Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
20-07-2022 16:48
Static task
static1
Behavioral task
behavioral1
Sample
4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe
Resource
win7-20220715-en
General
-
Target
4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe
-
Size
439KB
-
MD5
7970df345b3ee305ac6b4b028ee1d552
-
SHA1
d0c2b3ae5b4fad875a24fb80786797366647151b
-
SHA256
4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452
-
SHA512
214c2dbb52d82aae810327e9f8d20594db3aa89fb1b2ae5d0d639a5a9cf554dc56dc1b8dd22a6d82b489cdd17345990519ec9deb12e9dda3e24c7843c5cb8f75
Malware Config
Extracted
darkcomet
Guest16
minsuport.duckdns.org:3333
DC_MUTEX-TZSLN7R
-
gencode
KexhufRKN03t
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Processes:
resource yara_rule behavioral1/memory/888-56-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/888-59-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/888-60-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1956-66-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1956-68-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1956-69-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1956-71-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/888-72-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1956-73-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1956-75-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1956-76-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1956-79-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Drops startup file 1 IoCs
Processes:
4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scvshots.lnk 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exedescription pid process target process PID 1108 set thread context of 888 1108 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe PID 888 set thread context of 1956 888 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXEdescription pid process Token: SeIncreaseQuotaPrivilege 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeSecurityPrivilege 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeTakeOwnershipPrivilege 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeLoadDriverPrivilege 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeSystemProfilePrivilege 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeSystemtimePrivilege 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeProfSingleProcessPrivilege 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeIncBasePriorityPrivilege 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeCreatePagefilePrivilege 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeBackupPrivilege 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeRestorePrivilege 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeShutdownPrivilege 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeDebugPrivilege 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeSystemEnvironmentPrivilege 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeChangeNotifyPrivilege 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeRemoteShutdownPrivilege 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeUndockPrivilege 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeManageVolumePrivilege 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeImpersonatePrivilege 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeCreateGlobalPrivilege 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: 33 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: 34 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: 35 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXEpid process 1108 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 888 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXEdescription pid process target process PID 1108 wrote to memory of 888 1108 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe PID 1108 wrote to memory of 888 1108 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe PID 1108 wrote to memory of 888 1108 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe PID 1108 wrote to memory of 888 1108 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe PID 1108 wrote to memory of 888 1108 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe PID 1108 wrote to memory of 888 1108 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe PID 1108 wrote to memory of 888 1108 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe PID 1108 wrote to memory of 888 1108 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe PID 1108 wrote to memory of 888 1108 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe PID 888 wrote to memory of 1956 888 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE PID 888 wrote to memory of 1956 888 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE PID 888 wrote to memory of 1956 888 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE PID 888 wrote to memory of 1956 888 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE PID 888 wrote to memory of 1956 888 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE PID 888 wrote to memory of 1956 888 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE PID 888 wrote to memory of 1956 888 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE PID 888 wrote to memory of 1956 888 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE PID 1956 wrote to memory of 804 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 1956 wrote to memory of 804 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 1956 wrote to memory of 804 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 1956 wrote to memory of 804 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 1956 wrote to memory of 804 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 1956 wrote to memory of 804 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 1956 wrote to memory of 804 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 1956 wrote to memory of 804 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 1956 wrote to memory of 804 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 1956 wrote to memory of 804 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 1956 wrote to memory of 804 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 1956 wrote to memory of 804 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 1956 wrote to memory of 804 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 1956 wrote to memory of 804 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 1956 wrote to memory of 804 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 1956 wrote to memory of 804 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 1956 wrote to memory of 804 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 1956 wrote to memory of 804 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 1956 wrote to memory of 804 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 1956 wrote to memory of 804 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 1956 wrote to memory of 804 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 1956 wrote to memory of 804 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 1956 wrote to memory of 804 1956 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe"C:\Users\Admin\AppData\Local\Temp\4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe"C:\Users\Admin\AppData\Local\Temp\4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe"2⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE"C:\Users\Admin\AppData\Local\Temp\4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/804-77-0x0000000000000000-mapping.dmp
-
memory/888-57-0x0000000000409660-mapping.dmp
-
memory/888-56-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/888-59-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/888-60-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/888-63-0x00000000762A1000-0x00000000762A3000-memory.dmpFilesize
8KB
-
memory/888-72-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1956-69-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1956-68-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1956-70-0x00000000004B5670-mapping.dmp
-
memory/1956-71-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1956-66-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1956-73-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1956-75-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1956-76-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1956-65-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1956-79-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB