Analysis
-
max time kernel
154s -
max time network
164s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
31-07-2022 10:26
Static task
static1
Behavioral task
behavioral1
Sample
5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe
Resource
win7-20220715-en
General
-
Target
5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe
-
Size
1.1MB
-
MD5
051f250fd72cdbdc953e3c4d836cb514
-
SHA1
44d427d84c48cc3fd86d887150f0bbe732cae430
-
SHA256
5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef
-
SHA512
6c6901b0c34a0aac6f2a9022545385bfd235c1337f01758dc7a084da2305f805383334544b18cdba1c2bc7a732cddc4a1cfcf58cb9f2d4549e7a4e6b1ec0134a
Malware Config
Extracted
darkcomet
n19
e44.no-ip.biz:1337
DC_MUTEX-BTMHVCZ
-
gencode
b79tyFR0J2jW
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe -
Executes dropped EXE 1 IoCs
Processes:
5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exepid process 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe -
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Loads dropped DLL 1 IoCs
Processes:
5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exepid process 1752 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "\"C:\\Users\\Admin\\AppData\\Roaming\\V5FC58ZRWSGT43M3\\Gemon\\Product Version\\WindowsUpdate.exe\"" 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exedescription pid process target process PID 1752 set thread context of 748 1752 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exedescription pid process Token: SeIncreaseQuotaPrivilege 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeSecurityPrivilege 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeTakeOwnershipPrivilege 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeLoadDriverPrivilege 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeSystemProfilePrivilege 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeSystemtimePrivilege 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeProfSingleProcessPrivilege 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeIncBasePriorityPrivilege 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeCreatePagefilePrivilege 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeBackupPrivilege 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeRestorePrivilege 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeShutdownPrivilege 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeDebugPrivilege 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeSystemEnvironmentPrivilege 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeChangeNotifyPrivilege 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeRemoteShutdownPrivilege 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeUndockPrivilege 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeManageVolumePrivilege 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeImpersonatePrivilege 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeCreateGlobalPrivilege 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: 33 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: 34 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: 35 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exepid process 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe -
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.execmd.exedescription pid process target process PID 1752 wrote to memory of 748 1752 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe PID 1752 wrote to memory of 748 1752 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe PID 1752 wrote to memory of 748 1752 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe PID 1752 wrote to memory of 748 1752 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe PID 1752 wrote to memory of 748 1752 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe PID 1752 wrote to memory of 748 1752 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe PID 1752 wrote to memory of 748 1752 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe PID 1752 wrote to memory of 748 1752 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe PID 1752 wrote to memory of 748 1752 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe PID 1752 wrote to memory of 748 1752 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe PID 1752 wrote to memory of 748 1752 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe PID 1752 wrote to memory of 748 1752 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe PID 1752 wrote to memory of 748 1752 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe PID 748 wrote to memory of 1940 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe cmd.exe PID 748 wrote to memory of 1940 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe cmd.exe PID 748 wrote to memory of 1940 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe cmd.exe PID 748 wrote to memory of 1940 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe cmd.exe PID 748 wrote to memory of 880 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 748 wrote to memory of 880 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 748 wrote to memory of 880 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 748 wrote to memory of 880 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 748 wrote to memory of 880 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 748 wrote to memory of 880 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 748 wrote to memory of 880 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 748 wrote to memory of 880 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 748 wrote to memory of 880 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 748 wrote to memory of 880 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 748 wrote to memory of 880 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 748 wrote to memory of 880 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 748 wrote to memory of 880 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 748 wrote to memory of 880 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 748 wrote to memory of 880 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 748 wrote to memory of 880 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 748 wrote to memory of 880 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 748 wrote to memory of 880 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 748 wrote to memory of 880 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 748 wrote to memory of 880 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 748 wrote to memory of 880 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 748 wrote to memory of 880 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 748 wrote to memory of 880 748 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 1940 wrote to memory of 2032 1940 cmd.exe attrib.exe PID 1940 wrote to memory of 2032 1940 cmd.exe attrib.exe PID 1940 wrote to memory of 2032 1940 cmd.exe attrib.exe PID 1940 wrote to memory of 2032 1940 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe"C:\Users\Admin\AppData\Local\Temp\5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exeC:\Users\Admin\AppData\Local\Temp\5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe2⤵
- Modifies firewall policy service
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exeFilesize
1.1MB
MD5051f250fd72cdbdc953e3c4d836cb514
SHA144d427d84c48cc3fd86d887150f0bbe732cae430
SHA2565fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef
SHA5126c6901b0c34a0aac6f2a9022545385bfd235c1337f01758dc7a084da2305f805383334544b18cdba1c2bc7a732cddc4a1cfcf58cb9f2d4549e7a4e6b1ec0134a
-
\Users\Admin\AppData\Local\Temp\5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exeFilesize
1.1MB
MD5051f250fd72cdbdc953e3c4d836cb514
SHA144d427d84c48cc3fd86d887150f0bbe732cae430
SHA2565fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef
SHA5126c6901b0c34a0aac6f2a9022545385bfd235c1337f01758dc7a084da2305f805383334544b18cdba1c2bc7a732cddc4a1cfcf58cb9f2d4549e7a4e6b1ec0134a
-
memory/748-68-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/748-79-0x000000000048F000-0x0000000000491000-memory.dmpFilesize
8KB
-
memory/748-58-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/748-59-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/748-61-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/748-63-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/748-65-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/748-67-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/748-80-0x0000000000401000-0x000000000048F000-memory.dmpFilesize
568KB
-
memory/748-70-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/748-73-0x000000000048F888-mapping.dmp
-
memory/748-78-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/748-72-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/748-75-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/880-82-0x0000000000000000-mapping.dmp
-
memory/1752-77-0x0000000074E30000-0x00000000753DB000-memory.dmpFilesize
5.7MB
-
memory/1752-55-0x0000000074E30000-0x00000000753DB000-memory.dmpFilesize
5.7MB
-
memory/1752-56-0x0000000074E30000-0x00000000753DB000-memory.dmpFilesize
5.7MB
-
memory/1752-54-0x0000000076961000-0x0000000076963000-memory.dmpFilesize
8KB
-
memory/1940-81-0x0000000000000000-mapping.dmp
-
memory/2032-83-0x0000000000000000-mapping.dmp