Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
31-07-2022 07:47
Static task
static1
Behavioral task
behavioral1
Sample
5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe
Resource
win10v2004-20220721-en
General
-
Target
5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe
-
Size
381KB
-
MD5
48d1ef130b75aac8d5e6869d895b2ce8
-
SHA1
824b9c87c189f487f3a77a805cb1a20d3df03de3
-
SHA256
5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349
-
SHA512
5bb039172ab860556ba0dfb7c19bb093c1ba75db36038caf5939c5187548cb866fdd1707613d4116979980897ab071551329e4913aeba30c067777c4b43e1ee8
Malware Config
Extracted
darkcomet
JDB
ogparm.no-ip.org:1604
DC_MUTEX-GE44X6V
-
gencode
HNF9l7VodZpQ
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exedescription pid process target process PID 2044 set thread context of 960 2044 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cvtres.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
cvtres.exedescription pid process Token: SeIncreaseQuotaPrivilege 960 cvtres.exe Token: SeSecurityPrivilege 960 cvtres.exe Token: SeTakeOwnershipPrivilege 960 cvtres.exe Token: SeLoadDriverPrivilege 960 cvtres.exe Token: SeSystemProfilePrivilege 960 cvtres.exe Token: SeSystemtimePrivilege 960 cvtres.exe Token: SeProfSingleProcessPrivilege 960 cvtres.exe Token: SeIncBasePriorityPrivilege 960 cvtres.exe Token: SeCreatePagefilePrivilege 960 cvtres.exe Token: SeBackupPrivilege 960 cvtres.exe Token: SeRestorePrivilege 960 cvtres.exe Token: SeShutdownPrivilege 960 cvtres.exe Token: SeDebugPrivilege 960 cvtres.exe Token: SeSystemEnvironmentPrivilege 960 cvtres.exe Token: SeChangeNotifyPrivilege 960 cvtres.exe Token: SeRemoteShutdownPrivilege 960 cvtres.exe Token: SeUndockPrivilege 960 cvtres.exe Token: SeManageVolumePrivilege 960 cvtres.exe Token: SeImpersonatePrivilege 960 cvtres.exe Token: SeCreateGlobalPrivilege 960 cvtres.exe Token: 33 960 cvtres.exe Token: 34 960 cvtres.exe Token: 35 960 cvtres.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
cvtres.exepid process 960 cvtres.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.execmd.exedescription pid process target process PID 2044 wrote to memory of 1652 2044 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cmd.exe PID 2044 wrote to memory of 1652 2044 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cmd.exe PID 2044 wrote to memory of 1652 2044 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cmd.exe PID 2044 wrote to memory of 1652 2044 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cmd.exe PID 2044 wrote to memory of 1264 2044 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cmd.exe PID 2044 wrote to memory of 1264 2044 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cmd.exe PID 2044 wrote to memory of 1264 2044 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cmd.exe PID 2044 wrote to memory of 1264 2044 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cmd.exe PID 1652 wrote to memory of 1320 1652 cmd.exe reg.exe PID 1652 wrote to memory of 1320 1652 cmd.exe reg.exe PID 1652 wrote to memory of 1320 1652 cmd.exe reg.exe PID 1652 wrote to memory of 1320 1652 cmd.exe reg.exe PID 2044 wrote to memory of 960 2044 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cvtres.exe PID 2044 wrote to memory of 960 2044 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cvtres.exe PID 2044 wrote to memory of 960 2044 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cvtres.exe PID 2044 wrote to memory of 960 2044 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cvtres.exe PID 2044 wrote to memory of 960 2044 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cvtres.exe PID 2044 wrote to memory of 960 2044 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cvtres.exe PID 2044 wrote to memory of 960 2044 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cvtres.exe PID 2044 wrote to memory of 960 2044 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cvtres.exe PID 2044 wrote to memory of 960 2044 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cvtres.exe PID 2044 wrote to memory of 960 2044 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cvtres.exe PID 2044 wrote to memory of 960 2044 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cvtres.exe PID 2044 wrote to memory of 960 2044 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cvtres.exe PID 2044 wrote to memory of 960 2044 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cvtres.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe"C:\Users\Admin\AppData\Local\Temp\5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v WindowsDefender /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v WindowsDefender /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe3⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c copy C:\Users\Admin\AppData\Local\Temp\5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe C:\Users\Admin\AppData\Local\Temp\5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe /Y & exit2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/960-69-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/960-78-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/960-64-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/960-79-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/960-66-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/960-59-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/960-60-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/960-75-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/960-80-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/960-74-0x000000000048F888-mapping.dmp
-
memory/960-62-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/960-68-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/960-71-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/960-73-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1264-57-0x0000000000000000-mapping.dmp
-
memory/1320-58-0x0000000000000000-mapping.dmp
-
memory/1652-56-0x0000000000000000-mapping.dmp
-
memory/2044-55-0x00000000742F0000-0x000000007489B000-memory.dmpFilesize
5.7MB
-
memory/2044-54-0x00000000754B1000-0x00000000754B3000-memory.dmpFilesize
8KB
-
memory/2044-76-0x00000000742F0000-0x000000007489B000-memory.dmpFilesize
5.7MB