Analysis
-
max time kernel
41s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
14-07-2022 00:39
Static task
static1
Behavioral task
behavioral1
Sample
492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe
-
Size
276KB
-
MD5
a3429a9d44f94019d94339631a2a2c39
-
SHA1
3b63dbf0a6f044c1cb728b79c15c784d6a107f09
-
SHA256
492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3
-
SHA512
d1ae73c9a78cb569ec6ab76ae8b6f941aa441dbbe9d821c690ea3e369d093c2655aa78a9cdd736df9b5ead8f1c962f64d4cad5ffccfabffa3eac6d7e3f04af7a
Malware Config
Extracted
Family
darkcomet
Botnet
Guest16
C2
127.0.0.1:1604
Mutex
DC_MUTEX-2TRH0QQ
Attributes
-
gencode
fYebg7ya0k9F
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exeiexplore.exedescription pid process target process PID 1448 set thread context of 1796 1448 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe PID 1796 set thread context of 2004 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe iexplore.exe PID 2004 set thread context of 1712 2004 iexplore.exe iexplore.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exedescription pid process Token: SeIncreaseQuotaPrivilege 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe Token: SeSecurityPrivilege 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe Token: SeTakeOwnershipPrivilege 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe Token: SeLoadDriverPrivilege 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe Token: SeSystemProfilePrivilege 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe Token: SeSystemtimePrivilege 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe Token: SeProfSingleProcessPrivilege 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe Token: SeIncBasePriorityPrivilege 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe Token: SeCreatePagefilePrivilege 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe Token: SeBackupPrivilege 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe Token: SeRestorePrivilege 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe Token: SeShutdownPrivilege 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe Token: SeDebugPrivilege 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe Token: SeSystemEnvironmentPrivilege 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe Token: SeChangeNotifyPrivilege 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe Token: SeRemoteShutdownPrivilege 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe Token: SeUndockPrivilege 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe Token: SeManageVolumePrivilege 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe Token: SeImpersonatePrivilege 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe Token: SeCreateGlobalPrivilege 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe Token: 33 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe Token: 34 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe Token: 35 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exeiexplore.exepid process 1448 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe 2004 iexplore.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exeiexplore.exedescription pid process target process PID 1448 wrote to memory of 1796 1448 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe PID 1448 wrote to memory of 1796 1448 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe PID 1448 wrote to memory of 1796 1448 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe PID 1448 wrote to memory of 1796 1448 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe PID 1448 wrote to memory of 1796 1448 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe PID 1448 wrote to memory of 1796 1448 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe PID 1448 wrote to memory of 1796 1448 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe PID 1448 wrote to memory of 1796 1448 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe PID 1796 wrote to memory of 2004 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe iexplore.exe PID 1796 wrote to memory of 2004 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe iexplore.exe PID 1796 wrote to memory of 2004 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe iexplore.exe PID 1796 wrote to memory of 2004 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe iexplore.exe PID 1796 wrote to memory of 2004 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe iexplore.exe PID 1796 wrote to memory of 2004 1796 492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe iexplore.exe PID 2004 wrote to memory of 1712 2004 iexplore.exe iexplore.exe PID 2004 wrote to memory of 1712 2004 iexplore.exe iexplore.exe PID 2004 wrote to memory of 1712 2004 iexplore.exe iexplore.exe PID 2004 wrote to memory of 1712 2004 iexplore.exe iexplore.exe PID 2004 wrote to memory of 1712 2004 iexplore.exe iexplore.exe PID 2004 wrote to memory of 1712 2004 iexplore.exe iexplore.exe PID 2004 wrote to memory of 1712 2004 iexplore.exe iexplore.exe PID 2004 wrote to memory of 1712 2004 iexplore.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe"C:\Users\Admin\AppData\Local\Temp\492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exeC:\Users\Admin\AppData\Local\Temp\492c4e86ab5eed732e29f109cb48dbef64ca7471cd2e6ab61e01f879397576e3.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"4⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1448-54-0x0000000000400000-0x0000000000600000-memory.dmpFilesize
2.0MB
-
memory/1448-57-0x0000000000400000-0x0000000000600000-memory.dmpFilesize
2.0MB
-
memory/1448-58-0x0000000000020000-0x0000000000023000-memory.dmpFilesize
12KB
-
memory/1448-63-0x0000000000400000-0x0000000000600000-memory.dmpFilesize
2.0MB
-
memory/1796-59-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1796-60-0x0000000000401000-mapping.dmp
-
memory/1796-62-0x0000000074DE1000-0x0000000074DE3000-memory.dmpFilesize
8KB
-
memory/1796-64-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1796-65-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1796-68-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1796-70-0x0000000000240000-0x0000000000243000-memory.dmpFilesize
12KB
-
memory/1796-69-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB