Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
26-07-2022 09:28
Behavioral task
behavioral1
Sample
6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe
Resource
win7-20220715-en
General
-
Target
6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe
-
Size
349KB
-
MD5
a95e3e4dbedcc98e826cc682ef8b3fd6
-
SHA1
54008e19ea4b5b4a452905fa5f7d78b3ecfbfe6e
-
SHA256
6aaa5a53455217ab61faeb5f0f57fb643f594af50ae613275db528119e3f3715
-
SHA512
b73e4c4834e0b9de45c0efa8d589264e06b5f858bd393732fde1813c0d64ccc5e054625eaad5dd054f15d34e529d30a5505f84443e749640c5d68b00a8c4c4f5
Malware Config
Extracted
darkcomet
22
kvejo991.ddns.net:1604
DC_MUTEX-B50G4BJ
-
InstallPath
MSDCSC\explorer.exe
-
gencode
JLac09ou37rj
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
explorer
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\explorer.exe" 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" explorer.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" explorer.exe -
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe -
Executes dropped EXE 1 IoCs
Processes:
explorer.exepid process 1364 explorer.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 852 attrib.exe 1732 attrib.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\MSDCSC\explorer.exe upx \Users\Admin\AppData\Roaming\MSDCSC\explorer.exe upx C:\Users\Admin\AppData\Roaming\MSDCSC\explorer.exe upx C:\Users\Admin\AppData\Roaming\MSDCSC\explorer.exe upx behavioral1/memory/1752-69-0x0000000000400000-0x00000000004E8000-memory.dmp upx behavioral1/memory/1364-71-0x0000000000400000-0x00000000004E8000-memory.dmp upx behavioral1/memory/1364-72-0x0000000000400000-0x00000000004E8000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 1956 notepad.exe -
Loads dropped DLL 2 IoCs
Processes:
6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exepid process 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe -
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exeexplorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\explorer.exe" 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\explorer.exe" explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exeexplorer.exedescription pid process Token: SeIncreaseQuotaPrivilege 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeSecurityPrivilege 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeTakeOwnershipPrivilege 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeLoadDriverPrivilege 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeSystemProfilePrivilege 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeSystemtimePrivilege 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeProfSingleProcessPrivilege 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeIncBasePriorityPrivilege 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeCreatePagefilePrivilege 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeBackupPrivilege 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeRestorePrivilege 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeShutdownPrivilege 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeDebugPrivilege 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeSystemEnvironmentPrivilege 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeChangeNotifyPrivilege 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeRemoteShutdownPrivilege 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeUndockPrivilege 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeManageVolumePrivilege 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeImpersonatePrivilege 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeCreateGlobalPrivilege 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: 33 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: 34 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: 35 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe Token: SeIncreaseQuotaPrivilege 1364 explorer.exe Token: SeSecurityPrivilege 1364 explorer.exe Token: SeTakeOwnershipPrivilege 1364 explorer.exe Token: SeLoadDriverPrivilege 1364 explorer.exe Token: SeSystemProfilePrivilege 1364 explorer.exe