Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
25-07-2022 00:14
Behavioral task
behavioral1
Sample
731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe
Resource
win7-20220718-en
General
-
Target
731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe
-
Size
690KB
-
MD5
b5bdc77d7de04cee9d59999367b19759
-
SHA1
362fb65eb92228033d0f1f263ad26a33a43a443f
-
SHA256
731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c
-
SHA512
ad4e94c0a3fdc48efde1294d54004c89f07b36bb109a41826942a018b44030690a4d381e26992082dedd3dcfbe05c6ed4ef4523b11ea7758fc6691a00a8cb195
Malware Config
Extracted
darkcomet
Yarik
kolgah.ddns.net:1604
DC_MUTEX-YM0NEUT
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
pozsQkwcSLKX
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 1056 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 1380 attrib.exe 1360 attrib.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 992 notepad.exe -
Loads dropped DLL 2 IoCs
Processes:
731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exepid process 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe Token: SeSecurityPrivilege 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe Token: SeTakeOwnershipPrivilege 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe Token: SeLoadDriverPrivilege 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe Token: SeSystemProfilePrivilege 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe Token: SeSystemtimePrivilege 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe Token: SeProfSingleProcessPrivilege 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe Token: SeIncBasePriorityPrivilege 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe Token: SeCreatePagefilePrivilege 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe Token: SeBackupPrivilege 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe Token: SeRestorePrivilege 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe Token: SeShutdownPrivilege 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe Token: SeDebugPrivilege 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe Token: SeSystemEnvironmentPrivilege 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe Token: SeChangeNotifyPrivilege 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe Token: SeRemoteShutdownPrivilege 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe Token: SeUndockPrivilege 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe Token: SeManageVolumePrivilege 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe Token: SeImpersonatePrivilege 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe Token: SeCreateGlobalPrivilege 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe Token: 33 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe Token: 34 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe Token: 35 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe Token: SeIncreaseQuotaPrivilege 1056 msdcsc.exe Token: SeSecurityPrivilege 1056 msdcsc.exe Token: SeTakeOwnershipPrivilege 1056 msdcsc.exe Token: SeLoadDriverPrivilege 1056 msdcsc.exe Token: SeSystemProfilePrivilege 1056 msdcsc.exe Token: SeSystemtimePrivilege 1056 msdcsc.exe Token: SeProfSingleProcessPrivilege 1056 msdcsc.exe Token: SeIncBasePriorityPrivilege 1056 msdcsc.exe Token: SeCreatePagefilePrivilege 1056 msdcsc.exe Token: SeBackupPrivilege 1056 msdcsc.exe Token: SeRestorePrivilege 1056 msdcsc.exe Token: SeShutdownPrivilege 1056 msdcsc.exe Token: SeDebugPrivilege 1056 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1056 msdcsc.exe Token: SeChangeNotifyPrivilege 1056 msdcsc.exe Token: SeRemoteShutdownPrivilege 1056 msdcsc.exe Token: SeUndockPrivilege 1056 msdcsc.exe Token: SeManageVolumePrivilege 1056 msdcsc.exe Token: SeImpersonatePrivilege 1056 msdcsc.exe Token: SeCreateGlobalPrivilege 1056 msdcsc.exe Token: 33 1056 msdcsc.exe Token: 34 1056 msdcsc.exe Token: 35 1056 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 1056 msdcsc.exe -
Suspicious use of WriteProcessMemory 61 IoCs
Processes:
731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.execmd.execmd.exemsdcsc.exedescription pid process target process PID 1924 wrote to memory of 1512 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe cmd.exe PID 1924 wrote to memory of 1512 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe cmd.exe PID 1924 wrote to memory of 1512 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe cmd.exe PID 1924 wrote to memory of 1512 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe cmd.exe PID 1924 wrote to memory of 1284 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe cmd.exe PID 1924 wrote to memory of 1284 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe cmd.exe PID 1924 wrote to memory of 1284 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe cmd.exe PID 1924 wrote to memory of 1284 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe cmd.exe PID 1924 wrote to memory of 992 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe notepad.exe PID 1924 wrote to memory of 992 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe notepad.exe PID 1924 wrote to memory of 992 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe notepad.exe PID 1924 wrote to memory of 992 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe notepad.exe PID 1512 wrote to memory of 1380 1512 cmd.exe attrib.exe PID 1512 wrote to memory of 1380 1512 cmd.exe attrib.exe PID 1512 wrote to