Analysis
-
max time kernel
153s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
31-07-2022 07:47
Static task
static1
Behavioral task
behavioral1
Sample
5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe
Resource
win10v2004-20220721-en
General
-
Target
5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe
-
Size
381KB
-
MD5
48d1ef130b75aac8d5e6869d895b2ce8
-
SHA1
824b9c87c189f487f3a77a805cb1a20d3df03de3
-
SHA256
5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349
-
SHA512
5bb039172ab860556ba0dfb7c19bb093c1ba75db36038caf5939c5187548cb866fdd1707613d4116979980897ab071551329e4913aeba30c067777c4b43e1ee8
Malware Config
Extracted
darkcomet
JDB
ogparm.no-ip.org:1604
DC_MUTEX-GE44X6V
-
gencode
HNF9l7VodZpQ
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exedescription pid process target process PID 1880 set thread context of 2600 1880 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cvtres.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
cvtres.exedescription pid process Token: SeIncreaseQuotaPrivilege 2600 cvtres.exe Token: SeSecurityPrivilege 2600 cvtres.exe Token: SeTakeOwnershipPrivilege 2600 cvtres.exe Token: SeLoadDriverPrivilege 2600 cvtres.exe Token: SeSystemProfilePrivilege 2600 cvtres.exe Token: SeSystemtimePrivilege 2600 cvtres.exe Token: SeProfSingleProcessPrivilege 2600 cvtres.exe Token: SeIncBasePriorityPrivilege 2600 cvtres.exe Token: SeCreatePagefilePrivilege 2600 cvtres.exe Token: SeBackupPrivilege 2600 cvtres.exe Token: SeRestorePrivilege 2600 cvtres.exe Token: SeShutdownPrivilege 2600 cvtres.exe Token: SeDebugPrivilege 2600 cvtres.exe Token: SeSystemEnvironmentPrivilege 2600 cvtres.exe Token: SeChangeNotifyPrivilege 2600 cvtres.exe Token: SeRemoteShutdownPrivilege 2600 cvtres.exe Token: SeUndockPrivilege 2600 cvtres.exe Token: SeManageVolumePrivilege 2600 cvtres.exe Token: SeImpersonatePrivilege 2600 cvtres.exe Token: SeCreateGlobalPrivilege 2600 cvtres.exe Token: 33 2600 cvtres.exe Token: 34 2600 cvtres.exe Token: 35 2600 cvtres.exe Token: 36 2600 cvtres.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
cvtres.exepid process 2600 cvtres.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.execmd.exedescription pid process target process PID 1880 wrote to memory of 2860 1880 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cmd.exe PID 1880 wrote to memory of 2860 1880 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cmd.exe PID 1880 wrote to memory of 2860 1880 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cmd.exe PID 1880 wrote to memory of 3856 1880 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cmd.exe PID 1880 wrote to memory of 3856 1880 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cmd.exe PID 1880 wrote to memory of 3856 1880 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cmd.exe PID 2860 wrote to memory of 2004 2860 cmd.exe reg.exe PID 2860 wrote to memory of 2004 2860 cmd.exe reg.exe PID 2860 wrote to memory of 2004 2860 cmd.exe reg.exe PID 1880 wrote to memory of 2600 1880 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cvtres.exe PID 1880 wrote to memory of 2600 1880 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cvtres.exe PID 1880 wrote to memory of 2600 1880 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cvtres.exe PID 1880 wrote to memory of 2600 1880 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cvtres.exe PID 1880 wrote to memory of 2600 1880 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cvtres.exe PID 1880 wrote to memory of 2600 1880 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cvtres.exe PID 1880 wrote to memory of 2600 1880 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cvtres.exe PID 1880 wrote to memory of 2600 1880 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cvtres.exe PID 1880 wrote to memory of 2600 1880 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cvtres.exe PID 1880 wrote to memory of 2600 1880 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cvtres.exe PID 1880 wrote to memory of 2600 1880 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cvtres.exe PID 1880 wrote to memory of 2600 1880 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cvtres.exe PID 1880 wrote to memory of 2600 1880 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cvtres.exe PID 1880 wrote to memory of 2600 1880 5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe cvtres.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe"C:\Users\Admin\AppData\Local\Temp\5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v WindowsDefender /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v WindowsDefender /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe3⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c copy C:\Users\Admin\AppData\Local\Temp\5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe C:\Users\Admin\AppData\Local\Temp\5ffd8b673b47b76d5e1f08008a1bd8b97e74b7660d7057c1ddbc37a47ef97349.exe /Y & exit2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1880-130-0x0000000074AC0000-0x0000000075071000-memory.dmpFilesize
5.7MB
-
memory/1880-138-0x0000000074AC0000-0x0000000075071000-memory.dmpFilesize
5.7MB
-
memory/2004-133-0x0000000000000000-mapping.dmp
-
memory/2600-134-0x0000000000000000-mapping.dmp
-
memory/2600-135-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2600-136-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2600-137-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2600-139-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2600-140-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2860-131-0x0000000000000000-mapping.dmp
-
memory/3856-132-0x0000000000000000-mapping.dmp