Token: SeSystemtimePrivilege 1364 explorer.exe Token: SeProfSingleProcessPrivilege 1364 explorer.exe Token: SeIncBasePriorityPrivilege 1364 explorer.exe Token: SeCreatePagefilePrivilege 1364 explorer.exe Token: SeBackupPrivilege 1364 explorer.exe Token: SeRestorePrivilege 1364 explorer.exe Token: SeShutdownPrivilege 1364 explorer.exe Token: SeDebugPrivilege 1364 explorer.exe Token: SeSystemEnvironmentPrivilege 1364 explorer.exe Token: SeChangeNotifyPrivilege 1364 explorer.exe Token: SeRemoteShutdownPrivilege 1364 explorer.exe Token: SeUndockPrivilege 1364 explorer.exe Token: SeManageVolumePrivilege 1364 explorer.exe Token: SeImpersonatePrivilege 1364 explorer.exe Token: SeCreateGlobalPrivilege 1364 explorer.exe Token: 33 1364 explorer.exe Token: 34 1364 explorer.exe Token: 35 1364 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
explorer.exepid process 1364 explorer.exe -
Suspicious use of WriteProcessMemory 61 IoCs
Processes:
6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.execmd.execmd.exeexplorer.exedescription pid process target process PID 1752 wrote to memory of 2008 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe cmd.exe PID 1752 wrote to memory of 2008 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe cmd.exe PID 1752 wrote to memory of 2008 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe cmd.exe PID 1752 wrote to memory of 2008 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe cmd.exe PID 1752 wrote to memory of 1960 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe cmd.exe PID 1752 wrote to memory of 1960 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe cmd.exe PID 1752 wrote to memory of 1960 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe cmd.exe PID 1752 wrote to memory of 1960 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe cmd.exe PID 1752 wrote to memory of 1956 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 1752 wrote to memory of 1956 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 1752 wrote to memory of 1956 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 1752 wrote to memory of 1956 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 2008 wrote to memory of 852 2008 cmd.exe attrib.exe PID 2008 wrote to memory of 852 2008 cmd.exe attrib.exe PID 2008 wrote to memory of 852 2008 cmd.exe attrib.exe PID 2008 wrote to memory of 852 2008 cmd.exe attrib.exe PID 1752 wrote to memory of 1956 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 1752 wrote to memory of 1956 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 1752 wrote to memory of 1956 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 1752 wrote to memory of 1956 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 1752 wrote to memory of 1956 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 1752 wrote to memory of 1956 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 1752 wrote to memory of 1956 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 1752 wrote to memory of 1956 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 1752 wrote to memory of 1956 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 1752 wrote to memory of 1956 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 1752 wrote to memory of 1956 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 1752 wrote to memory of 1956 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 1752 wrote to memory of 1956 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 1752 wrote to memory of 1956 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe notepad.exe PID 1960 wrote to memory of 1732 1960 cmd.exe attrib.exe PID 1960 wrote to memory of 1732 1960 cmd.exe attrib.exe PID 1960 wrote to memory of 1732 1960 cmd.exe attrib.exe PID 1960 wrote to memory of 1732 1960 cmd.exe attrib.exe PID 1752 wrote to memory of 1364 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe explorer.exe PID 1752 wrote to memory of 1364 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe explorer.exe PID 1752 wrote to memory of 1364 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe explorer.exe PID 1752 