memory of 1380 1512 cmd.exe attrib.exe PID 1512 wrote to memory of 1380 1512 cmd.exe attrib.exe PID 1924 wrote to memory of 992 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe notepad.exe PID 1924 wrote to memory of 992 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe notepad.exe PID 1924 wrote to memory of 992 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe notepad.exe PID 1924 wrote to memory of 992 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe notepad.exe PID 1924 wrote to memory of 992 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe notepad.exe PID 1924 wrote to memory of 992 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe notepad.exe PID 1924 wrote to memory of 992 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe notepad.exe PID 1924 wrote to memory of 992 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe notepad.exe PID 1924 wrote to memory of 992 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe notepad.exe PID 1924 wrote to memory of 992 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe notepad.exe PID 1924 wrote to memory of 992 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe notepad.exe PID 1924 wrote to memory of 992 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe notepad.exe PID 1924 wrote to memory of 992 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe notepad.exe PID 1924 wrote to memory of 992 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe notepad.exe PID 1284 wrote to memory of 1360 1284 cmd.exe attrib.exe PID 1284 wrote to memory of 1360 1284 cmd.exe attrib.exe PID 1284 wrote to memory of 1360 1284 cmd.exe attrib.exe PID 1284 wrote to memory of 1360 1284 cmd.exe attrib.exe PID 1924 wrote to memory of 1056 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe msdcsc.exe PID 1924 wrote to memory of 1056 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe msdcsc.exe PID 1924 wrote to memory of 1056 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe msdcsc.exe PID 1924 wrote to memory of 1056 1924 731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe msdcsc.exe PID 1056 wrote to memory of 1400 1056 msdcsc.exe notepad.exe PID 1056 wrote to memory of 1400 1056 msdcsc.exe notepad.exe PID 1056 wrote to memory of 1400 1056 msdcsc.exe notepad.exe PID 1056 wrote to memory of 1400 1056 msdcsc.exe notepad.exe PID 1056 wrote to memory of 1400 1056 msdcsc.exe notepad.exe PID 1056 wrote to memory of 1400 1056 msdcsc.exe notepad.exe PID 1056 wrote to memory of 1400 1056 msdcsc.exe notepad.exe PID 1056 wrote to memory of 1400 1056 msdcsc.exe notepad.exe PID 1056 wrote to memory of 1400 1056 msdcsc.exe notepad.exe PID 1056 wrote to memory of 1400 1056 msdcsc.exe notepad.exe PID 1056 wrote to memory of 1400 1056 msdcsc.exe notepad.exe PID 1056 wrote to memory of 1400 1056 msdcsc.exe notepad.exe PID 1056 wrote to memory of 1400 1056 msdcsc.exe notepad.exe PID 1056 wrote to memory of 1400 1056 msdcsc.exe notepad.exe PID 1056 wrote to memory of 1400 1056 msdcsc.exe notepad.exe PID 1056 wrote to memory of 1400 1056 msdcsc.exe notepad.exe PID 1056 wrote to memory of 1400 1056 msdcsc.exe notepad.exe PID 1056 wrote to memory of 1400 1056 msdcsc.exe notepad.exe PID 1056 wrote to memory of 1400 1056 msdcsc.exe notepad.exe PID 1056 wrote to memory of 1400 1056 msdcsc.exe notepad.exe PID 1056 wrote to memory of 1400 1056 msdcsc.exe notepad.exe PID 1056 wrote to memory of 1400 1056 msdcsc.exe notepad.exe PID 1056 wrote to memory of 1400 1056 msdcsc.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1380 attrib.exe 1360 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe"C:\Users\Admin\AppData\Local\Temp\731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
690KB
MD5b5bdc77d7de04cee9d59999367b19759
SHA1362fb65eb92228033d0f1f263ad26a33a43a443f
SHA256731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c
SHA512ad4e94c0a3fdc48efde1294d54004c89f07b36bb109a41826942a018b44030690a4d381e26992082dedd3dcfbe05c6ed4ef4523b11ea7758fc6691a00a8cb195
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
690KB
MD5b5bdc77d7de04cee9d59999367b19759
SHA1362fb65eb92228033d0f1f263ad26a33a43a443f
SHA256731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c
SHA512ad4e94c0a3fdc48efde1294d54004c89f07b36bb109a41826942a018b44030690a4d381e26992082dedd3dcfbe05c6ed4ef4523b11ea7758fc6691a00a8cb195
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
690KB
MD5b5bdc77d7de04cee9d59999367b19759
SHA1362fb65eb92228033d0f1f263ad26a33a43a443f
SHA256731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c
SHA512ad4e94c0a3fdc48efde1294d54004c89f07b36bb109a41826942a018b44030690a4d381e26992082dedd3dcfbe05c6ed4ef4523b11ea7758fc6691a00a8cb195
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
690KB
MD5b5bdc77d7de04cee9d59999367b19759
SHA1362fb65eb92228033d0f1f263ad26a33a43a443f
SHA256731bf93dd8c38122503a1d07c57060bfbbeb0456f6148762dabd8481982f6a2c
SHA512ad4e94c0a3fdc48efde1294d54004c89f07b36bb109a41826942a018b44030690a4d381e26992082dedd3dcfbe05c6ed4ef4523b11ea7758fc6691a00a8cb195
-
memory/992-57-0x0000000000000000-mapping.dmp
-
memory/1056-63-0x0000000000000000-mapping.dmp
-
memory/1284-56-0x0000000000000000-mapping.dmp
-
memory/1360-60-0x0000000000000000-mapping.dmp
-
memory/1380-58-0x0000000000000000-mapping.dmp
-
memory/1400-67-0x0000000000000000-mapping.dmp
-
memory/1512-55-0x0000000000000000-mapping.dmp
-
memory/1924-54-0x0000000076201000-0x0000000076203000-memory.dmpFilesize
8KB