Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
resource tags
arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system -
submitted
20-07-2022 16:48
Static task
static1
Behavioral task
behavioral1
Sample
4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe
Resource
win7-20220715-en
General
-
Target
4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe
-
Size
439KB
-
MD5
7970df345b3ee305ac6b4b028ee1d552
-
SHA1
d0c2b3ae5b4fad875a24fb80786797366647151b
-
SHA256
4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452
-
SHA512
214c2dbb52d82aae810327e9f8d20594db3aa89fb1b2ae5d0d639a5a9cf554dc56dc1b8dd22a6d82b489cdd17345990519ec9deb12e9dda3e24c7843c5cb8f75
Malware Config
Extracted
darkcomet
Guest16
minsuport.duckdns.org:3333
DC_MUTEX-TZSLN7R
-
gencode
KexhufRKN03t
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4296-133-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4296-135-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4296-136-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4388-140-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4388-141-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4296-142-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4388-143-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4388-144-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4388-146-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Drops startup file 1 IoCs
Processes:
4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scvshots.lnk 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exedescription pid process target process PID 4180 set thread context of 4296 4180 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe PID 4296 set thread context of 4388 4296 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXEdescription pid process Token: SeIncreaseQuotaPrivilege 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeSecurityPrivilege 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeTakeOwnershipPrivilege 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeLoadDriverPrivilege 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeSystemProfilePrivilege 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeSystemtimePrivilege 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeProfSingleProcessPrivilege 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeIncBasePriorityPrivilege 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeCreatePagefilePrivilege 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeBackupPrivilege 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeRestorePrivilege 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeShutdownPrivilege 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeDebugPrivilege 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeSystemEnvironmentPrivilege 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeChangeNotifyPrivilege 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeRemoteShutdownPrivilege 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeUndockPrivilege 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeManageVolumePrivilege 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeImpersonatePrivilege 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: SeCreateGlobalPrivilege 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: 33 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: 34 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: 35 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE Token: 36 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXEpid process 4180 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4296 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXEdescription pid process target process PID 4180 wrote to memory of 4296 4180 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe PID 4180 wrote to memory of 4296 4180 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe PID 4180 wrote to memory of 4296 4180 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe PID 4180 wrote to memory of 4296 4180 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe PID 4180 wrote to memory of 4296 4180 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe PID 4180 wrote to memory of 4296 4180 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe PID 4180 wrote to memory of 4296 4180 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe PID 4180 wrote to memory of 4296 4180 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe PID 4296 wrote to memory of 4388 4296 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE PID 4296 wrote to memory of 4388 4296 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE PID 4296 wrote to memory of 4388 4296 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE PID 4296 wrote to memory of 4388 4296 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE PID 4296 wrote to memory of 4388 4296 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE PID 4296 wrote to memory of 4388 4296 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE PID 4296 wrote to memory of 4388 4296 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE PID 4296 wrote to memory of 4388 4296 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE PID 4388 wrote to memory of 2968 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 4388 wrote to memory of 2968 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 4388 wrote to memory of 2968 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 4388 wrote to memory of 2968 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 4388 wrote to memory of 2968 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 4388 wrote to memory of 2968 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 4388 wrote to memory of 2968 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 4388 wrote to memory of 2968 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 4388 wrote to memory of 2968 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 4388 wrote to memory of 2968 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 4388 wrote to memory of 2968 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 4388 wrote to memory of 2968 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 4388 wrote to memory of 2968 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 4388 wrote to memory of 2968 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 4388 wrote to memory of 2968 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 4388 wrote to memory of 2968 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 4388 wrote to memory of 2968 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 4388 wrote to memory of 2968 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 4388 wrote to memory of 2968 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 4388 wrote to memory of 2968 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 4388 wrote to memory of 2968 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe PID 4388 wrote to memory of 2968 4388 4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe"C:\Users\Admin\AppData\Local\Temp\4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe"C:\Users\Admin\AppData\Local\Temp\4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.exe"2⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE"C:\Users\Admin\AppData\Local\Temp\4eb0e9fe8a9f823d5498797b99c0d7c21a2cc4cfdf7808560040b2116b9dd452.EXE"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2968-145-0x0000000000000000-mapping.dmp
-
memory/4296-132-0x0000000000000000-mapping.dmp
-
memory/4296-133-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4296-135-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4296-136-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4296-142-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4388-139-0x0000000000000000-mapping.dmp
-
memory/4388-140-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4388-141-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4388-143-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4388-144-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4388-146-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB