.exe PID 4848 wrote to memory of 3036 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe notepad.exe PID 4848 wrote to memory of 3036 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe notepad.exe PID 4848 wrote to memory of 3036 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe notepad.exe PID 4848 wrote to memory of 3036 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe notepad.exe PID 4848 wrote to memory of 3036 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe notepad.exe PID 4848 wrote to memory of 3036 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe notepad.exe PID 4848 wrote to memory of 3488 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe msdcsc.exe PID 4848 wrote to memory of 3488 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe msdcsc.exe PID 4848 wrote to memory of 3488 4848 fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe msdcsc.exe PID 3488 wrote to memory of 3220 3488 msdcsc.exe iexplore.exe PID 3488 wrote to memory of 3220 3488 msdcsc.exe iexplore.exe PID 3488 wrote to memory of 3220 3488 msdcsc.exe iexplore.exe PID 3488 wrote to memory of 3220 3488 msdcsc.exe iexplore.exe PID 3488 wrote to memory of 3220 3488 msdcsc.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe"C:\Users\Admin\AppData\Local\Temp\fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
690KB
MD58c3d9ce08799aa0c07ceb6b50f626d28
SHA13d82bce6926365c9c19cb5bad5a2c8e155b6a171
SHA256fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8
SHA5125e39cb5728c39930871cef521c7656ee491f26e60cc8243b7665da501dd2a8a1e40245198011a23daacefa771e51e1f99d6914e60564fdec488483ebbb6acf21
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
690KB
MD58c3d9ce08799aa0c07ceb6b50f626d28
SHA13d82bce6926365c9c19cb5bad5a2c8e155b6a171
SHA256fc90b85e15d5d314d4a0c4a7f73e7eff48390720ad8b3c25de51b82296d97ff8
SHA5125e39cb5728c39930871cef521c7656ee491f26e60cc8243b7665da501dd2a8a1e40245198011a23daacefa771e51e1f99d6914e60564fdec488483ebbb6acf21
-
memory/3036-130-0x0000000000000000-mapping.dmp
-
memory/3488-131-0x0000000000000000-mapping.dmp