wrote to memory of 1364 1752 6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe explorer.exe PID 1364 wrote to memory of 1768 1364 explorer.exe notepad.exe PID 1364 wrote to memory of 1768 1364 explorer.exe notepad.exe PID 1364 wrote to memory of 1768 1364 explorer.exe notepad.exe PID 1364 wrote to memory of 1768 1364 explorer.exe notepad.exe PID 1364 wrote to memory of 1768 1364 explorer.exe notepad.exe PID 1364 wrote to memory of 1768 1364 explorer.exe notepad.exe PID 1364 wrote to memory of 1768 1364 explorer.exe notepad.exe PID 1364 wrote to memory of 1768 1364 explorer.exe notepad.exe PID 1364 wrote to memory of 1768 1364 explorer.exe notepad.exe PID 1364 wrote to memory of 1768 1364 explorer.exe notepad.exe PID 1364 wrote to memory of 1768 1364 explorer.exe notepad.exe PID 1364 wrote to memory of 1768 1364 explorer.exe notepad.exe PID 1364 wrote to memory of 1768 1364 explorer.exe notepad.exe PID 1364 wrote to memory of 1768 1364 explorer.exe notepad.exe PID 1364 wrote to memory of 1768 1364 explorer.exe notepad.exe PID 1364 wrote to memory of 1768 1364 explorer.exe notepad.exe PID 1364 wrote to memory of 1768 1364 explorer.exe notepad.exe PID 1364 wrote to memory of 1768 1364 explorer.exe notepad.exe PID 1364 wrote to memory of 1768 1364 explorer.exe notepad.exe PID 1364 wrote to memory of 1768 1364 explorer.exe notepad.exe PID 1364 wrote to memory of 1768 1364 explorer.exe notepad.exe PID 1364 wrote to memory of 1768 1364 explorer.exe notepad.exe PID 1364 wrote to memory of 1768 1364 explorer.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 852 attrib.exe 1732 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe"C:\Users\Admin\AppData\Local\Temp\6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\6AAA5A53455217AB61FAEB5F0F57FB643F594AF50AE61.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\Users\Admin\AppData\Roaming\MSDCSC\explorer.exe"C:\Users\Admin\AppData\Roaming\MSDCSC\explorer.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\MSDCSC\explorer.exeFilesize
349KB
MD5a95e3e4dbedcc98e826cc682ef8b3fd6
SHA154008e19ea4b5b4a452905fa5f7d78b3ecfbfe6e
SHA2566aaa5a53455217ab61faeb5f0f57fb643f594af50ae613275db528119e3f3715
SHA512b73e4c4834e0b9de45c0efa8d589264e06b5f858bd393732fde1813c0d64ccc5e054625eaad5dd054f15d34e529d30a5505f84443e749640c5d68b00a8c4c4f5
-
C:\Users\Admin\AppData\Roaming\MSDCSC\explorer.exeFilesize
349KB
MD5a95e3e4dbedcc98e826cc682ef8b3fd6
SHA154008e19ea4b5b4a452905fa5f7d78b3ecfbfe6e
SHA2566aaa5a53455217ab61faeb5f0f57fb643f594af50ae613275db528119e3f3715
SHA512b73e4c4834e0b9de45c0efa8d589264e06b5f858bd393732fde1813c0d64ccc5e054625eaad5dd054f15d34e529d30a5505f84443e749640c5d68b00a8c4c4f5
-
\Users\Admin\AppData\Roaming\MSDCSC\explorer.exeFilesize
349KB
MD5a95e3e4dbedcc98e826cc682ef8b3fd6
SHA154008e19ea4b5b4a452905fa5f7d78b3ecfbfe6e
SHA2566aaa5a53455217ab61faeb5f0f57fb643f594af50ae613275db528119e3f3715
SHA512b73e4c4834e0b9de45c0efa8d589264e06b5f858bd393732fde1813c0d64ccc5e054625eaad5dd054f15d34e529d30a5505f84443e749640c5d68b00a8c4c4f5
-
\Users\Admin\AppData\Roaming\MSDCSC\explorer.exeFilesize
349KB
MD5a95e3e4dbedcc98e826cc682ef8b3fd6
SHA154008e19ea4b5b4a452905fa5f7d78b3ecfbfe6e
SHA2566aaa5a53455217ab61faeb5f0f57fb643f594af50ae613275db528119e3f3715
SHA512b73e4c4834e0b9de45c0efa8d589264e06b5f858bd393732fde1813c0d64ccc5e054625eaad5dd054f15d34e529d30a5505f84443e749640c5d68b00a8c4c4f5
-
memory/852-58-0x0000000000000000-mapping.dmp
-
memory/1364-63-0x0000000000000000-mapping.dmp
-
memory/1364-71-0x0000000000400000-0x00000000004E8000-memory.dmpFilesize
928KB
-
memory/1364-72-0x0000000000400000-0x00000000004E8000-memory.dmpFilesize
928KB
-
memory/1732-60-0x0000000000000000-mapping.dmp
-
memory/1752-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmpFilesize
8KB
-
memory/1752-69-0x0000000000400000-0x00000000004E8000-memory.dmpFilesize
928KB
-
memory/1752-70-0x00000000039F0000-0x0000000003AD8000-memory.dmpFilesize
928KB
-
memory/1768-67-0x0000000000000000-mapping.dmp
-
memory/1956-57-0x0000000000000000-mapping.dmp
-
memory/1960-56-0x0000000000000000-mapping.dmp
-
memory/2008-55-0x0000000000000000-mapping.dmp